# Best practices security tower security **URL:** \ **Category:** AWX Project\ **Tags:** windows, awx\ **Created:** [March 27, 2021, 4:37am UTC](https://forum.ansible.com/t/best-practices-security-tower-security/34871 "2021-03-27T04:37:51Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [March 27, 2021, 4:37am UTC](https://forum.ansible.com/t/best-practices-security-tower-security/34871/1 "2021-03-27T04:37:51Z")
I see that in awx/ tower I have made use of schedules. Naturally I have saved credentials in the job template. In the windows world with active directory we have group policy that enforces policies so I guess I would like to emulate like that with awx / tower. I have spoken to a linux engineer about this and they have said that is not a good idea to use saved credentials in Ansible job templates / schedules. If course the jobs I am doing is not impacting…I’d no hard disk setting changes. This is more of a compliance I would love to hear your thoughts on this and what are the use cases for tower schedules / saved credentials for compliance types of activity. Many thanks, Wei-yen ---
**Author:** ![Hrvoje\_Gaspar](https://avatars.discourse-cdn.com/v4/letter/h/3ab097/32.png) [@Hrvoje\_Gaspar](https://forum.ansible.com/u/Hrvoje_Gaspar)\ **Post date:** [March 31, 2021, 11:01am UTC](https://forum.ansible.com/t/best-practices-security-tower-security/34871/2 "2021-03-31T11:01:34Z")
I’m not sure I understand how exactly you are storing credentials. If you are creating a new credential object, stored credentials are encrypted and are perfectly safe to use. If you use plaintext credentials within playbooks themselves, that would be an issue. What exactly are the concerns your Linux engineer raised? Dana subota, 27. ožujka 2021. u 05:37:59 UTC+1 korisnik [weiye...@gmail.com](mailto:weiye...@gmail.com) napisao je: ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [April 5, 2021, 7:42am UTC](https://forum.ansible.com/t/best-practices-security-tower-security/34871/3 "2021-04-05T07:42:31Z")
Basically he was saying that it was better to set up cronjobs on each host to do tasks than to have jobs run from the Ansible AWX host. I personally use Credential objects not vault. What would be good is to know what the use cases of you guys using schedules . How you handle the credential objects being used for each template and uch Do you use individual credentials or a system one? Thanks for the help. regards. Wei-Yen ---
**Author:** ![Daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@Daniel2](https://forum.ansible.com/u/Daniel2)\ **Post date:** [April 6, 2021, 9:13pm UTC](https://forum.ansible.com/t/best-practices-security-tower-security/34871/4 "2021-04-06T21:13:02Z")
Credentials and AWX users are a topic here at my company. Since this is the AWX forum, I recently setup a Survey Question for the password. So like I have an account on all Windows servers, the credential is stored in CyberArk. I start the playbook, go into CyberArk pull the password at that given time and paste it into the survey question at runtime. So you can only know the password if you have rights via Cyberark and no credential is saved in Ansible AWX for any user to try to get to. Regards, Daniel ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [April 6, 2021, 9:17pm UTC](https://forum.ansible.com/t/best-practices-security-tower-security/34871/5 "2021-04-06T21:17:04Z")
Them you Daniel. So you would essentially not use schedules at all because it would mean saving the password in the template…