# Windows Kerberos Issues **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [June 8, 2017, 3:59pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684 "2017-06-08T15:59:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jim\_Heald](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@Jim\_Heald](https://forum.ansible.com/u/Jim_Heald)\ **Post date:** [June 8, 2017, 3:59pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/1 "2017-06-08T15:59:34Z")
I’m trying to use Ansible to log into a Windows host, and I’m having issues logging in. 1. My Ansible server is joined to the domain 2. DNS lookup works, as well as in reverse 3. I can log into the Windows hosts as a local user through Ansible 4. Running something like “id @” works on my Ansible server The error I am getting is this: “msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”, I can ping the host, and like I said both DNS and Reverse DNS work. I know for sure the host is joined to the domain, and I’m pretty certain the Linux server is joined to the domain. Any suggestions? Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [June 8, 2017, 4:49pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/2 "2017-06-08T16:49:53Z")
The domain status of the Ansible controller shouldn’t matter. If DNS is working, the typical remaining causes of that error are not using the FQDN of the target host in your Ansible inventory, or that the host’s HTTP SPN has been reassigned to another user. Also, if you don’t absolutely need to use Kerberos, NTLM or CredSSP are much easier ways to do domain user auth… ---
**Author:** ![Jim\_Heald](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@Jim\_Heald](https://forum.ansible.com/u/Jim_Heald)\ **Post date:** [June 8, 2017, 7:41pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/3 "2017-06-08T19:41:40Z")
I would love to use NTLM or CredSSP because Kerberos is a bit of a PITA it seems. Do those transports require host configuration? If I simply change the transport to ntlm I get: “msg”: “ntlm: the specified credentials were rejected by the server” And with CredSSP I get: “msg”: “credssp: The server did not respond with CredSSP as an available auth method” ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [June 12, 2017, 5:43pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/4 "2017-06-12T17:43:04Z")
There’s a command line switch you have to use on the ConfigureRemotingForAnsible.ps1 if you want to use CredSSP I think. Re your kerberos problem, has the windows box you are trying to hit actually been joined to the domain? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [June 12, 2017, 10:06pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/5 "2017-06-12T22:06:19Z")
The switch to enable CredSSP when running ConfigureRemotingForAnsible.ps1 is `powershell.exe -ExecutionPolicy Bypass -File ConfigureRemotingForAnsible.ps1 -EnableCredSSP` You can also just enable it manually by running `Enable-WSManCredSSP -role server -Force` As for your Kerberos I find if your DNS isn’t set correctly and you have SPN issues then you are going to have a bad time. You can use `setspn -L COMPUTERACCOUNT` where COMPUTERACCOUNT is the account in AD for the host to see a list of SPN’s registered to that host. ---
**Author:** ![Jim\_Heald](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@Jim\_Heald](https://forum.ansible.com/u/Jim_Heald)\ **Post date:** [June 12, 2017, 11:30pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/6 "2017-06-12T23:30:53Z")
Thank you! I actually just got CredSSP working, so much easier! ---
**Author:** ![Snehit](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@Snehit](https://forum.ansible.com/u/Snehit)\ **Post date:** [February 26, 2018, 1:03pm UTC](https://forum.ansible.com/t/windows-kerberos-issues/24684/7 "2018-02-26T13:03:40Z")