# Windows domain account using Kerberos

**URL:** <https://forum.ansible.com/t/windows-domain-account-using-kerberos/19487>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [October 12, 2015, 8:15am UTC](https://forum.ansible.com/t/windows-domain-account-using-kerberos/19487 "2015-10-12T08:15:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jugal\_Porwal](https://avatars.discourse-cdn.com/v4/letter/j/b2d939/32.png) [@Jugal\_Porwal](https://forum.ansible.com/u/Jugal_Porwal)\
**Post date:** [October 12, 2015, 8:15am UTC](https://forum.ansible.com/t/windows-domain-account-using-kerberos/19487/1 "2015-10-12T08:15:49Z")

</div>

Hi,

I want to access my windows machine using the domain account. I installed kerberos on my control node (centos) . And configured the krb5.conf as follows :

`  
[realms]  
[MYDOMAIN.COM](http://etbdenevr.com/) = {  
kdc = [my-domain-controller.com](http://my-domain-controller.com)  
}

[domain\_realm]  
.[mydomain.com](http://etbdenver.com/) = MYDOMAIN[.COM](http://etbdenver.com/)  
`

In my windows.yml file i have the following details :

`ansible_ssh_user: '[Administrator@MYDOMAIN.COM](mailto:Administrator@ETBDENVER.COM)' ansible_ssh_pass: 'mypassword' ansible_ssh_port: '5986' ansible_connection: 'winrm'`

When i run the command kinit [Administrator@MYDOMAIN.COM](mailto:Administrator@MYDOMAIN.COM) it prompts for the password but does nothing after i enter it. It just accepts it and moves on.  
When i tried to ping my windows machine it returns the following error

Loaded callback minimal of type stdout, v2.0  
 ESTABLISH WINRM CONNECTION FOR USER: [Administrator@MYDOMAIN.COM](mailto:Administrator@ETBDENVER.COM) on PORT 5986 TO windowsip  
windowsip | FAILED! =\> {  
“failed”: true,  
“msg”: “ERROR! plaintext: 401 Unauthorized. basic auth failed”  
}

What is the issue here? Is there some more configuration that i need to do ? Like a certificate or sumthing on the windows machine?

Regards  
Jugal Porwal

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [October 12, 2015, 12:55pm UTC](https://forum.ansible.com/t/windows-domain-account-using-kerberos/19487/2 "2015-10-12T12:55:19Z")

</div>

I think you probably just need to acquire a kerberos ticket.

Unless you have things set up so that you can log in to your ansible controller as a user on your domain, you won’t have a kerberos ticket (which is what lets you access the machines on your domain as a specific user).

I suggest you attempt to test that you can acquire a kerberos ticket as described here: [http://docs.ansible.com/ansible/intro\_windows.html#testing-a-kerberos-connection](http://docs.ansible.com/ansible/intro_windows.html#testing-a-kerberos-connection)

If you have further problems, try the troubleshooting tips here: [http://docs.ansible.com/ansible/intro\_windows.html#troubleshooting-kerberos-connections](http://docs.ansible.com/ansible/intro_windows.html#troubleshooting-kerberos-connections)

Jon