# ansible\_ssh\_user and ansible\_ssh\_pass in windows.yml

**URL:** <https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [October 29, 2014, 9:58pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642 "2014-10-29T21:58:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan\_Anderson](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jonathan\_Anderson](https://forum.ansible.com/u/Jonathan_Anderson)\
**Post date:** [October 29, 2014, 9:58pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642/1 "2014-10-29T21:58:04Z")

</div>

Details:  
Ansible 1.8  
CentOs 7  
Windows 7 (not a server os)

[Documentation](http://docs.ansible.com/intro_windows.html#inventory)specifies that for remote nodes running windows we add these definitions to /etc/ansible/group\_vars/windows.yml

```auto
ansible_ssh_user: Administrator
ansible_ssh_pass: SekritPasswordGoesHere
ansible_ssh_port: 5986
ansible_connection: winrm

```

```auto
So does user and pass above refer to the local linux account on the management node or the local windows account on the remote node (windows 7) or is it just part of ansible-vault or something else all together? I think it would have to be the management node account or else if you had 100 remote nodes you would need 100 names and passwords. Am I understanding this correctly? Could someone clarify for me?

```

---

<div class="post-metadata">

**Author:** ![Michael\_Peters](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Michael\_Peters](https://forum.ansible.com/u/Michael_Peters)\
**Post date:** [October 29, 2014, 10:03pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642/2 "2014-10-29T22:03:54Z")

</div>

It will be the remote nodes. In lots of cases these are all the same  
(lots of setups have the same management account with the same  
credentials on the managed nodes). And if you need to specify per-host  
variables for the remote nodes you can do that as well in your  
inventory.

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [October 29, 2014, 10:05pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642/3 "2014-10-29T22:05:00Z")

</div>

It is the username/password combination for the remote nodes (in your case the windows nodes).

You can also configure them in host\_vars, or potentially in a dynamic inventory script that pulls that info from a CMDB or database.

---

<div class="post-metadata">

**Author:** ![Jonathan\_Anderson](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jonathan\_Anderson](https://forum.ansible.com/u/Jonathan_Anderson)\
**Post date:** [October 29, 2014, 10:08pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642/4 "2014-10-29T22:08:38Z")

</div>

So then when I run ansible with the --ask-pass switch and it asks me for SSH password, ansible\_ssh\_pass is the password they want or is that a different password.

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [October 29, 2014, 10:13pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642/5 "2014-10-29T22:13:16Z")

</div>

–ask-pass is the equivalent of specifying a single password for all remote nodes with ansible\_ssh\_pass.

---

<div class="post-metadata">

**Author:** ![Jonathan\_Anderson](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jonathan\_Anderson](https://forum.ansible.com/u/Jonathan_Anderson)\
**Post date:** [April 26, 2015, 1:43am UTC](https://forum.ansible.com/t/ansible-ssh-user-and-ansible-ssh-pass-in-windows-yml/16642/6 "2015-04-26T01:43:49Z")

</div>

Okay this is fixed. The values assigned to the variables “ansible\_ssh\_user” and “ansible\_ssh\_pass” must:

1. Exactly match an account on the windows machine with admin privileges (account must exist but need NOT be current active login)

2. If you are using SSL and the value of winrm/config/service/AllowUnencrypted is true (this is the default) the values in ansible\group\_vars\windows.yml must exactly match the username and password that was submitted to generate the SSL web certificate.

In my case I also had to append the computer name with the port number in the inventory like this

[windows]  
ComputerName:5986

(or 5985 for AllowUnedcrypted=“true” type this command in powershell PS C:\winrm set winrm/config/service ‘@{AllowUnencrypted=“true”}’

done.