# Windows host management via WinRM (Kerberos) from Mac clients

**URL:** <https://forum.ansible.com/t/windows-host-management-via-winrm-kerberos-from-mac-clients/8606>\
**Category:** Get Help\
**Tags:** windows, macosx\
**Created:** [September 18, 2024, 5:34pm UTC](https://forum.ansible.com/t/windows-host-management-via-winrm-kerberos-from-mac-clients/8606 "2024-09-18T17:34:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Huskers79](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@Huskers79](https://forum.ansible.com/u/Huskers79)\
**Post date:** [September 18, 2024, 5:34pm UTC](https://forum.ansible.com/t/windows-host-management-via-winrm-kerberos-from-mac-clients/8606/1 "2024-09-18T17:34:41Z")

</div>

Good day,

We are having issues managing Windows hosts from Mac clients when the Ansible user is _not_ the user logged into the Mac client. It appears the Kerberos ticket of the logged in user is _always_ utilized. This is for both `manual` and `managed ansible_winrm_kinit_mode`. Setting `KRB5CCNAME` to point to the cache of the Ansible user works for `klist, kinit, etc`, but it does not appear to be honored when calling `ansible`.

As a workaround we can `kdestroy` the logged in user’s cache, but this negatively impacts other activities on the client. When only the Ansible user’s cache exists Ansible works as expected.

Is there anyway to direct `ansible` to a specific Kerberos cache?

Thank you for any assistance you can provide.

---

<div class="post-metadata">

**Author:** ![Huskers79](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@Huskers79](https://forum.ansible.com/u/Huskers79)\
**Post date:** [October 10, 2024, 1:11pm UTC](https://forum.ansible.com/t/windows-host-management-via-winrm-kerberos-from-mac-clients/8606/2 "2024-10-10T13:11:47Z")

</div>

Do you have any recommendations here @jborean ?

Thank you.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [October 10, 2024, 9:29pm UTC](https://forum.ansible.com/t/windows-host-management-via-winrm-kerberos-from-mac-clients/8606/3 "2024-10-10T21:29:43Z")

</div>

macOS uses the `API` ccache which is managed by some system service and is tied to the user. You can set the `krb5.conf` to change the default ccache to something else like `FILE` that is accessible by both the normal user and whatever is running Ansible. Keep in mind macOS can be difficult with GSSAPI due to the fork/exec problem present with how Ansible runs each worker. Some things work but others can fail.