# Using ansible\_winrm\_server\_cert\_validation

**URL:** <https://forum.ansible.com/t/using-ansible-winrm-server-cert-validation/24737>\
**Category:** Ansible Project\
**Created:** [June 15, 2017, 4:01pm UTC](https://forum.ansible.com/t/using-ansible-winrm-server-cert-validation/24737 "2017-06-15T16:01:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![b-long](https://avatars.discourse-cdn.com/v4/letter/b/ed8c4c/32.png) [@b-long](https://forum.ansible.com/u/b-long)\
**Post date:** [June 15, 2017, 4:01pm UTC](https://forum.ansible.com/t/using-ansible-winrm-server-cert-validation/24737/1 "2017-06-15T16:01:30Z")

</div>

Hi All,

As I noted in a [previously closed issue](https://github.com/ansible/ansible/issues/14710#issuecomment-291744396), it’s not clear to me where `ansible_winrm_server_cert_validation` will be respected in group\_vars and host\_vars. In addition, I’m unsure how to deal with the situation of dynamic inventory, such as in Ansible Tower. Here’s my GitHub question repeated for convenience:

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [June 16, 2017, 5:23am UTC](https://forum.ansible.com/t/using-ansible-winrm-server-cert-validation/24737/2 "2017-06-16T05:23:14Z")

</div>

Yeah, I think that restriction is still in place, but group\_vars is a good place for it.

You have ‘hosts: all’ in your example playbook, but not all of them are going to be windows hosts (probably) so defining a group called windows and having these vars defined for hosts that belong to the windows group is a good place to start. Then when your plays are for windows hosts you can just set

hosts: windows

and the playbook will apply to the right machines, with the right settings (which are only really relevant to the windows machines).  
So the specific details of connecting to windows machines are kept out of your playbook and are applied where they are meaningful, i.e. on any of your windows machines.

Obviously you can get more detailed and have child groups of windows hosts if needed but you can still keep these common connection variables and have them apply to any hosts that are running windows.

You don’t mention what your dynamic inventory source is, but provided your dynamic inventory returns your hosts as members of a group, you can use matching group\_vars with dynamic inventory just fine.

Hope this helps,

Jon