# Ansible windows kerberos issue **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [January 15, 2016, 6:54pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-issue/20232 "2016-01-15T18:54:39Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Mayur\_Barge](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Mayur\_Barge](https://forum.ansible.com/u/Mayur_Barge)\ **Post date:** [January 15, 2016, 6:54pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-issue/20232/1 "2016-01-15T18:54:39Z")
Hi I’m facing below issue while connecting to windows machine using AD accounts File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 586, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 789, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 968, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect self.protocol = self.\_winrm\_connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 269, in send\_message krb\_ticket = KerberosTicket(self.krb\_service) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 205, in **init** kerberos.authGSSClientStep(krb\_context, ‘’) GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377)) Please help Thanks, Mayur ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [January 18, 2016, 2:09pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-issue/20232/2 "2016-01-18T14:09:14Z")
Hi Mayur, You usually get that message when kerberos is not configured properly on your ansible controller. Please ensure you have followed the setup instructions here: [http://docs.ansible.com/ansible/intro\_windows.html#configuring-kerberos](http://docs.ansible.com/ansible/intro_windows.html#configuring-kerberos) Without this, the ansible controller does cannot connect to your windows domain, because it is unaware of the network location of your windows domain controllers. Hope this helps, Jon ---
**Author:** ![Mayur\_Barge](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Mayur\_Barge](https://forum.ansible.com/u/Mayur_Barge)\ **Post date:** [January 22, 2016, 12:30pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-issue/20232/3 "2016-01-22T12:30:09Z")
Hi Jon, Thanks for your inputs If I manage windows machine using local administrator account then it works. But for AD account following is the error. I can successfully do kinit with domain user and klist displays appropriate ticket ESTABLISH WINRM CONNECTION FOR USER: on PORT 5986 TO win2k8r2-client WINRM CONNECT: transport=kerberos endpoint=[https://win2k8r2-client:5986/wsman](https://win2k8r2-client:5986/wsman) win2k8r2-client | FAILED =\> Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 586, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 789, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 968, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect self.protocol = self.\_winrm\_connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 269, in send\_message krb\_ticket = KerberosTicket(self.krb\_service) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 205, in **init** kerberos.authGSSClientStep(krb\_context, ‘’) GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377)) ---
**Author:** ![Joe\_Levis](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@Joe\_Levis](https://forum.ansible.com/u/Joe_Levis)\ **Post date:** [January 22, 2016, 6:21pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-issue/20232/4 "2016-01-22T18:21:37Z")
Mayur, Make sure your Linux Control Machine is bound to the same domain as your target Windows VM. After much reading and debugging, I realized my Ubuntu server where I was running Ansible was not bound to the Domain. **Another thing…** I had to run the kinit command with the below flags on the Control Machine to get past the auth failures (according to [https://github.com/diyan/pywinrm/issues/36#issuecomment-60175388](https://github.com/diyan/pywinrm/issues/36#issuecomment-60175388)): kinit -l 7d -r 7d -pAf [user@MY.DOMAIN.COM](mailto:user@MY.DOMAIN.COM) **NOTE: I had run the kinit command before, but not with the flags. The forwarding flags of kinit is what got me over the hump.** ---
**Author:** ![Mayur\_Barge](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Mayur\_Barge](https://forum.ansible.com/u/Mayur_Barge)\ **Post date:** [January 23, 2016, 4:19pm UTC](https://forum.ansible.com/t/ansible-windows-kerberos-issue/20232/5 "2016-01-23T16:19:37Z")
I will give it a try and let you know. Thanks in advance for your help !