# Failing to connect to Windows clients with 1.9.0 -- No credentials cache file found **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [March 27, 2015, 7:05pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861 "2015-03-27T19:05:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Peter\_Loron](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@Peter\_Loron](https://forum.ansible.com/u/Peter_Loron)\ **Post date:** [March 27, 2015, 7:05pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861/1 "2015-03-27T19:05:17Z")
Hello. I’m trying to get going with managing some Windows servers using Ansible. I’ve got Ansible 1.9.0.1 installed on a OS X 10.10 machine. On my Windows client (2012R2), I have run the suggested “ConfigureRemotingForAnsible.ps1” script and I can telnet to 5986 on that machine from my control machine. I have the client defined in a [windows] section in the hosts file, and there is a “group\_vars/windows/settings” file that has the following: ansible\_ssh\_user: Administrator ansible\_ssh\_pass: ansible\_ssh\_port: 5986 ansible\_connection: winrm When I try to do a win\_ping, I get this error: “No credentials cache file found”. I see that it is attempting to use Kerberos to connect, and the control machine is NOT connected to the domain. The client machine is. I’m thinking I need to tell Ansible to not use Kerberos, but I’m not sure how. Full command output below: > ansible windows -m win\_ping -vvvv ESTABLISH WINRM CONNECTION FOR USER: Administrator on PORT 5986 TO srbos1build02 WINRM CONNECT: transport=kerberos endpoint=[https://srbos1build02:5986/wsman](https://srbos1build02:5986/wsman) srbos1build02 | FAILED =\> Traceback (most recent call last): File “/usr/local/Cellar/ansible/1.9.0.1/libexec/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 582, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/local/Cellar/ansible/1.9.0.1/libexec/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 785, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/local/Cellar/ansible/1.9.0.1/libexec/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 960, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/local/Cellar/ansible/1.9.0.1/libexec/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/local/Cellar/ansible/1.9.0.1/libexec/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 147, in connect self.protocol = self.\_winrm\_connect() File “/usr/local/Cellar/ansible/1.9.0.1/libexec/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 101, in \_winrm\_connect protocol.send\_message(‘’) File “build/bdist.macosx-10.10-intel/egg/winrm/protocol.py”, line 190, in send\_message return self.transport.send\_message(message) File “build/bdist.macosx-10.10-intel/egg/winrm/transport.py”, line 219, in send\_message krb\_ticket = KerberosTicket(self.krb\_service) File “build/bdist.macosx-10.10-intel/egg/winrm/transport.py”, line 166, in **init** kerberos.authGSSClientStep(krb\_context, ‘’) GSSError: ((’ Miscellaneous failure (see text)', 851968), (‘No credentials cache file found’, -1765328189)) ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 29, 2015, 9:56pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861/2 "2015-03-29T21:56:25Z")
If I recall, if you have pykerberos installed, winrm will attempt kerberos connection. I guess your options are to remove pykerberos or use knit to acquire a kerberos ticket and connect as a domain user. Hope that helps. Jon ---
**Author:** ![Peter\_Loron](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@Peter\_Loron](https://forum.ansible.com/u/Peter_Loron)\ **Post date:** [March 30, 2015, 9:26pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861/3 "2015-03-30T21:26:22Z")
As far as I know, I do not have pykerberos installed. If I start the default python and do “import kerberos”, it fails. Regardless, there should be an option to force the connection type. ---
**Author:** ![Peter\_Loron](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@Peter\_Loron](https://forum.ansible.com/u/Peter_Loron)\ **Post date:** [March 30, 2015, 10:33pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861/4 "2015-03-30T22:33:31Z")
Well, apparently there’s _some_ kind of python glue installed. I did kinit to acquire a ticket for the appropriate user, and I was able to get it to work. There still needs to be a switch. I don’t want to muck about with kinit every time I want to run playbooks. ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [April 3, 2015, 8:09pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861/5 "2015-04-03T20:09:05Z")
I’m not sure there’s a one-size fits all solution to this. Personally I use a callback plugin to call kinit and acquire the necessary kerberos ticket whenever I start running a playbook. This works for me as I want my ansible controller to be able to work with \> 1 domain. Its not ideal as it will only work for ansible-playbook and not ansible commands. I’ve read that others use a local action to call kinit as their first task and I believe others are happy to have an ansible controller per domain and have kinit set up the kerberos ticket when you log in. Jon ---
**Author:** ![Chris\_Church1](https://avatars.discourse-cdn.com/v4/letter/c/ac8455/32.png) [@Chris\_Church1](https://forum.ansible.com/u/Chris_Church1)\ **Post date:** [April 9, 2015, 7:58pm UTC](https://forum.ansible.com/t/failing-to-connect-to-windows-clients-with-1-9-0-no-credentials-cache-file-found/17861/6 "2015-04-09T19:58:49Z")
A fix has been merged via [https://github.com/ansible/ansible/pull/10664](https://github.com/ansible/ansible/pull/10664) (similar to Jon's changes in [https://github.com/ansible/ansible/pull/10644](https://github.com/ansible/ansible/pull/10644)) and pending docs changes in [https://github.com/ansible/ansible/issues/10665](https://github.com/ansible/ansible/issues/10665). The winrm connection will only try kerberos if it is installed and the username contains @. Anything after the @ would be used to specify the kerberos realm (if pywinrm didn't ignore the realm at the moment). Let me know if it makes sense, gets rid of the error you are experiencing, and/or breaks things horribly.