# Trouble connecting to Windows remote node via Kerberos

**URL:** <https://forum.ansible.com/t/trouble-connecting-to-windows-remote-node-via-kerberos/21587>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [May 27, 2016, 4:18pm UTC](https://forum.ansible.com/t/trouble-connecting-to-windows-remote-node-via-kerberos/21587 "2016-05-27T16:18:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan\_Anderson](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jonathan\_Anderson](https://forum.ansible.com/u/Jonathan_Anderson)\
**Post date:** [May 27, 2016, 4:18pm UTC](https://forum.ansible.com/t/trouble-connecting-to-windows-remote-node-via-kerberos/21587/1 "2016-05-27T16:18:02Z")

</div>

Control Node:

- CentOS 7

- Ansible 2.1

- pywinrm version from May 19th, 2016

Remote Node:

- Windows 7

- Powershell 3

I’m able to connect to my Windows remote node just fine with the powershell setting **winrm/config/server/AllowUnencrypted=true**. But when I change it to false I get the error below. I’m trying to use Kerberos. What am I doing wrong or how should I diagnose the problem?

**$ ansible windows -m win\_ping -vvvvv**  
**No config file found; using defaults**  
**Loaded callback minimal of type stdout, v2.0**  
 **ESTABLISH WINRM CONNECTION FOR USER: ansibleAdmin on PORT 5986 TO ADS-6999**  
 **WINRM CONNECT: transport=kerberos endpoint=[https://ADS-6999:5986/wsman](https://urldefense.proofpoint.com/v2/url?u=https-3A__ADS-2D6999-3A5986_wsman&d=CwMFaQ&c=IGDlg0lD0b-nebmJJ0Kp8A&r=ATO-uJXWOBdlXfHiWeQfW-8RNV-1NXeUTYIEq2ZNDg4&m=-onXPFRqIMDCtRo7_m9XkC3nOC4xIpQkQWKM0l4jPUo&s=kO_2d9w5rZF-SAxmt_YAoID0cJqOODW4tgpQtGfOpoc&e=)**  
 **WINRM CONNECTION ERROR: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))**  
**Traceback (most recent call last):**  
**File “/etc/ansible/lib/ansible/plugins/connection/winrm.py”, line 134, in \_winrm\_connect**  
**protocol.send\_message(‘’)**  
**File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message**  
**return self.transport.send\_message(message)**  
**File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 269, in send\_message**  
**krb\_ticket = KerberosTicket(self.krb\_service)**  
**File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 205, in init**  
**kerberos.authGSSClientStep(krb\_context, ‘’)**  
**GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))**

**ADS-6999 | FAILED! =\> {**  
**“failed”: true,**  
**“msg”: “kerberos: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))”**  
**}**

here is my file from the group\_vars direcctory

$ cat windows.yml

---

<div class="post-metadata">

**Author:** ![Mike\_Fennemore](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Mike\_Fennemore](https://forum.ansible.com/u/Mike_Fennemore)\
**Post date:** [May 31, 2016, 9:37am UTC](https://forum.ansible.com/t/trouble-connecting-to-windows-remote-node-via-kerberos/21587/2 "2016-05-31T09:37:23Z")

</div>

[https://groups.google.com/forum/#!topic/ansible-project/vEl-mrvFkrY](https://groups.google.com/forum/#!topic/ansible-project/vEl-mrvFkrY)

I had a few similar issues, eventually switched from kerberos to ntlm. Using the newer pywinrm seems to work like a charm thus far.  
I’m assuming you have configured the krb5.conf and installed the dependencies as per [http://docs.ansible.com/ansible/intro\_windows.html#active-directory-support](http://docs.ansible.com/ansible/intro_windows.html#active-directory-support) .

---

<div class="post-metadata">

**Author:** ![Jonathan\_Anderson](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jonathan\_Anderson](https://forum.ansible.com/u/Jonathan_Anderson)\
**Post date:** [May 31, 2016, 1:50pm UTC](https://forum.ansible.com/t/trouble-connecting-to-windows-remote-node-via-kerberos/21587/3 "2016-05-31T13:50:57Z")

</div>

Regarding the Ansible Docs page on [Installing python-kerberos dependencies](http://docs.ansible.com/ansible/intro_windows.html#active-directory-support), it lists 6 different install procedures. As I understand I only need to run one of these based on my os, not all 6. Is that correct?

---

<div class="post-metadata">

**Author:** ![Mike\_Fennemore](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Mike\_Fennemore](https://forum.ansible.com/u/Mike_Fennemore)\
**Post date:** [May 31, 2016, 4:01pm UTC](https://forum.ansible.com/t/trouble-connecting-to-windows-remote-node-via-kerberos/21587/4 "2016-05-31T16:01:22Z")

</div>

Well you are running Centos 7 so typically you would use yum as your package manager:

```auto
# Via Yum
yum -y install python-devel krb5-devel krb5-libs krb5-workstation

```

```auto
Just remember to run it using sudo.

```