# Problem with WinRM Connections **URL:** \ **Category:** Ansible Project\ **Tags:** windows, rhel, aap\ **Created:** [June 12, 2022, 1:55am UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718 "2022-06-12T01:55:15Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Michael\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Michael\_Kennedy](https://forum.ansible.com/u/Michael_Kennedy)\ **Post date:** [June 12, 2022, 1:55am UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/1 "2022-06-12T01:55:15Z")
I am having a problem running WinRM connections with both basic and kerberos auth. My Ansible is deployed with RedHat AAP 4.2.0 on RHEL 9. I setup a test Windows 2019 machine and ran the ConfigureRemotingForAnsible.ps1 script against the host. Rebooted the host for good measure. Tested from the Ansible server that I can telnet to 5985 and 5986 (confirmed) but I cannot run a Windows test playbook against the host. Skipping callback ‘oneline’, as we already have a stdout callback. 18 19 PLAYBOOK: test.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 20 2 plays in windows/test.yml 21 22 PLAY [test raw module] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*18:47:21 23 24 TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*18:47:21 25 **task path: /runner/project/windows/test.yml:2** 26 **[WARNING]: The “winrm” connection plugin has an improperly configured remote** 27 **target value, forcing “inventory\_hostname” templated value instead of the** 28 **string** 29 redirecting (type: modules) ansible.builtin.setup to ansible.windows.setup 30 Using module file /usr/share/ansible/collections/ansible\_collections/ansible/windows/plugins/modules/setup.ps1 31 Pipelining is enabled. 32 \ ESTABLISH WINRM CONNECTION FOR USER: administrator on PORT 5986 TO inventory\_hostname 33 **fatal: [192.168.12.52]: UNREACHABLE! =\> {** 34 **“changed”: false,** 35 **“msg”: “ssl: HTTPSConnectionPool(host=‘inventory\_hostname’, port=5986): Max retries exceeded with url: /wsman (Caused by NewConnectionError(‘\: Failed to establish a new connection: [Errno -2] Name or service not known’))”,** 36 **“unreachable”: true** 37 **}** **Running a Windows test against a domain joined machine produces a different error that I also cannot resolve.** PLAY [Ping] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*18:53:19 3 4 TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*18:53:19 5 **[WARNING]: The “winrm” connection plugin has an improperly configured remote** 6 **target value, forcing “inventory\_hostname” templated value instead of the** 7 **string** 8 **fatal: [srvrds04]: UNREACHABLE! =\> {“changed”: false, “msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”, “unreachable”: true}** **I am getting this error despite me confirming the SPN is fine. Confirming I can connect to the host with WinRM from a different domain joined host. Confirmed my Kerb ticket with kinit and list.** ---
**Author:** ![Michael\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Michael\_Kennedy](https://forum.ansible.com/u/Michael_Kennedy)\ **Post date:** [June 12, 2022, 3:17pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/2 "2022-06-12T15:17:51Z")
Here is some more troubleshooting information. Also as a side note. I am running an partner NFR self-support only version of AAP and have zero support from RedHat on this. It also doesn’t seem to matter if I run the job through command line ansible or through AAP. The error is the same. My Group Vars ---
**Author:** ![Urs\_Rau](https://avatars.discourse-cdn.com/v4/letter/u/50afbb/32.png) [@Urs\_Rau](https://forum.ansible.com/u/Urs_Rau)\ **Post date:** [June 13, 2022, 10:27am UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/3 "2022-06-13T10:27:19Z")
Hi Michael, A stab in the dark winrm or Kerberos specifically depend on a fully working DNS. Is your tower cluster properly looking up the windows domain DCs? I had tried a kludge myself with hard coded names in Hosts files but that gave me same error you are getting. Oddly the kinit and list cmd works fine, but the actual ansible connections trying to use winrm or kerberos transport failed. And as soon as I had added my local or internal dns zone to the cluster dns things started working for me. HTH ---
**Author:** ![Michael\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Michael\_Kennedy](https://forum.ansible.com/u/Michael_Kennedy)\ **Post date:** [June 13, 2022, 2:42pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/4 "2022-06-13T14:42:06Z")
Hi Urs, Yes, dealing with Active Directory, DNS was the first place I looked. I have eliminated it being a problem with DNS. My resolv.conf file is setup correctly. DNS is correct, and rDNS is correct. I have also eliminated other low hanging fruit such as, NTP, Firewalls, Windows Firewall, Ethernet Adapter zones. [root@ansible ~]# ping mikes-wintest PING [mikes-wintest.domain.ca](http://mikes-wintest.sudden.ca) (192.168.12.52) 56(84) bytes of data. 64 bytes from [Mikes-WinTest.domain.ca](http://Mikes-WinTest.domain.ca) (192.168.12.52): icmp\_seq=1 ttl=123 time=14.1 ms ^C — [mikes-wintest.domain.ca](http://mikes-wintest.domain.ca) ping statistics — 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 14.127/14.127/14.127/0.000 ms [root@ansible ~]# nslookup mikes-wintest Server: 192.168.8.11 Address: 192.168.8.11#53 Name: [mikes-wintest.domain.ca](http://mikes-wintest.domain.ca) Address: 192.168.12.52 [root@ansible ~]# nslookup [domain.ca](http://domain.ca) Server: 192.168.8.11 Address: 192.168.8.11#53 Name: [domain.ca](http://domain.ca) Address: 192.168.15.202 Name: [domain.ca](http://domain.ca) Address: 192.168.12.153 Name: [domain.ca](http://domain.ca) Address: 192.168.12.20 Name: [domain.ca](http://domain.ca) Address: 192.168.8.11 Name: [domain.ca](http://domain.ca) Address: 192.168.15.201 Name: [domain.ca](http://domain.ca) Address: 192.168.8.44 Name: [domain.ca](http://domain.ca) Address: 192.168.8.21 Name: [domain.ca](http://domain.ca) Address: 192.168.12.201 Name: [domain.ca](http://domain.ca) Address: 192.168.9.150 [root@ansible ~]# ---
**Author:** ![Michael\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Michael\_Kennedy](https://forum.ansible.com/u/Michael_Kennedy)\ **Post date:** [June 13, 2022, 3:06pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/5 "2022-06-13T15:06:13Z")
I setup the inventory from CLI with a yml file and have run the win\_ping test against the hosts. One thing that stands out to me is this. \ WINRM CONNECT: transport=kerberos endpoint=https:// **inventory\_hostname** :5986/wsman Should it not be populating the real FQDN of the machine here? ansible [core 2.13.0] config file = /etc/ansible/ansible.cfg configured module search path = [‘/root/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’] ansible python module location = /usr/lib/python3.9/site-packages/ansible ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections executable location = /usr/bin/ansible python version = 3.9.10 (main, Feb 9 2022, 00:00:00) [GCC 11.2.1 20220127 (Red Hat 11.2.1-9)] jinja version = 3.0.3 libyaml = True Using /etc/ansible/ansible.cfg as config file setting up inventory plugins host\_list declined parsing /etc/ansible/projects/inventory/inventory.yml as it did not pass its verify\_file() method script declined parsing /etc/ansible/projects/inventory/inventory.yml as it did not pass its verify\_file() method Parsed /etc/ansible/projects/inventory/inventory.yml inventory source with ini plugin Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python3.9/site-packages/ansible/plugins/callback/minimal.py Attempting to use ‘default’ callback. Skipping callback ‘default’, as we already have a stdout callback. Attempting to use ‘junit’ callback. Attempting to use ‘minimal’ callback. Skipping callback ‘minimal’, as we already have a stdout callback. Attempting to use ‘oneline’ callback. Skipping callback ‘oneline’, as we already have a stdout callback. Attempting to use ‘tree’ callback. META: ran handlers [WARNING]: The “winrm” connection plugin has an improperly configured remote target value, forcing “inventory\_hostname” templated value instead of the string redirecting (type: modules) ansible.builtin.win\_ping to ansible.windows.win\_ping Loading collection ansible.windows from /root/.ansible/collections/ansible\_collections/ansible/windows Using module file /root/.ansible/collections/ansible\_collections/ansible/windows/plugins/modules/win\_ping.ps1 Pipelining is enabled. \ ESTABLISH WINRM CONNECTION FOR USER: ubermike@DOMAIN.CA on PORT 5986 TO inventory\_hostname creating Kerberos CC at /tmp/tmpnx950wor calling kinit with pexpect for principal ubermike@DOMAIN.CA [WARNING]: The “winrm” connection plugin has an improperly configured remote target value, forcing “inventory\_hostname” templated value instead of the string redirecting (type: modules) ansible.builtin.win\_ping to ansible.windows.win\_ping Loading collection ansible.windows from /root/.ansible/collections/ansible\_collections/ansible/windows Using module file /root/.ansible/collections/ansible\_collections/ansible/windows/plugins/modules/win\_ping.ps1 Pipelining is enabled. \ ESTABLISH WINRM CONNECTION FOR USER: ubermike@DOMAIN.CA on PORT 5986 TO inventory\_hostname creating Kerberos CC at /tmp/tmpoh0zue5y calling kinit with pexpect for principal ubermike@DOMAIN.CA [WARNING]: The “winrm” connection plugin has an improperly configured remote target value, forcing “inventory\_hostname” templated value instead of the string kinit succeeded for principal ubermike@DOMAIN.CA redirecting (type: modules) ansible.builtin.win\_ping to ansible.windows.win\_ping Loading collection ansible.windows from /root/.ansible/collections/ansible\_collections/ansible/windows Using module file /root/.ansible/collections/ansible\_collections/ansible/windows/plugins/modules/win\_ping.ps1 Pipelining is enabled. \ ESTABLISH WINRM CONNECTION FOR USER: ubermike@DOMAIN.CA on PORT 5986 TO inventory\_hostname creating Kerberos CC at /tmp/tmp1d3m70sc calling kinit with pexpect for principal ubermike@DOMAIN.CA kinit succeeded for principal ubermike@DOMAIN.CA \ WINRM CONNECT: transport=kerberos endpoint=https://inventory\_hostname:5986/wsman kinit succeeded for principal ubermike@DOMAIN.CA \ WINRM CONNECT: transport=kerberos endpoint=https://inventory\_hostname:5986/wsman \ WINRM CONNECTION ERROR: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377)) Traceback (most recent call last): File “/usr/local/lib/python3.9/site-packages/winrm/vendor/requests\_kerberos/kerberos\_.py”, line 245, in generate\_request\_header result = kerberos.authGSSClientStep(self.context[host], kerberos.GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377)) During handling of the above exception, another exception occurred: Traceback (most recent call last): File “/usr/lib/python3.9/site-packages/ansible/plugins/connection/winrm.py”, line 448, in _winrm\_connect self.shell\_id = protocol.open\_shell(codepage=65001) # UTF-8 File “/usr/local/lib/python3.9/site-packages/winrm/protocol.py”, line 166, in open\_shell res = self.send\_message(xmltodict.unparse(req)) File “/usr/local/lib/python3.9/site-packages/winrm/protocol.py”, line 243, in send\_message resp = self.transport.send\_message(message) File “/usr/local/lib/python3.9/site-packages/winrm/transport.py”, line 320, in send\_message prepared\_request = self.session.prepare\_request(request) File “/usr/lib/python3.9/site-packages/requests/sessions.py”, line 456, in prepare\_request p.prepare( File “/usr/lib/python3.9/site-packages/requests/models.py”, line 320, in prepare self.prepare\_auth(auth, url) File “/usr/lib/python3.9/site-packages/requests/models.py”, line 551, in prepare\_auth r = auth(self) File "/usr/local/lib/python3.9/site-packages/winrm/vendor/requests\_kerberos/kerberos_.py", line 453, in **call** auth\_header = self.generate\_request\_header(None, host, is\_preemptive=True) File “/usr/local/lib/python3.9/site-packages/winrm/vendor/requests\_kerberos/kerberos\_.py”, line 260, in generate\_request\_header raise KerberosExchangeError(“%s failed: %s” % (kerb\_stage, str(error.args))) winrm.vendor.requests\_kerberos.exceptions.KerberosExchangeError: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377)) Mikes-WinTest.domain.ca | UNREACHABLE! =\> { “changed”: false, “msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”, “unreachable”: true } ---
**Author:** ![Urs\_Rau](https://avatars.discourse-cdn.com/v4/letter/u/50afbb/32.png) [@Urs\_Rau](https://forum.ansible.com/u/Urs_Rau)\ **Post date:** [June 13, 2022, 5:11pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/6 "2022-06-13T17:11:41Z")
Hi Michael, OK, I should have said so earlier but as well as kinit and klist ping also worked, but ansible still would not connect … and gave me exactly the error message you are getting, I am not sure but I suspect the python kerberos transport is making another over the wire query off of the DC or another container is involved to open the kerberos winrm session. I have messed with the resolvers.conf myself and cheated by adding my local ones but that alone did not resolve it. I think there is another container that tower uses . I have posted today on this group what I did with getting the local dns info injected into the awx cluster. I am using minikube but maybe my way works on yours too? Awx or tower uses a number of containers … HTH Urs ---
**Author:** ![Michael\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Michael\_Kennedy](https://forum.ansible.com/u/Michael_Kennedy)\ **Post date:** [June 13, 2022, 6:30pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/7 "2022-06-13T18:30:08Z")
I could add the machines to my hosts file directly but I think I actually have a bug here. The winRM plugin is actually trying to connect to https://inventory\_hostname:5986/wsman instead of [https://mikes-wintest.domain.ca:5986/wsman](https://mikes-wintest.domain.ca:5986/wsman). **WARNING]: The “winrm” connection plugin has an improperly configured remote target value, forcing “inventory\_hostname” templated value instead of the string** kinit succeeded for principal uber…@DOMAIN.CA redirecting (type: modules) ansible.builtin.win\_ping to ansible.windows.win\_ping Loading collection ansible.windows from /root/.ansible/collections/ansible\_collections/ansible/windows Using module file /root/.ansible/collections/ansible\_collections/ansible/windows/plugins/modules/win\_ping.ps1 Pipelining is enabled. \ ESTABLISH WINRM CONNECTION FOR USER: uber…@DOMAIN.CA on PORT 5986 TO inventory\_hostname creating Kerberos CC at /tmp/tmp1d3m70sc calling kinit with pexpect for principal uber…@DOMAIN.CA kinit succeeded for principal uber…@DOMAIN.CA **\ WINRM CONNECT: transport=kerberos endpoint=[https://inventory\_hostname:5986/wsman](https://inventory_hostname:5986/wsman)** kinit succeeded for principal uber…@DOMAIN.CA ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [June 13, 2022, 10:04pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/8 "2022-06-13T22:04:25Z")
Have a look at the warning Ansible is giving you, it is telling you it was unable to use your configured remote target value and forced `inventory_hostname`. Solve that and you will probably solve this problem. ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [June 13, 2022, 10:13pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/9 "2022-06-13T22:13:10Z")
That bug was introduced in 2.13.0 and recently resolved: [https://github.com/ansible/ansible/pull/77894](https://github.com/ansible/ansible/pull/77894) It’ll be included in 2.13.1 on June 20. ---
**Author:** ![Michael\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Michael\_Kennedy](https://forum.ansible.com/u/Michael_Kennedy)\ **Post date:** [June 13, 2022, 10:50pm UTC](https://forum.ansible.com/t/problem-with-winrm-connections/36718/10 "2022-06-13T22:50:49Z")
Matt, Thank you for that. Yes, it seems my hunch that it was a bug was correct if its already confirmed. Guess I will need to wait and patch Ansible before I can run it against any windows hosts.