# Trouble authenticating to a Windows host

**URL:** <https://forum.ansible.com/t/trouble-authenticating-to-a-windows-host/5828>\
**Category:** Get Help\
**Tags:** windows\
**Created:** [May 15, 2024, 1:59pm UTC](https://forum.ansible.com/t/trouble-authenticating-to-a-windows-host/5828 "2024-05-15T13:59:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsavich](https://avatars.discourse-cdn.com/v4/letter/n/d78d45/32.png) [@nsavich](https://forum.ansible.com/u/nsavich)\
**Post date:** [May 15, 2024, 1:59pm UTC](https://forum.ansible.com/t/trouble-authenticating-to-a-windows-host/5828/1 "2024-05-15T13:59:34Z")

</div>

We’re having issues establishing a WinRM session to a windows workstation. As a test I’m using win\_ping to attempt to get a response. I’ve tried basic and ntlm transport methods which both failed. The following output is the vars I have set in my inventory. Credentials have been obfuscated.

```auto
[workstation:vars]
ansible_user= ''
ansible_password= ''
ansible_become_password=''
ansible_connection= ansible.builtin.winrm
ansible_port= 5985
ansible_winrm_transport= ntlm
ansible_winrm_server_cert_validation= ignore
ansible_winrm_message_encryption= auto

```

This is the playbook used for testing

```auto
---
- name: Test windows connectivity
  hosts: workstation
  gather_facts: false
  become: true
  become_method: ansible.builtin.runas
  become_user: ''

  tasks:
    - name: Verifiy connectivity
      ansible.windows.win_ping:

```

This is an example of the error I am getting.

```auto
    "changed": false,
    "msg": "ntlm: the specified credentials were rejected by the server",
    "unreachable": true
}

```

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [May 15, 2024, 6:37pm UTC](https://forum.ansible.com/t/trouble-authenticating-to-a-windows-host/5828/2 "2024-05-15T18:37:53Z")

</div>

Have you enabled the [LocalAccountTokenFilterPolicy](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction)? This needs to be set to 1 to allow local accounts to be authorized with their admin token as WinRM by default only allows admin users. I’m not sure if the single quotes in your ini example is also just a placeholder but might be best to remove those if you have it in the literal inventory as well.

---

<div class="post-metadata">

**Author:** ![nsavich](https://avatars.discourse-cdn.com/v4/letter/n/d78d45/32.png) [@nsavich](https://forum.ansible.com/u/nsavich)\
**Post date:** [May 15, 2024, 10:09pm UTC](https://forum.ansible.com/t/trouble-authenticating-to-a-windows-host/5828/3 "2024-05-15T22:09:09Z")

</div>

This was simply due to admin privileges being set incorrectly. Thanks for the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [June 14, 2024, 10:09pm UTC](https://forum.ansible.com/t/trouble-authenticating-to-a-windows-host/5828/4 "2024-06-14T22:09:37Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.