# \[Ansible windows\] "kerberos: authGSSClientStep() failed: (('Unspecified GSS failure. Minor code may provide more information', 851968), ('Generic error (see e-text)', -1765328324))", **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [August 27, 2018, 6:51am UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426 "2018-08-27T06:51:53Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [August 27, 2018, 6:51am UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/1 "2018-08-27T06:51:53Z")
Hi In my company we have a forest with multiple domains, EUR / USA … I can work without any issue with my domain (EUR) with a EUR user Now i’m trying to access a USA server with and got the following failure: ` # ansible-playbook agent.yml --limit [tsthost67.usa.company.com](http://tsthost67.usa.company.com) -vvvv ansible-playbook 2.6.2 config file = /ansible/scripts/ansible.cfg configured module search path = [u’/usr/local/lib/python2.7/dist-packages/ara/plugins/modules’] ansible python module location = /usr/lib/python2.7/dist-packages/ansible executable location = /usr/bin/ansible-playbook python version = 2.7.12 (default, Dec 4 2017, 14:50:18) [GCC 5.4.0 20160609] Using /ansible/scripts/ansible.cfg as config file setting up inventory plugins Parsed /ansible/scripts/inventory/windows.yml inventory source with yaml plugin Loading callback plugin default of type stdout, v2.0 from /usr/lib/python2.7/dist-packages/ansible/plugins/callback/default.pyc Loading callback plugin ara of type notification, v2.0 from /usr/local/lib/python2.7/dist-packages/ara/plugins/callbacks/log\_ara.pyc PLAYBOOK: agent.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 1 plays in agent.yml PLAY [fw] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* Trying secret FileVaultSecret(filename=‘/nfs/site/disks/home30/ansible/.ssh/ansible\_vault.txt’) for vault\_id=default TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /ansible/scripts/agent.yml:2 Using module file /usr/lib/python2.7/dist-packages/ansible/modules/windows/setup.ps1 \<[tsthost67.usa.company.com](http://tsthost67.usa.company.com)\> ESTABLISH WINRM CONNECTION FOR USER: [ansible@eur.company.com](mailto:ansible@eur.company.com) on PORT 5986 TO [tsthost67.usa.company.com](http://tsthost67.usa.company.com) checking if winrm\_host [tsthost67.usa.company.com](http://tsthost67.usa.company.com) is an IPv6 address calling kinit with pexpect for principal [ansible@eur.company.com](mailto:ansible@eur.company.com) fatal: [[tsthost67.usa.company.com](http://tsthost67.usa.company.com)]: UNREACHABLE! =\> { “changed”: false, **“msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Generic error (see e-text)’, -1765328324))”,** “unreachable”: true } to retry, use: --limit @/ansible/scripts/qb-agent-fw.retry PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* [tsthost67.usa.company.com](http://tsthost67.usa.company.com) : ok=0 changed=0 unreachable=1 failed=0 ` my kerberos file: ` # cat /etc/krb5.conf [libdefaults] default\_realm = [EUR.COMPANY.COM](http://EUR.COMPANY.COM) ticket\_lifetime = 36000 renew\_lifetime = 2592000 default\_keytab\_name = /etc/krb5.keytab forwardable = true allow\_weak\_crypto = true dns\_lookup\_realm = false dns\_lookup\_kdc = false default\_tgs\_enctypes = des-cbc-crc arcfour-hmac-md5 default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc preferred\_preauth\_types = des-cbc-crc [domain\_realm] .usa.company.com = [USA.COMPANY.COM](http://USA.COMPANY.COM) … [libvas] use-dns-srv = true use-server-referrals = true [realms] [USA.COMPANY.COM](http://USA.COMPANY.COM) = { default\_domain = [usa.company.com](http://usa.company.com) … } [EUR.COMPANY.COM](http://EUR.COMPANY.COM) = { default\_domain = [eur.company.com](http://eur.company.com) … } ` My group\_vars file: ` ansible\_user: [ansible@EUR.COMPANY.COM](mailto:ansible@EUR.COMPANY.COM) ansible\_password: SECURED\_PASSWORD ansible\_port: 5986 ansible\_connection: winrm ansible\_winrm\_transport: kerberos ansible\_winrm\_scheme: https ansible\_winrm\_server\_cert\_validation: ignore ansible\_winrm\_kerberos\_delegation: true ` How can i access a computer in the USA domain ? ---
**Author:** ![Badraj\_Angirekula](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@Badraj\_Angirekula](https://forum.ansible.com/u/Badraj_Angirekula)\ **Post date:** [August 27, 2018, 9:25am UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/2 "2018-08-27T09:25:55Z")
Hi All, please help me. Build ec2 instances with attaching multiple tags names :- For example- I have launched one ec2 instance with tag name “websever1” the next builds of ec2 instances should start with tag name webserver2 , webserver3 … automatically. Note: No two ec2 instances have same tag name. ---
**Author:** ![S\_C\_Rigler](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@S\_C\_Rigler](https://forum.ansible.com/u/S_C_Rigler)\ **Post date:** [August 27, 2018, 3:40pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/3 "2018-08-27T15:40:32Z")
Badraj, Please start a new topic instead of hijacking an existing one. ---
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [August 27, 2018, 8:16pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/4 "2018-08-27T20:16:45Z")
Using an USA domain user instead of a EUR domain user move me to another issue **“kerberos: Bad HTTP response returned from server. Code 400”** I found out this question here : [https://groups.google.com/forum/#!topic/ansible-project/WJbhN3VYMmI](https://groups.google.com/forum/#!topic/ansible-project/WJbhN3VYMmI) but nothing could help me. I have to say, my first choice would be to use the same user eventually. Thanks Jordan / Jon ? 🙂 ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [August 27, 2018, 9:38pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/5 "2018-08-27T21:38:34Z")
Because you are running over https, message encryption is not being run so that post you linked to is technically unrelated. In saying that, I have no idea about your environment setup, but RC4 and DES are effectively broken and you should avoid using in any case. Unless you have set that on purpose you shouldn’t be allowing weak cryptos. To try and find out what exactly is failing can you run Ansible with KRB5\_TRACE=/dev/stdout set, e.g. ‘ **KRB5\_TRACE=/dev/stdout ansible-playbook agent.yml --limit …** ’. This will make gssapi on that host sent the logs to stdout hopefully giving you a better error. Thanks Jordan ---
**Author:** ![Jeremie\_Levy](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jeremie\_Levy](https://forum.ansible.com/u/Jeremie_Levy)\ **Post date:** [August 28, 2018, 8:46pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/6 "2018-08-28T20:46:47Z")
Hello Jordan I moved from https to http I removed the des kerberos options: # default\_tgs\_enctypes = des-cbc-crc arcfour-hmac-md5 default\_tgs\_enctypes = arcfour-hmac-md5 # default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc default\_tkt\_enctypes = arcfour-hmac-md5 # preferred\_preauth\_types = des-cbc-crc And here is the result of the run - i have to admit this is not helping me much… # KRB5\_TRACE=/dev/stdout ansible-playbook playbooks/win\_test.yml --limit [scststhost67.usa.company.com](http://scststhost67.usa.company.com) -vvvv ansible-playbook 2.6.2 config file = /ansible/scripts/ansible.cfg configured module search path = [u’/usr/local/lib/python2.7/dist-packages/ara/plugins/modules’] ansible python module location = /usr/lib/python2.7/dist-packages/ansible executable location = /usr/bin/ansible-playbook python version = 2.7.12 (default, Dec 4 2017, 14:50:18) [GCC 5.4.0 20160609] Using /ansible/scripts/ansible.cfg as config file setting up inventory plugins Parsed /ansible/scripts/inventory/windows.yml inventory source with yaml plugin Loading callback plugin default of type stdout, v2.0 from /usr/lib/python2.7/dist-packages/ansible/plugins/callback/default.pyc Loading callback plugin ara of type notification, v2.0 from /usr/local/lib/python2.7/dist-packages/ara/plugins/callbacks/log\_ara.pyc PLAYBOOK: win\_test.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 1 plays in playbooks/win\_test.yml PLAY [windows] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* META: ran handlers Trying secret FileVaultSecret(filename=‘/nfs/site/disks/home30/ansible/.ssh/ansible\_vault.txt’) for vault\_id=default TASK [Simple Ping] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /ansible/scripts/playbooks/win\_test.yml:5 Using module file /usr/lib/python2.7/dist-packages/ansible/modules/windows/win\_ping.ps1 \<[scststhost67.usa.company.com](http://scststhost67.usa.company.com)\> ESTABLISH WINRM CONNECTION FOR USER: [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) on PORT 5986 TO [scststhost67.usa.company.com](http://scststhost67.usa.company.com) checking if winrm\_host [scststhost67.usa.company.com](http://scststhost67.usa.company.com) is an IPv6 address calling kinit with pexpect for principal [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) [5574] 1535488714.966934: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.967925: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.968917: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.969845: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.970790: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.974593: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.975957: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.976891: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) from FILE:/etc/krb5/user/30254/client.keytab (vno 0, enctype 0) with result: 2/Key table file ‘/etc/krb5/user/30254/client.keytab’ not found [5574] 1535488714.979603: Getting credentials [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM) using ccache FILE:/tmp/tmpa0pCw0 [5574] 1535488714.979722: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM) from FILE:/tmp/tmpa0pCw0 with result: -1765328243/Matching credential not found [5574] 1535488714.979790: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → krbtgt/[USA.COMPANY.COM@USA.COMPANY.COM](mailto:USA.COMPANY.COM@USA.COMPANY.COM) from FILE:/tmp/tmpa0pCw0 with result: 0/Success [5574] 1535488714.979801: Starting with TGT for client realm: [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → krbtgt/[USA.COMPANY.COM@USA.COMPANY.COM](mailto:USA.COMPANY.COM@USA.COMPANY.COM) [5574] 1535488714.979809: Requesting tickets for HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM), referrals on [5574] 1535488714.979835: Generated subkey for TGS request: rc4-hmac/DA64 [5574] 1535488714.979855: etypes requested in TGS request: rc4-hmac [5574] 1535488714.979986: Encoding request body and padata into FAST request [5574] 1535488714.980151: Sending request (8510 bytes) to [USA.COMPANY.COM](http://USA.COMPANY.COM) [5574] 1535488714.980237: Resolving hostname 10.104.193.41 [5574] 1535488714.980329: Initiating TCP connection to stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488714.980736: Sending TCP request to stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.46929: Received answer (8503 bytes) from stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.46941: Terminating TCP connection to stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.46968: Response was not from master KDC [5574] 1535488715.46992: Decoding FAST response [5574] 1535488715.47089: FAST reply key: rc4-hmac/AD14 [5574] 1535488715.47115: TGS reply is for [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM) with session key rc4-hmac/C716 [5574] 1535488715.47172: TGS request result: 0/Success [5574] 1535488715.47178: Received creds for desired service HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM) [5574] 1535488715.47186: Storing [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM) in FILE:/tmp/tmpa0pCw0 [5574] 1535488715.47336: Retrieving [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → krbtgt/[USA.COMPANY.COM@USA.COMPANY.COM](mailto:USA.COMPANY.COM@USA.COMPANY.COM) from FILE:/tmp/tmpa0pCw0 with result: 0/Success [5574] 1535488715.47345: Get cred via TGT krbtgt/[USA.COMPANY.COM@USA.COMPANY.COM](mailto:USA.COMPANY.COM@USA.COMPANY.COM) after requesting krbtgt/[USA.COMPANY.COM@USA.COMPANY.COM](mailto:USA.COMPANY.COM@USA.COMPANY.COM) (canonicalize off) [5574] 1535488715.47358: Generated subkey for TGS request: rc4-hmac/C5C1 [5574] 1535488715.47368: etypes requested in TGS request: rc4-hmac [5574] 1535488715.47448: Encoding request body and padata into FAST request [5574] 1535488715.47557: Sending request (8526 bytes) to [USA.COMPANY.COM](http://USA.COMPANY.COM) [5574] 1535488715.47614: Resolving hostname 10.104.193.41 [5574] 1535488715.47663: Initiating TCP connection to stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.48125: Sending TCP request to stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.50778: Received answer (8459 bytes) from stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.50796: Terminating TCP connection to stream [10.104.193.41:88](http://10.104.193.41:88) [5574] 1535488715.50831: Response was not from master KDC [5574] 1535488715.50860: Decoding FAST response [5574] 1535488715.51036: FAST reply key: rc4-hmac/E764 [5574] 1535488715.51075: TGS reply is for [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → krbtgt/[USA.COMPANY.COM@USA.COMPANY.COM](mailto:USA.COMPANY.COM@USA.COMPANY.COM) with session key rc4-hmac/B213 [5574] 1535488715.51153: Got cred; 0/Success [5574] 1535488715.51311: Creating authenticator for [usa\_ansible@USA.COMPANY.COM](mailto:usa_ansible@USA.COMPANY.COM) → HTTP/[scststhost67.usa.company.com@USA.COMPANY.COM](mailto:scststhost67.usa.company.com@USA.COMPANY.COM), seqnum 63157312, subkey rc4-hmac/C622, session key rc4-hmac/C716 fatal: [[scststhost67.usa.company.com](http://scststhost67.usa.company.com)]: UNREACHABLE! =\> { “changed”: false, “msg”: “kerberos: (‘Connection aborted.’, error(104, ‘Connection reset by peer’))”, “unreachable”: true } to retry, use: --limit @/ansible/scripts/playbooks/win\_test.retry PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* [scststhost67.usa.company.com](http://scststhost67.usa.company.com) : ok=0 changed=0 unreachable=1 failed=0 Do you have any other advise please? Thanks ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [August 28, 2018, 9:42pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-authgssclientstep-failed-unspecified-gss-failure-minor-code-may-provide-more-information-851968-generic-error-see-e-text-1765328324/28426/7 "2018-08-28T21:42:20Z")
arcfour is RC4 which isn’t supported, problematic, and a broken encryption standard. You should be using at least AES, a list of encryption types in krb5 can be found here [http://web.mit.edu/kerberos/krb5-1.12/doc/admin/enctypes.html#enctype-compatibility](http://web.mit.edu/kerberos/krb5-1.12/doc/admin/enctypes.html#enctype-compatibility).