# Windows: kerberos: the specified credentials were rejected by the server

**URL:** <https://forum.ansible.com/t/windows-kerberos-the-specified-credentials-were-rejected-by-the-server/28880>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [October 27, 2018, 4:57am UTC](https://forum.ansible.com/t/windows-kerberos-the-specified-credentials-were-rejected-by-the-server/28880 "2018-10-27T04:57:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Subhi\_Andrews](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@Subhi\_Andrews](https://forum.ansible.com/u/Subhi_Andrews)\
**Post date:** [October 27, 2018, 4:57am UTC](https://forum.ansible.com/t/windows-kerberos-the-specified-credentials-were-rejected-by-the-server/28880/1 "2018-10-27T04:57:11Z")

</div>

I am using the following ansible settings:

ansible\_user: ‘myuser’  
ansible\_password: ‘mypass’  
ansible\_port: 5986  
ansible\_connection: winrm  
ansible\_winrm\_transport: kerberos  
ansible\_winrm\_server\_cert\_validation: ignore  
ansible\_winrm\_message\_encryption: always  
ansible\_winrm\_kerberos\_delegation: true

ansible\_user is a domain user - that has administrative rights on all the nodes.

Then I run win\_ping command.

/usr/local/bin/ansible citrix\_ch3 -m win\_ping  
ctx11 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “kerberos: the specified credentials were rejected by the server”,  
“unreachable”: true  
}  
ctx12 | SUCCESS =\> {  
“changed”: false,  
“ping”: “pong”  
}  
ctx13 | SUCCESS =\> {  
“changed”: false,  
“ping”: “pong”  
}  
ctx14 | SUCCESS =\> {  
“changed”: false,  
“ping”: “pong”  
}

I get unreachable from just one host. This is the WinRM config on the machine that’s unreachable:

PS C:\> winrm get winrm/config  
Config  
MaxEnvelopeSizekb = 500  
MaxTimeoutms = 60000  
MaxBatchItems = 32000  
MaxProviderRequests = 4294967295  
Client  
NetworkDelayms = 5000  
URLPrefix = wsman  
AllowUnencrypted = false  
Auth  
Basic = true  
Digest = true  
Kerberos = true  
Negotiate = true  
Certificate = true  
CredSSP = false  
DefaultPorts  
HTTP = 5985  
HTTPS = 5986  
TrustedHosts  
Service  
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)  
MaxConcurrentOperations = 4294967295  
MaxConcurrentOperationsPerUser = 1500  
EnumerationTimeoutms = 240000  
MaxConnections = 300  
MaxPacketRetrievalTimeSeconds = 120  
AllowUnencrypted = true  
Auth  
Basic = true  
Kerberos = true  
Negotiate = true  
Certificate = false  
CredSSP = false  
CbtHardeningLevel = Relaxed  
DefaultPorts  
HTTP = 5985  
HTTPS = 5986  
IPv4Filter = \*  
IPv6Filter = \*  
EnableCompatibilityHttpListener = false  
EnableCompatibilityHttpsListener = false  
CertificateThumbprint  
AllowRemoteAccess = true  
Winrs  
AllowRemoteShellAccess = true  
IdleTimeout = 7200000  
MaxConcurrentUsers = 2147483647  
MaxShellRunTime = 2147483647  
MaxProcessesPerShell = 2147483647  
MaxMemoryPerShellMB = 2147483647  
MaxShellsPerUser = 2147483647

Any suggestions or help on how to potentially debug/resolve this problem?

Thank you all,

Subhi.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [October 27, 2018, 12:41pm UTC](https://forum.ansible.com/t/windows-kerberos-the-specified-credentials-were-rejected-by-the-server/28880/2 "2018-10-27T12:41:47Z")

</div>

Make sure the time is synced between the Ansible host, your Windows host, and finally the domain controller. Kerberos is highly dependent on all this being aligned for the authentication to succeed.

Thanks

Jordan