# Connecting to Windows hosts via winrm Get "KDC has no support for encryption type"

**URL:** <https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695>\
**Category:** AWX Project\
**Tags:** windows, awx\
**Created:** [September 1, 2021, 6:27am UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695 "2021-09-01T06:27:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Calum\_Butler1](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@Calum\_Butler1](https://forum.ansible.com/u/Calum_Butler1)\
**Post date:** [September 1, 2021, 6:27am UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695/1 "2021-09-01T06:27:33Z")

</div>

##### SUMMARY

Connecting to Windows hosts via winrm  
Get “KDC has no support for encryption type”

##### ENVIRONMENT

- AWX version: 19.2.2
- AWX install method: operator
- AWX deployment target:minikube
- Operating System: Rhel\_8\_4.x86\_64
- Web Browser:

##### STEPS TO REPRODUCE

ConfigMap for /etc/krb5.conf is same as working old environment.  
Inventory Variables:  
ansible\_connection: winrm  
ansible\_winrm\_server\_cert\_validation: ignore  
ansible\_port: 5986  
ansible\_winrm\_transport: kerberos  
ansible\_winrm\_scheme: https  
ansible\_winrm\_kerberos\_delegation: true

tasks:

- name: Win Ping (win\_ping)  
win\_ping:

##### EXPECTED RESULTS

connection successful

##### ACTUAL RESULTS

fatal: [Host.hostzone]: UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘KDC has no support for encryption type’, -1765328370))”,  
“unreachable”: true  
}  
This used to work Pre AWX-Operator install

##### ADDITIONAL INFORMATION

from minikube host  
test1:  
openssl s\_client -connect host.hostzove:5986  
Protocol : TLSv1.2  
Cipher : 0000

and test2:  
openssl s\_client -connect host.hostzone:5986 -cipher ‘ECDHE-RSA-AES256-SHA’  
Protocol : TLSv1.2  
Cipher : ECDHE-RSA-AES256-SHA

Not really sure where the error is

---

<div class="post-metadata">

**Author:** ![rcdlinux](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@rcdlinux](https://forum.ansible.com/u/rcdlinux)\
**Post date:** [September 1, 2021, 3:52pm UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695/2 "2021-09-01T15:52:47Z")

</div>

Hi Calum

Try adding the following to your inventory variables/ConfigMap for /etc/krb5.conf:

ansible\_winrm\_message\_encryption: always

Also verify the [kerberos packages are installed.](https://docs.ansible.com/ansible-tower/latest/html/administration/kerberos_auth.html)

Best regards,

---

<div class="post-metadata">

**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\
**Post date:** [September 24, 2021, 6:38pm UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695/3 "2021-09-24T18:38:14Z")

</div>

Running into similar error with 19.2.2 AWX instance, any idea how to add custom krb5.conf file to the environment?  
I am copying custom krb5.conf file as part of AWX docker image build but noticed that some of the entries are getting overwritten when deployed to Kubernetes but I see correct entries with ‘docker run’ command.

Thanks

---

<div class="post-metadata">

**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\
**Post date:** [September 24, 2021, 6:47pm UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695/4 "2021-09-24T18:47:20Z")

</div>

Through the crd. I wrote about this in my blog

[https://weiyentan.github.io/2021/Installing-awx-kubernetes/](https://weiyentan.github.io/2021/Installing-awx-kubernetes/)

Under the heading

## Kerberos Setup

Hth

---

<div class="post-metadata">

**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\
**Post date:** [September 24, 2021, 8:40pm UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695/5 "2021-09-24T20:40:16Z")

</div>

Thanks for the link. Saw that you have the entries as tower\_task\_extra\_volume\_mounts instead of task\_extra\_volume\_mounts, would this make a difference?  
BTW, I am using 19.2.2 with AWX operator version 0.12.0.

---

<div class="post-metadata">

**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\
**Post date:** [September 24, 2021, 8:52pm UTC](https://forum.ansible.com/t/connecting-to-windows-hosts-via-winrm-get-kdc-has-no-support-for-encryption-type/35695/6 "2021-09-24T20:52:50Z")

</div>

I used the same settings for all my upgrades to those iterations. They all worked for me. It might be something to do with your krb5.conf file