# Ansible WinRM Connection 'Connection reset by peer' only when Windows Role ADFS/WAP is Installed and Post Configuration Finished **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [June 21, 2017, 3:57pm UTC](https://forum.ansible.com/t/ansible-winrm-connection-connection-reset-by-peer-only-when-windows-role-adfs-wap-is-installed-and-post-configuration-finished/24790 "2017-06-21T15:57:52Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![David\_Baumann](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@David\_Baumann](https://forum.ansible.com/u/David_Baumann)\ **Post date:** [June 21, 2017, 3:57pm UTC](https://forum.ansible.com/t/ansible-winrm-connection-connection-reset-by-peer-only-when-windows-role-adfs-wap-is-installed-and-post-configuration-finished/24790/1 "2017-06-21T15:57:52Z")
Hi i got a realy akward Problem with Ansible(devel) Got Multiple Servers and all works fine with WinRM and Kerberos on Ansible Side until i Install/Configure follow Windows Roles on hosts - Active Directory Federation Service - WebapplicationProxy All Servers are based on the Same VM Template Connection over WinRM first with SSL/Basic Auth for Provisioning then i Switch on the Fly to SSL/Kerberos Basic ansible\_user: username Kerberos ansible\_user: [username@domain.tld](mailto:username@domain.tld) Got always requests.exceptions.ConnectionError: (‘Connection aborted.’, error(104, ‘Connection reset by peer’)) What i found out if i use the FQDN it works both with Basic and Kerberos over SSL on the Server with ADFS/WAP Installed With an IP Address it only works on Server without ADFS or WAP Installed. **More Details and Debugging Writeout under** [https://gist.github.com/daBONDi/4f9a4f6f5feb49fdcb3f7451b92612e9](https://gist.github.com/daBONDi/4f9a4f6f5feb49fdcb3f7451b92612e9) Maybe a some of you find out the same with an ADFS / WAP Server and could help me diagnose it Thanks in advance for you Time David Baumann(daBONDI@Github) [www.davidbaumann.at](http://www.davidbaumann.at) ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [June 23, 2017, 8:05am UTC](https://forum.ansible.com/t/ansible-winrm-connection-connection-reset-by-peer-only-when-windows-role-adfs-wap-is-installed-and-post-configuration-finished/24790/2 "2017-06-23T08:05:38Z")
My guess would be that something about these windows server roles causes some kind of reset or restart of some part of the http stack (which WinRM depends on). I know kerberos needs DNS to work properly - the hostname is important for kerberos for reasons I forget, but it needs to be able to go from ip → hostname and hostname → ip in order to work fully. Is it difficult for you to make use of the hostname in your environment? There are modules now for configuring dns resolution ([https://docs.ansible.com/ansible/win\_dns\_client\_module.html](https://docs.ansible.com/ansible/win_dns_client_module.html)) and also a module for updating DNS [https://docs.ansible.com/ansible/nsupdate\_module.html](https://docs.ansible.com/ansible/nsupdate_module.html) So you might be able to configure things so you can use hostnames from the start. Hope this helps, Jon ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [June 24, 2017, 9:32am UTC](https://forum.ansible.com/t/ansible-winrm-connection-connection-reset-by-peer-only-when-windows-role-adfs-wap-is-installed-and-post-configuration-finished/24790/3 "2017-06-24T09:32:27Z")
ADFS/WAP manipulates http.sys, which is the shared process taking care of winRM, IIS and other http-related calls into the host. I’ve never tested it but it kinda makes sense that there are issues there. ---
**Author:** ![David\_Baumann](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@David\_Baumann](https://forum.ansible.com/u/David_Baumann)\ **Post date:** [June 25, 2017, 3:14pm UTC](https://forum.ansible.com/t/ansible-winrm-connection-connection-reset-by-peer-only-when-windows-role-adfs-wap-is-installed-and-post-configuration-finished/24790/4 "2017-06-25T15:14:40Z")
Yeah i know that is based on http.sys I checked also the http/https binding over netsh and compare them between a working and non working system. Realy no clue why this happening. I put now 3 Days of work into that debugging, now i switch to ensure the dns records are prefilled priorer theh provisioning of the vms, so the issue don’t come up… So looks like no one is using ADFS with Ansible :-). But this is not worth anymore time to debug i think… ---
**Author:** ![Dag\_Wieers](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Dag\_Wieers](https://forum.ansible.com/u/Dag_Wieers)\ **Post date:** [June 28, 2017, 8:24am UTC](https://forum.ansible.com/t/ansible-winrm-connection-connection-reset-by-peer-only-when-windows-role-adfs-wap-is-installed-and-post-configuration-finished/24790/5 "2017-06-28T08:24:07Z")
Just a heads-up, we have a Windows Working Group where things like this can be discussed with the devs. Either on the #ansible-windows IRC channel, or during one of the weekly meetings. You can find more information at:      [https://github.com/ansible/community/tree/master/group-windows](https://github.com/ansible/community/tree/master/group-windows) We definitely can use more Windows experts like you in the WWG, as the interest from the community seems to be growing steadily, as are the open issues and PR numbers 🙂