# Power Shell remoting (WinRM trust) not working with Active Directory Kerberos Authentication

**URL:** <https://forum.ansible.com/t/power-shell-remoting-winrm-trust-not-working-with-active-directory-kerberos-authentication/26851>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [February 26, 2018, 3:25pm UTC](https://forum.ansible.com/t/power-shell-remoting-winrm-trust-not-working-with-active-directory-kerberos-authentication/26851 "2018-02-26T15:25:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dinesh\_Vashisht](https://avatars.discourse-cdn.com/v4/letter/d/2acd7d/32.png) [@Dinesh\_Vashisht](https://forum.ansible.com/u/Dinesh_Vashisht)\
**Post date:** [February 26, 2018, 3:25pm UTC](https://forum.ansible.com/t/power-shell-remoting-winrm-trust-not-working-with-active-directory-kerberos-authentication/26851/1 "2018-02-26T15:25:15Z")

</div>

Hi All,

We are using Ansible Version: 2.4.2.0.

Power Shell remoting (WinRM trust) is not working when using Active Directory even after establishing:

**Successful Kerberos Authentication** :

> Default principal: [automation@ITRNETWORK.COM](mailto:automation@ITRNETWORK.COM)
> 
> Valid starting Expires Service principal
> 
> 02/26/2018 09:23:25 02/26/2018 19:23:25 krbtgt/ITRNETWORK.COM@ITRNETWORK.COM
> 
> renew until 03/05/2018 09:23:19
> 
> [root@calam1 group\_vars]#

**Following are test results:**

> [root@calam1 group\_vars]# ansible windows-jump-servers -m win\_ping
> 
> [pcijmp1.itrnetwork.com](http://pcijmp1.itrnetwork.com) | UNREACHABLE! =\> {
> 
> “changed”: false,
> 
> “msg”: “ssl: the specified credentials were rejected by the server”,
> 
> “unreachable”: true
> 
> }

**Contents of file /etc/ansible/group\_vars/windows-jump-servers.yml:**

> ansible\_user: automation
> 
> ansible\_password: \<my\_password\>
> 
> ansible\_port: 5986
> 
> ansible\_connection: winrm
> 
> ansible\_winrm\_scheme: https
> 
> ansible\_winrm\_server\_cert\_validation: ignore

It works OK with a local user on the same domain joined Windows server.

Can someone help to verify cause and advice how to resolve this?

Thank you,  
Dinesh Vashisht

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [February 26, 2018, 3:43pm UTC](https://forum.ansible.com/t/power-shell-remoting-winrm-trust-not-working-with-active-directory-kerberos-authentication/26851/2 "2018-02-26T15:43:12Z")

</div>

try using

`ansible_user: automation@ITRNETWORK.COM`

as the user name. Without this ansible will expect ‘automation’ to be a local user, not a domain user.

Also, if you are wanting to control remote resources (file shares on other machines) via ansible and a windows jump host, its worth setting  
`

ansible\_winrm\_kerberos\_delegation: yes

`

… as well.

If you are just getting started with ansible and windows, this page is well worth reading: [http://docs.ansible.com/ansible/devel/user\_guide/windows\_usage.html](http://docs.ansible.com/ansible/devel/user_guide/windows_usage.html)

Hope this helps,

Jon

---

<div class="post-metadata">

**Author:** ![Dinesh\_Vashisht](https://avatars.discourse-cdn.com/v4/letter/d/2acd7d/32.png) [@Dinesh\_Vashisht](https://forum.ansible.com/u/Dinesh_Vashisht)\
**Post date:** [February 26, 2018, 4:47pm UTC](https://forum.ansible.com/t/power-shell-remoting-winrm-trust-not-working-with-active-directory-kerberos-authentication/26851/3 "2018-02-26T16:47:56Z")

</div>

Thank you Jon,

Your advice worked:

[pcijmp1.itrnetwork.com](http://pcijmp1.itrnetwork.com) | SUCCESS =\> {  
“changed”: false,  
“ping”: “pong”  
}

Regards,  
Dinesh Vashisht