# Ansible ping working in some of the servers and not working in some of the list. **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [March 4, 2016, 3:20pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774 "2016-03-04T15:20:58Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Akash\_John](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Akash\_John](https://forum.ansible.com/u/Akash_John)\ **Post date:** [March 4, 2016, 3:20pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/1 "2016-03-04T15:20:58Z")
Hi Team, We have configured ansible to perform activities on windows hosts and all are under the same AD. But some how some of the hosts are not providing positive ping response. Please find the response which we are getting below, **[myserver.data.log.doman.com](http://myserver.data.log.doman.com) | FAILED =\> the username/password specified for this server was incorrect** **Configurations on Ansible** - Host file containing FQDN for each hosts - /etc/ansible/group\_vars/windows.yaml containing ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 5, 2016, 2:23pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/2 "2016-03-05T14:23:51Z")
What version of windows and service pack is on the hosts that won’t respond to ping? Are you using the win\_ping module? win\_ping will connect using the wirnm port, rather than the normal ping port. You might have firewall configured not to respond to the normal ping port on the machines which are not responding. Please ensure [https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1](https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) has been run on the machines that won’t respond. Hope this helps, Jon ---
**Author:** ![Akash\_John](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Akash\_John](https://forum.ansible.com/u/Akash_John)\ **Post date:** [March 7, 2016, 1:52pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/3 "2016-03-07T13:52:49Z")
Hi Hawkesworth, What version of windows and service pack is on the hosts that won’t respond to ping? > **Windows server 2012 R2 Standard,** but all other responding hosts are having same operating system version. Are you using the win\_ping module? win\_ping will connect using the wirnm port, rather than the normal ping port. You might have firewall configured not to respond to the normal ping port on the machines which are not responding. > **Yes, we are using win\_ping module and the port which we are using is 5986. The firewall is configured to enable all port access from ansible server to remote host.** Please ensure [https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1](https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) has been run on the machines that won’t respond. > We ran the script, even after that we are getting the same response. Please let us know if you need to have any other details about the infra. ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 7, 2016, 2:55pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/4 "2016-03-07T14:55:43Z")
What is the exact error message you are seeing? Also try running ansible with -v or -vvvvvv to see connection debugging information. Here are some more suggestions: 1/ In Powershell, running as Administrator, run winrm get winrm/config on a machine that can’t be connected to, and compare the same from a machine that can be connected to. 2/ Check the machines you cannot connect to have a current trust relationship with your domain controller (ensure you can log in with the same domain username and password as ansible is using). Ensure the ansible\_ssh\_user has fully qualified domain name, and the domain part is in UPPER CASE LETTERS ansible\_ssh\_user: [testuser@MY.DOMAIN.COM](mailto:testuser@MY.DOMAIN.COM) Not ansible\_ssh\_user: testuser@MY or ansible\_ssh\_user: [testuser@my.domain.com](mailto:testuser@my.domain.com) 3/ use kinit -C [user@MY.DOMAIN.COM](mailto:user@MY.DOMAIN.COM) to acquire a kerberos ticket, and then use klist to examine the ticket. 4/ ensure the hosts you cannot connect to have clocks synchronized with your AD Domain controllers 5/ ensure the hosts you cannot connect to can be found using both hostname and ip address That is: if you ping hostname, the response gives you an ip address. If you then use that ip address with nslookup, it must return the same hostname, or kerberos will not be able to connect. For example C:\> ping windows-t1 Pinging [windows-t1.my.domain.com](http://windows-t1.my.domain.com) [192.168.1.100] with 32 bytes of data: Reply from 192.168.1.100:… Control-C ^C C:\> nslookup 192.168.1.100 Server: [dc01.my.domain.com](http://dc01.my.domain.com) Address: 192.168.1.50 Name: [windows-t1.my.domain.com](http://windows-t1.my.domain.com) Address: 192.168.1.100 C:\> Hope this helps, Jon ---
**Author:** ![Akash\_John](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Akash\_John](https://forum.ansible.com/u/Akash_John)\ **Post date:** [March 7, 2016, 4:14pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/5 "2016-03-07T16:14:55Z")
Hi Hawkesworth, Thanks for your quick response. Please find the responses below, What is the exact error message you are seeing? > **ansible [hostname.mydomain.com](http://hostname.mydomain.com) -m win\_ping -vvvvvv** > > **\<[hostname.mydomain.com](http://hostname.mydomain.com) \> ESTABLISH WINRM CONNECTION FOR USER: on PORT 5986 TO [hostname.mydomain.com](http://hostname.mydomain.com)** > > **\<[hostname.mydomain.com](http://hostname.mydomain.com) \> WINRM CONNECT: transport=kerberos endpoint=[https://hostname.mydomain.com](https://hostname.mydomain.com) :5986/wsman** > > **[hostname.mydomain.com](http://hostname.mydomain.com) | FAILED =\> the username/password specified for this server was incorrect** 1/ In Powershell, running as Administrator, run winrm get winrm/config > **Both working and not working hosts are giving same out put** 2/ Check the machines you cannot connect to have a current trust relationship with your domain controller (ensure you can log in with the same domain username and password as ansible is using). > **It is working, and the user name is already in the format as you suggested** > **ansible\_ssh\_user: [testuser@MY.DOMAIN.COM](mailto:testuser@MY.DOMAIN.COM)** 3/ use kinit -C [user@MY.DOMAIN.COM](mailto:user@MY.DOMAIN.COM) to acquire a kerberos ticket, and then use klist to examine the ticket. > **I was able to acquire kerberos ticket and the klist is showing necessary data.** > **Ticket cache: KEYRING:persistent:0:0** > **Default principal: [username@CORP.MYDOMAIN.COM](mailto:username@CORP.MYDOMAIN.COM)** > **Valid starting Expires Service principal** > **03/07/2016 11:05:32 03/07/2016 21:05:32 krbtgt/CORP.MYDOMAIN.COM@CORP.MYDOMAIN.COM** > **renew until 03/07/2016 21:05:32** 4/ ensure the hosts you cannot connect to have clocks synchronized with your AD Domain controllers > **Yes, It is since the machine in which i am able to connect to having the same time as in the machine i am not able to connect.** 5/ ensure the hosts you cannot connect to can be found using both hostname and ip address > **Yes, we can found the machines with IP and host names. This was tested using RDP.** Please let me know if you want to have any other details. Thanks, Akash John ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 8, 2016, 12:35pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/6 "2016-03-08T12:35:46Z")
Looks like you have some parent/subdomain relationship going on. In my experience you must use whatever domain name is returned by kinit -C. So kinit -C returns [CORP.MYDOMAIN.COM](http://CORP.MYDOMAIN.COM) in your case - so that is what you need to put in your kinit command line and ansible\_ssh\_user - if not the domains don’t match up and maybe that is why you are getting the ‘the username/password specified for this server is incorrect’ message. Hope this helps, Jon ---
**Author:** ![Akash\_John](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Akash\_John](https://forum.ansible.com/u/Akash_John)\ **Post date:** [March 8, 2016, 1:29pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/7 "2016-03-08T13:29:55Z")
Hi Hawkesworth, kinit -C giving an output as [adusername@CORP.MYDOMAIN.COM](mailto:adusername@CORP.MYDOMAIN.COM) and is prompting for inputting password. I have used the same as you suggested (ansible\_ssh\_user: [adusername@CORP.MYDOMAIN.COM](mailto:adusername@CORP.MYDOMAIN.COM)) and I cannot find any change while executing win\_ping. But, if it is the case how other servers are providing proper response to win\_ping… Do we need to check anything from Windows Server side? Thanks, Akash John ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 8, 2016, 4:08pm UTC](https://forum.ansible.com/t/ansible-ping-working-in-some-of-the-servers-and-not-working-in-some-of-the-list/20774/8 "2016-03-08T16:08:53Z")
Meant to say also need to match the domain names in your /etc/krb5.conf No harm in checking the event logs on the windows hosts, but if the domain of your kerberos ticket doesn’t exactly match the domain that the windows host is on, that might explain why it thinks the username/password is incorrect. Hope this helps, Jon