# KDC has no support for encryption type

**URL:** <https://forum.ansible.com/t/kdc-has-no-support-for-encryption-type/26783>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [February 19, 2018, 11:17am UTC](https://forum.ansible.com/t/kdc-has-no-support-for-encryption-type/26783 "2018-02-19T11:17:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MKPhil](https://avatars.discourse-cdn.com/v4/letter/m/9e8a1a/32.png) [@MKPhil](https://forum.ansible.com/u/MKPhil)\
**Post date:** [February 19, 2018, 11:17am UTC](https://forum.ansible.com/t/kdc-has-no-support-for-encryption-type/26783/1 "2018-02-19T11:17:41Z")

</div>

When connecting from Ansible 2.3.0.0 to Windows 2008 (not R2) running PowerShell 3.0 I’m getting:

`hostname.domain.corp | UNREACHABLE! => { "changed": false, "msg": "kerberos: (('Unspecified GSS failure. Minor code may provide more information', 851968), ('KDC has no support for encryption type', -1765328370)), ssl: 401 Unauthorized. basic auth failed", "unreachable": true }`

The same playbook and account work on Windows 2012 servers on the same domain.

Any thoughts?

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [February 19, 2018, 1:54pm UTC](https://forum.ansible.com/t/kdc-has-no-support-for-encryption-type/26783/2 "2018-02-19T13:54:44Z")

</div>

I believe you can get round this by setting the following in your [ibdefaults] section of your krb5.conf

default\_tgs\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5  
default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5

Hope this helps,

Jon

---

<div class="post-metadata">

**Author:** ![MKPhil](https://avatars.discourse-cdn.com/v4/letter/m/9e8a1a/32.png) [@MKPhil](https://forum.ansible.com/u/MKPhil)\
**Post date:** [February 20, 2018, 9:22am UTC](https://forum.ansible.com/t/kdc-has-no-support-for-encryption-type/26783/3 "2018-02-20T09:22:45Z")

</div>

Thanks - that seems to have done the trick