# WinRM to windows machine only works with local user

**URL:** <https://forum.ansible.com/t/winrm-to-windows-machine-only-works-with-local-user/18368>\
**Category:** Ansible Developer\
**Tags:** windows\
**Created:** [June 1, 2015, 12:04pm UTC](https://forum.ansible.com/t/winrm-to-windows-machine-only-works-with-local-user/18368 "2015-06-01T12:04:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amir\_Luzon](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Amir\_Luzon](https://forum.ansible.com/u/Amir_Luzon)\
**Post date:** [June 1, 2015, 12:04pm UTC](https://forum.ansible.com/t/winrm-to-windows-machine-only-works-with-local-user/18368/1 "2015-06-01T12:04:11Z")

</div>

hey guys,

so we have an ansible control machine on CentOS 6. it is trying to connect to and windows machine to do win\_ping

the issue is that i keep receiving “FAILED =\> 401 Unauthorized. basic auth failed” when we use a user from the domain. it will only succeed once i creat a local user on the machine and add it to the Admin group.

any ideas on how to allow ansible to use a user from the active directory to access this machine?

Hosts file:

[windows]  
HOST\_NAME

[windows:vars]  
ansible\_ssh\_user=[DomainUser]  
ansible\_ssh\_pass=[Pass]  
ansible\_connection=winrm

Command & result:

ansible windows -m win\_ping -i environments/…  
HOST\_NAME | FAILED =\> 401 Unauthorized. basic auth failed

thanks,

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [June 1, 2015, 3:59pm UTC](https://forum.ansible.com/t/winrm-to-windows-machine-only-works-with-local-user/18368/2 "2015-06-01T15:59:48Z")

</div>

Hi,

First of all, use ansible 1.9.1 or latest development.

You need to install python kerberos module, as mentioned here.

[http://docs.ansible.com/intro\_windows.html#installing-on-the-control-machine](http://docs.ansible.com/intro_windows.html#installing-on-the-control-machine)

Then you need to configure your Ansible controller as a kerberos client so that it can authenticate against your domain controller. Search for ‘centos 6 kerberos client’ and you will find advice on how to set this up, but for centos the main steps are 1/ yum install krb5-workstation and 2/ configure your /etc/krb5.conf to point at your active directory domain controller.

Finally, before running Ansible, ensure that you have got a kerberos ticket to allow you to connect as a domain user. You can use the command

klist

to show this (once installed, it is part of krb5-workstation).

Probably a question better suited to Ansible Project mailing list in future too.

Hope that’s enough to get you started.

Jon