# windows, secrets, and remote plays

**URL:** <https://forum.ansible.com/t/windows-secrets-and-remote-plays/23765>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [February 18, 2017, 11:24pm UTC](https://forum.ansible.com/t/windows-secrets-and-remote-plays/23765 "2017-02-18T23:24:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pixel\_fairy](https://avatars.discourse-cdn.com/v4/letter/p/6f9a4e/32.png) [@pixel\_fairy](https://forum.ansible.com/u/pixel_fairy)\
**Post date:** [February 18, 2017, 11:24pm UTC](https://forum.ansible.com/t/windows-secrets-and-remote-plays/23765/1 "2017-02-18T23:24:36Z")

</div>

how does one manage secrets and remote plays? when we only had linux to deal with, no big deal to ssh -A to a control node, tmux, and have no secrets stored there at all.

but now, we have to deal with windows, which doesnt speak ssh. of course we can keep a vault remotely, and copy paste the passphrase over the ssh connection, or just run from your laptop and hope the connections stay up. is there a better way? what do the remote windows admins around here do?

---

<div class="post-metadata">

**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\
**Post date:** [February 23, 2017, 5:15pm UTC](https://forum.ansible.com/t/windows-secrets-and-remote-plays/23765/2 "2017-02-23T17:15:28Z")

</div>

That’s pretty much all you can do today- WinRM doesn’t support any useful agent/key-based auth (WinRM certificate auth is nearly useless). It’d be cool if Microsoft could implement something akin to smartcard auth for RDP (which works transparently across remote connections like an ssh agent), but alas, nothing there yet. Microsoft’s OpenSSH build has apparently recently added support for key-based auth for both local and domain users, but getting Windows module support working over SSH isn’t even on the roadmap yet.

-Matt