# Login Credentials were rejected for Computers Attached to Active Directory

**URL:** <https://forum.ansible.com/t/login-credentials-were-rejected-for-computers-attached-to-active-directory/21979>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 10, 2016, 3:55pm UTC](https://forum.ansible.com/t/login-credentials-were-rejected-for-computers-attached-to-active-directory/21979 "2016-07-10T15:55:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajagopal\_Subramania](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@Rajagopal\_Subramania](https://forum.ansible.com/u/Rajagopal_Subramania)\
**Post date:** [July 10, 2016, 3:55pm UTC](https://forum.ansible.com/t/login-credentials-were-rejected-for-computers-attached-to-active-directory/21979/1 "2016-07-10T15:55:46Z")

</div>

I have three 3 Windows computers. One is Windows server 2012, Other two are Windows 7 Desktop. Through Ansible I can individually manage all 3 windows machine through their local login account. Ansible Work Perfectly.

Now I configure AD in windows server 2012 and I joined two desktop computer to AD. Through Active Directory’s Administrator Account I can login through all 3 Windows Machines.

To Manage AD Account in ansible I installed keberos as mentioned in [this documentaion.](http://docs.ansible.com/ansible/intro_windows.html#installing-python-kerberos-dependencies)

My Configurations are as follow:

**/etc/krb5.conf**

```auto
[libdefaults]

default_realm = NAANAL.IN

[realms]

NAANAL.IN = {
    kdc = WIN2012.naanal.in
    default_domain = naanal.in
}

[domain_realm]

.naanal.in = NAANAL.IN

[login]

krb4_convert = true
krb4_get_tickets = false

```

**Connection and Ticket Details:**

```auto
kinit Administrator@NAANAL.IN
Password for Administrator@NAANAL.IN:

klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Administrator@NAANAL.IN

Valid starting Expires Service principal
2016-07-10T20:41:25 2016-07-11T06:41:25 krbtgt/NAANAL.IN@NAANAL.IN
    renew until 2016-07-11T20:40:33

```

Now I just try to ping my all windows machines through the account `Administrator@NAANAL.IN`

Here is my Configuration and output :

**hosts**

```auto
[windows]
192.168.1.13 -> Windows 7 Desktop Attached to AD
192.168.1.23 -> Windows 7 Desktop Attached to AD
172.30.64.77 -> Windows 2012 with AD

```

**group\_vars/windows.yaml**

```auto
ansible_user: Administrator@NAANAL.IN
ansible_password: p@ssw0rd1
ansible_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore

```

While I run `ansible windows -i hosts -m win_ping`

```auto
192.168.1.13 | UNREACHABLE! => {
"changed": false,
"msg": "ssl: the specified credentials were rejected by the server",
"unreachable": true
}
192.168.1.23 | UNREACHABLE! => {
"changed": false,
"msg": "ssl: the specified credentials were rejected by the server",
"unreachable": true
}
172.30.64.77 | SUCCESS => {
"changed": false,
"ping": "pong"
}

```

i.e In Ansible, I can’t login into computers attached to AD through AD user account. Where I miss things ?

Note: I enabled Remote Connections in Desktops. Also tried with firewall disabled.

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [July 11, 2016, 9:54am UTC](https://forum.ansible.com/t/login-credentials-were-rejected-for-computers-attached-to-active-directory/21979/2 "2016-07-11T09:54:58Z")

</div>

So, for some reason it is trying to connect via ssl and not kerberos.

I can think of two things for you to try:

1/ ensure you have install the python kerberos library as described here: [http://docs.ansible.com/ansible/intro\_windows.html#installing-python-kerberos](http://docs.ansible.com/ansible/intro_windows.html#installing-python-kerberos)

Without this ansible will ‘fall back’ to attempting ssl connection, which will fail as you are using a domain user. This is also needed (it is **not** included the packages listed here): [http://docs.ansible.com/ansible/intro\_windows.html#installing-python-kerberos-dependencies](http://docs.ansible.com/ansible/intro_windows.html#installing-python-kerberos-dependencies)

2/ Switch to hostnames instead of ip addresses in your inventory. Kerberos needs fully functioning DNS to work properly.

Hope this helps,

Jon