# Bitten by the command line options **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [February 3, 2017, 2:13pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630 "2017-02-03T14:13:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Noel\_Verhoeven](https://avatars.discourse-cdn.com/v4/letter/n/3da27b/32.png) [@Noel\_Verhoeven](https://forum.ansible.com/u/Noel_Verhoeven)\ **Post date:** [February 3, 2017, 2:13pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/1 "2017-02-03T14:13:30Z")
I’ve been trying to get a new server to work without luck. This windows 2008R2 server has the local Administrator account and an account called AnsibleControlAdmin, member of the Administrators group. In group\_vars, I have a variable called ansible\_user=AnsibleControlAdmin. On the command line I have been trying: [noel.verhoeven@ansible ansible]$ ansible mx01 -m win\_ping -u **Administrator** -k -vvvv Using /home/noel.verhoeven/work/ivv-test/ansible/ansible.cfg as config file SSH password: Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callback/ **init**.pyc Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/windows/win\_ping.ps1le \<192.168.1.12\> ESTABLISH WINRM CONNECTION FOR USER: **AnsibleControlAdmin** on PORT 5985 TO 192.168.1.12 mx01 | UNREACHABLE! =\> { “changed”: false, “msg”: “plaintext: the specified credentials were rejected by the server”, “unreachable”: true } [noel.verhoeven@ansible ansible]$ After a lot of tries, and headscratching I finally notice that the call was made for AnsibleControlAdmin instead of Administrator. Somehow the command line option does not override the group\_var definitions. Googling I see lots of references to this issue, all finally saying that it "\*works as designed"\* and \*"works as intended\*". I sort of cannot disagree, but I guess most people intent to use this differently. Therefore the design is rubbish. I agree that it works as designed. But, who uses ansible without some user defined in the variables? However, this design decision has been very very expensive, costing lots of hours of wasted time. The difference between command line options, and extra vars is far from clear or intuitive. This should be at least somewhere in the documentation page for variable precedence with a big warning. Ansible is a really nice tool, but these simple things make it seem rather unprofessional. Can I please update the documentation? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [February 6, 2017, 3:23pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/2 "2017-02-06T15:23:10Z")
First, let me explain why, hosts are considered 'more specific' than config or command line options. HostA can have an Administrator account, HostB an admin one, the rest of the hosts can have multiple/none configured, as such the command line and config can set a 'default' account with which to try to connect, but specific hosts are allowed to override it. This is a common problem with heterogeneous environments, but it does trip up those that have a homogeneous one as Ansible tries to serve both. FYI, it is already documented here (at the bottom of the section): [http://docs.ansible.com/ansible/playbooks\_variables.html#variable-precedence-where-should-i-put-a-variable](http://docs.ansible.com/ansible/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable) But we are open to better/clearer ways of explaining this, the docs are part of the main repo so you can open a pull request to update them just like any part of the code [https://github.com/ansible/ansible/blob/devel/docs/docsite/rst/playbooks\_variables.rst](https://github.com/ansible/ansible/blob/devel/docs/docsite/rst/playbooks_variables.rst). ---
**Author:** ![Noel\_Verhoeven](https://avatars.discourse-cdn.com/v4/letter/n/3da27b/32.png) [@Noel\_Verhoeven](https://forum.ansible.com/u/Noel_Verhoeven)\ **Post date:** [February 8, 2017, 12:48pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/3 "2017-02-08T12:48:35Z")
Hi Brian, thanks for the explanation. It is clear to me now. I’m currently running a heterogeneous environment so I do have multiple user accounts/passwords for various hosts in the configuration files/vault. But I was experimenting and thought I could override all with the command line. I was not familiar with the piece of text you reference, below the footnotes / notes. That explains things clearly. I guess sometimes the documentation can be overwhelming. One thing I’d like to do is add to the documentation (explaining the ansible command line options) that these command line options do not override theses user settings and maybe reference the piece of doc you pointed to. However, I cannot find an explanation of the command line options in the documentation. Only when you run ansible without arguments you get this list. Am I missing this in the documentation? Noel ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [February 8, 2017, 4:49pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/4 "2017-02-08T16:49:28Z")
The CLI help and man pages document all command line options, the webdocs sometimes document parts of them in appropriate sections i.e. [http://docs.ansible.com/ansible/become.html#new-command-line-options](http://docs.ansible.com/ansible/become.html#new-command-line-options) One final clarification, you CAN override the inventory from the command line, but not via the specific switches, through extra-vars ansible -e 'ansible\_user=xyz' ... Connection vars follow normal variable precedence, so extra\_vars always have the highest precedence and override all other sources. The command line switches override the configs, but not the directives/connection variables as those are considered 'more specific'. It can be a bit confusing, but the system is designed to allow for very complex environments, as such it does assume some of that complexity itself. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [February 8, 2017, 5:18pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/5 "2017-02-08T17:18:45Z")
Hi Brian, > One final clarification, you CAN override the inventory from the > command line, but not via the specific switches, through > extra-vars > > ansible -e 'ansible\_user=xyz' ... I think this bit is missing in the docs. Or rather, many people might be confused what "extra vars" are. Or they might not know the difference between "-e 'ansible\_user=foo'" and "-u foo". This may also be true for other items in the variable precedence list. I guess not that many people have used a "play vars\_prompt". > Connection vars follow normal variable precedence, so extra\_vars > always have the highest precedence and override all other sources. > The command line switches override the configs, but not the > directives/connection variables as those are considered 'more > specific'. I was very pleased to see the very detailed precendence table appear here: [https://docs.ansible.com/ansible/playbooks\_variables.html#variable-precedence-where-should-i-put-a-variable](https://docs.ansible.com/ansible/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable) > It can be a bit confusing, but the system is designed to allow for > very complex environments, as such it does assume some of that > complexity itself. But that's what allows it to do so many wonderful things... 😉 Johannes ---
**Author:** ![Noel\_Verhoeven](https://avatars.discourse-cdn.com/v4/letter/n/3da27b/32.png) [@Noel\_Verhoeven](https://forum.ansible.com/u/Noel_Verhoeven)\ **Post date:** [February 9, 2017, 9:36am UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/6 "2017-02-09T09:36:14Z")
Hi, I hadn’t looked at the “_man ansible_” pages yet. When I do I see for the -u option: “Use this username to login to the target host, instead of the current user.” I guess that is a bit simplistic, and in other than the most basic circumstances not true. I think some more explanation is needed here, And to my opinion, a new entry in the online docs should be present in the basics/introduction part about the “_ansible -help_” CLI options with a bit more explanation and perhaps examples. I’ll be glad to help here, since I’m going to dive in deep the coming months… Noel ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [February 9, 2017, 10:53pm UTC](https://forum.ansible.com/t/bitten-by-the-command-line-options/23630/7 "2017-02-09T22:53:20Z")
Both website docs and man pages are part of the repo, we accept pull requests to improve those also, not just code.