# Issue with running Ansible playbook against windows. **URL:** \ **Category:** Ansible Project\ **Tags:** windows, aws\ **Created:** [December 14, 2017, 10:44pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297 "2017-12-14T22:44:17Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Alexmil\_Reyes](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@Alexmil\_Reyes](https://forum.ansible.com/u/Alexmil_Reyes)\ **Post date:** [December 14, 2017, 10:44pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/1 "2017-12-14T22:44:17Z")
Hi, Thank you in advance to anyone who helps here. So am unable to run playbooks against our windows AWS instances. I was able to perform a win\_ping but when I attempt to run this task on the same instances that I am able to ping I get an SSL Cert error. I have displayed all relevant information down below, let me know if any other information is required. **PLAYBOOK** ---
**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\ **Post date:** [December 15, 2017, 7:31pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/2 "2017-12-15T19:31:13Z")
Try running “ConfigureRemotingForAnsible.ps1” on the windows host you are trying to manage with Ansible. If that doesn’t work try this command on the ansible host telnet windows-host-name 5985 telnet windows-host-name 5986 If you see “Trying …” but times out, the maybe the network ACL is not opened. ---
**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\ **Post date:** [December 15, 2017, 8:03pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/3 "2017-12-15T20:03:36Z")
You can also try removing the existing listeners and then run ConfigureRemotingForAnsible.ps1 which will recreate the self-signed ssl certificate using the following commands winrm delete winrm/config/Listener?Address=\*+Transport=HTTP winrm delete winrm/config/Listener?Address= **\*** +Transport=HTTPS ---
**Author:** ![Alexmil\_Reyes](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@Alexmil\_Reyes](https://forum.ansible.com/u/Alexmil_Reyes)\ **Post date:** [December 15, 2017, 9:50pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/4 "2017-12-15T21:50:41Z")
Thank you for responding. I am able to telnet to the windows machine without a problem. But the playbook still presented the same error when it was run. I ran the following commands on the windwos machine: winrm delete winrm/config/Listener?Address=\*+Transport=HTTP winrm delete winrm/config/Listener?Address= **\*** +Transport=HTTPS followed up with with the ConfigureRemotingForAnsible.ps1. I was able to telnet and win\_ping but error continues to occur when I run the playbook. ---
**Author:** ![Heather\_Luna](https://avatars.discourse-cdn.com/v4/letter/h/5e9695/32.png) [@Heather\_Luna](https://forum.ansible.com/u/Heather_Luna)\ **Post date:** [December 15, 2017, 10:14pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/5 "2017-12-15T22:14:13Z")
Hey there, I was just cutting my teeth on executing playbooks against Windows. To add to Tony’s piece about the PowerShell script ConfiguringRemotingforAnsible.ps1 which I had to do I also had to pip install the following on the control machine within side my virtualenv: pip install pywinrm pip install pywinrm[kerberos] Source: [http://docs.ansible.com/ansible/latest/intro\_windows.html](http://docs.ansible.com/ansible/latest/intro_windows.html) I’m not sure if this will help you or not but worth a shot if you haven’t already done so yet. Good luck! ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [December 16, 2017, 12:41am UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/6 "2017-12-16T00:41:37Z")
For some reason the ansible\_winrm\_server\_cert\_validation: ignore var is not being set for your Windows host hence the error. Can you test out the following before your win\_stat task when running on the Windows host. - debug: var: ansible\_winrm\_server\_cert\_validation ---
**Author:** ![Alexmil\_Reyes](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@Alexmil\_Reyes](https://forum.ansible.com/u/Alexmil_Reyes)\ **Post date:** [December 18, 2017, 2:57pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/7 "2017-12-18T14:57:14Z")
@jordan I completely agree. Although I have clearly stated in the group\_vars/windwos.yml file to ignore cert validation it does not appear to acknowledge the setting. With the tasks/main.yml file now looking like this: ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [December 18, 2017, 9:19pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/8 "2017-12-18T21:19:04Z")
I believe I may know what is happening and this was fixed in the latest devel branch so you can try that out if you like. Looks like it is failing to gather facts before it gets to your debug task, can you set **gather\_facts: no** in your playbook as I’m really curious if the cert validation is being set properly. A few other things that would be helpful to know - Run **pip list** and post the output - What version of Ansible are you on - What version of Python 2.7 are you on - If you turn on fact gathering, does it would if you explicitly set the ignore var on the stat task like so - win\_stat: path: C:\Users vars: ansible\_winrm\_server\_cert\_validation: ignore Looks like you are using a dynamic inventory for your AWS hosts, instead of having include\_vars to point to the Windows vars file I would create a create an actual windows group in that inventory and add those hosts in there. In the end it would would look something similar to this (untested) # inventory/hosts [tag\_OSType\_Windows] # keep empty, is populated in the dynamic inventory [windows:children] tag\_OSType\_Windows # inventory/ec2.py … keep as normal, just to show how to mix/match dynamic and static inventories # inventory/ec2.ini … keep as normal # group\_vars/windows.yml ansible\_user: username ansible\_password: “#####” ansible\_port: 5986 ansible\_connection: winrm ansible\_winrm\_scheme: https # The following is necessary for Python 2.7.9+ when using default WinRM self-signed certificates: ansible\_winrm\_server\_cert\_validation: ignore # playbooks/windows.yml - name: run test on Windows host hosts: ‘{{target}}’ tasks: - win\_stat: path: C:\Users From there you would add a tag to the newly created instances OSType: Windows so that when Ansible reads it from the inventory it is automatically put in the Windows group. Even though you are running the playbook on the one host it will inherit the group based on that tag which in turn get’s the Windows vars required. Thanks Jordan ---
**Author:** ![Alexmil\_Reyes](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@Alexmil\_Reyes](https://forum.ansible.com/u/Alexmil_Reyes)\ **Post date:** [December 21, 2017, 4:26pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/9 "2017-12-21T16:26:43Z")
Hi Jordan, Thank you for the suggestion on the inventory management. We can currently target any instance based on their tags. here is the command I am using to issue the playbook. _ansible-playbook playbooks/windows.yml -e “target=tag\_product\_cse”_ **Here is the information you requested.** **$ pip list** _DEPRECATION: The default format will switch to columns in the future. You can use --format=(legacy|columns) (or define a format=(legacy|columns) in your pip.conf under the [list] section) to disable this warning._ _ansible (2.3.2.0)_ _aws-amicleaner (0.1.2)_ _awscli (1.11.133)_ _blessings (1.6)_ _boto (2.48.0)_ _boto3 (1.4.6)_ _botocore (1.6.0)_ _certifi (2017.7.27.1)_ _cffi (1.9.1)_ _chardet (3.0.4)_ _colorama (0.3.7)_ _docutils (0.14)_ _ecdsa (0.13)_ _enum34 (1.1.6)_ _futures (3.1.1)_ _httplib2 (0.9.1)_ _hvac (0.3.0)_ _idna (2.5)_ _ipaddress (1.0.18)_ _Jinja2 (2.8)_ _jmespath (0.9.3)_ _kerberos (1.2.5)_ _MarkupSafe (0.23)_ _ntlm-auth (1.0.5)_ _ordereddict (1.1)_ _paramiko (1.16.0)_ _pip (9.0.1)_ _prettytable (0.7.2)_ _pyasn1 (0.2.3)_ _pycparser (2.17)_ _pycrypto (2.6.1)_ _python-dateutil (2.6.1)_ _pywinrm (0.3.0b1)_ _PyYAML (3.12)_ _requests (2.18.3)_ _requests-ntlm (1.0.0)_ _rsa (3.4.2)_ _s3transfer (0.1.10)_ _setuptools (20.7.0)_ _six (1.10.0)_ _termcolor (1.1.0)_ _urllib3 (1.22)_ _virtualenv (15.1.0)_ _wheel (0.29.0)_ _xmltodict (0.11.0)_ **$ ansible --version** _ansible 2.3.2.0_ _config file = /etc/ansible/ansible.cfg_ _configured module search path = Default w/o overrides_ _python version = 2.7.12 (default, Nov 20 2017, 18:23:56) [GCC 5.4.0 20160609]_ **$ python --version** _Python 2.7.12_ **Here are the changes I made to the following files:** _playbooks/windows.yml, roles/windows/task/main.yml, inventory/group\_vars/windows.yml_ **Playbook: playbooks/windows.yml** ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [December 21, 2017, 8:23pm UTC](https://forum.ansible.com/t/issue-with-running-ansible-playbook-against-windows/26297/10 "2017-12-21T20:23:21Z")
I believe your issue is that ansible\_winrm\_server\_cert\_validation is being loaded with your include\_vars directive in the playbook and the way connection vars with Ansible before the current devel branch had a few issues. I would recommend you add [all:vars] ansible\_winrm\_server\_cert\_validation=ignore to your inventory and try again. One more thing you can try is to use the latest checkout of Ansible and see if the issue is still there. Thanks Jordan