# WinRM on APT Ansible installation **URL:** \ **Category:** Get Help\ **Tags:** winrm, windows, ssh, ubuntu\ **Created:** [October 7, 2023, 4:24pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521 "2023-10-07T16:24:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![charlespick](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@charlespick](https://forum.ansible.com/u/charlespick)\ **Post date:** [October 7, 2023, 4:24pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/1 "2023-10-07T16:24:58Z")
I installed Ansible with `apt` on Ubuntu 23. When I try adding Windows servers to the inventory it throws SSH errors. I’m assuming this is because the WinRM components are missing. In the docs it talks about adding them using pip or pipx but I didn’t use either of those. Do I need to uninstall Ansible with `apt` and reinstall with pip or something else? Charles ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [October 7, 2023, 6:06pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/2 "2023-10-07T18:06:40Z")
Hi, > I installed Ansible with `apt` As a side note, you should install Ansible from pip if you want to use latest versions, as deb packages are updated to the whim of maintainers (thanks to them btw). > I’m assuming this is because the WinRM components are missing No, it’s because Ansible uses ssh as default [connection method](https://docs.ansible.com/ansible/latest/inventory_guide/connection_details.html). You need to explicitly specify `ansible_connection: winrm`, though you might indeed need to install additional packages (pywinrm from PyPI in my case, as well as krb5-user from my distro repo) for this method to work. I remember having a bad time getting it to work, not so much because of Ansible configuration, but the Kerberos one and the fact that winrm was badly configured on multiple remote nodes. It is also really slow to work with. I don’t manage Windows Server nodes anymore these days, but if I had to, I probably use OpenSSH instead. Anyways, here is a configuration example: ```yaml # inventories/group_vars/windows.yml --- ansible_connection: winrm ansible_winrm_transport: kerberos ansible_winrm_server_cert_validation: ignore #ansible_user: [] # To override; format : USER@DOMAIN.TLD (case sensitive) #ansible_winrm_pass: [] # Doesn't work with --ask-pass, so either use https://docs.ansible.com/ansible/latest/user_guide/playbooks_prompts.html, or override # Example : ANSIBLE_PASSWORD="" ansible ... -e ansible_user=USER@DOMAIN.TLD -e ansible_winrm_pass='{{ lookup("env", "ANSIBLE_PASSWORD") }}' # It would be somewhat safer to set password in a vault encrypted file and use --ask-vault-pass parameter on command line # To check winrm config on Windows Server nodes: winrm get winrm/config (more here: https://learn.microsoft.com/fr-fr/troubleshoot/windows-client/system-management-components/configure-winrm-for-https, here for ansible conf: https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html) ``` ```ini # /etc/krb5.conf [libdefaults] default_realm = DOM1.TLD [realms] DOM1.TLD = { kdc = SRV1.DOM1.TLD:88 kdc = SRV2.DOM1.TLD:88 kdc = SRV3.DOM1.TLD:88 kdc = SRV4.DOM1.TLD:88 admin_server = SRV1.DOM1.TLD default_domain = DOM1.TLD } DOM2.TLD = { kdc = SRV1.DOM2.TLD:88 kdc = SRV2.DOM2.TLD:88 kdc = SRV3.DOM2.TLD:88 kdc = SRV4.DOM2.TLD:88 admin_server = SRV1.DOM2.TLD default_domain = DOM2.TLD } [domain_realm] .dom1.tld = DOM1.TLD .dom2.tld = DOM2.TLD ``` I tried quickly to join Windows Server nodes with my previously existing config (I haven’t use for years), and have this error I really don’t want to troubleshoot: ```bash | UNREACHABLE! => { "changed": false, "msg": "kerberos: authGSSClientStep() failed: (('Unspecified GSS failure. Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377))", "unreachable": true } ``` Anyways, here is how I used to ~~manage~~ do stuff on Windows Server nodes, and I’d like to not do that again, ever. Hope it helps ! ---
**Author:** ![charlespick](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@charlespick](https://forum.ansible.com/u/charlespick)\ **Post date:** [October 8, 2023, 1:01am UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/3 "2023-10-08T01:01:01Z")
So I was investigating WinRM because ssh on windows was experimental. However, all I’m trying to do is script a shutdown of all my servers when my ups runs low. Is shutdown over ssh on Windows reliable enough for this purpose? Charles ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [October 8, 2023, 11:04am UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/4 "2023-10-08T11:04:40Z")
> Is shutdown over ssh on Windows reliable enough for this purpose? Yes, I think so. There will probably be some missing or buggy features depending on which OS version / build you’re using, but I doubt you’ll encounter much issues really. AFAIK, OpenSSH on Windows Server exists for a while and [project](https://github.com/PowerShell/openssh-portable) seems well maintained. FWIW, a team I worked with on a previous mission used this kind of setup to run centralized scheduled jobs on Windows Server targets with no issues whatsoever. Some resources: - [Get started with OpenSSH for Windows - Microsoft doc](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui) - [Windows SSH Setup - Ansible doc](https://docs.ansible.com/ansible/latest/os_guide/windows_setup.html#id16) - [PowerShell/Win32-OpenSSH/issues](https://github.com/PowerShell/Win32-OpenSSH/issues) - [WinRM vs. OpenSSH: A Showdown for PowerShell Remoting - Paul Broadwith - PSConfEU 2023](https://www.youtube.com/watch?app=desktop&v=ghGw7AWElj0); I just fast-tracked it and it seems informative. Plus it’s recent content. That being said, I’m not saying you should use OpenSSH over WinRM as it’s not a complete replacement and will probably not be the best option in every situation, but it should work just as fine if not better for your current needs (shutdown remote nodes with Ansible). So unless you’re in a hurry or have specific requirements, I suggest you try to implement both at small scale and see what setup would be more convenient to use and manage, also taking into account your future needs. Also not what you asked, but be aware you’ll still be limited to [Windows modules](https://docs.ansible.com/ansible/latest/collections/ansible/windows/index.html) use. As for what you’re trying to achieve, [ansible.windows.win\_reboot module](https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_reboot_module.html#ansible-collections-ansible-windows-win-reboot-module) seems appropriate. I don’t know if you plan to automate your playbook execution, but if you do, you might want to have a look on [Event-driven Ansible](https://www.redhat.com/en/technologies/management/ansible/event-driven-ansible), which could be configured to receive monitoring system notifications as your UPS runs low and automatically run your playbook in response. Have a nice Sunday ! ---
**Author:** ![charlespick](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@charlespick](https://forum.ansible.com/u/charlespick)\ **Post date:** [October 8, 2023, 9:40pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/5 "2023-10-08T21:40:59Z")
I’ll look into SSH on windows server after I get my first linux boxes dealt with. Thanks for the tip on event driven ansible. I was just planning to have the playbook called by NUT. Is Event Driven Ansible only part of AAP or can I get that for free too? Charles ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [October 9, 2023, 4:33pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/6 "2023-10-09T16:33:27Z")
> Is Event Driven Ansible only part of AAP or can I get that for free too? You can use it for free 🙂 ; look at this: [Installation — Ansible Rulebook Documentation](https://ansible.readthedocs.io/projects/rulebook/en/stable/installation.html) ---
**Author:** ![charlespick](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@charlespick](https://forum.ansible.com/u/charlespick)\ **Post date:** [October 15, 2023, 4:27pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/7 "2023-10-15T16:27:58Z")
I got SSH server running on Windows Server and I had to install Python. Now when I login at the ansible user over ssh and run `python` it loads ```auto ansible@FEDERATION02 C:\Users\ansible>python Python 3.12.0 (tags/v3.12.0:0fb18b0, Oct 2 2023, 13:03:39) [MSC v.1935 64 bit (AMD64)] on win32 Type "help", "copyright", "credits" or "license" for more information. >>> ``` But Ansible is complaining that no python intepreter is found. It says the last thing it tried was `python` so why isn’t it working? ![image](https://us1.discourse-cdn.com/ansible/original/2X/1/1533051e34bd29985853934bd075c78cbae29abf.png) ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [October 15, 2023, 5:08pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/8 "2023-10-15T17:08:46Z")
This is just a warning, and is not why your task is failing. You can see the Powershell error trace in `module_stderr` key. Post your playbook and I’ll try to point out where your issue lies. You’re getting this warn about interpreter because Ansible can’t find `python` binary, though I’m not sure why, but probably because [you can’t run python modules on Windows](https://docs.ansible.com/ansible/latest/os_guide/windows_faq.html#what-windows-modules-are-available). You could either try to explicitly define the absolute path in Ansible config, or mask those warns. Have a look here: [Ansible Configuration Settings — Ansible Documentation](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#interpreter-python), and here: [Interpreter Discovery — Ansible Documentation](https://docs.ansible.com/ansible/latest/reference_appendices/interpreter_discovery.html). ---
**Author:** ![charlespick](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@charlespick](https://forum.ansible.com/u/charlespick)\ **Post date:** [October 15, 2023, 5:47pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/9 "2023-10-15T17:47:24Z")
All I’m doing is using the Ping module. Is that Python? ---
**Author:** ![briantist](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/briantist/32/130_2.png) [@briantist](https://forum.ansible.com/u/briantist)\ **Post date:** [October 15, 2023, 9:59pm UTC](https://forum.ansible.com/t/winrm-on-apt-ansible-installation/1521/10 "2023-10-15T21:59:45Z")
You need to use `ansible.windows.win_ping` [ansible.windows.win\_ping module – A windows version of the classic ping module — Ansible Documentation](https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_ping_module.html) Python modules do not work on Windows right now.