# winrm **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [February 2, 2016, 8:57pm UTC](https://forum.ansible.com/t/winrm/20426 "2016-02-02T20:57:44Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 2, 2016, 8:57pm UTC](https://forum.ansible.com/t/winrm/20426/1 "2016-02-02T20:57:44Z")
> **Nshah** > > > > Feb 2, 12:42 > > > > Hello, > > > > I followed the guidelines in setting up a windows node. > [http://docs.ansible.com/ansible/intro\_windows.html#windows-system-prep](http://docs.ansible.com/ansible/intro_windows.html#windows-system-prep) > > > > I am using Windows 2008 R2, which had PowerShell 2.0 installed; I upgraded to PowerShell 4.0 (since the requirements said PowerShell 3.0)… > > > > When trying to run ansible, I am running the following and getting the below listed error message: > > > > ansible-playbook -i hosts ipconfig.yml --ask-vault > Vault password: > > > > PLAY [test raw module] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > > > TASK: [run ipconfig] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > fatal: [qa-codegen01.theorchard.local] =\> 500 WinRMTransport. [Errno 111] Connection refused > > > > FATAL: all hosts have already failed – aborting > > > > > > > > > > > > > > Note - I went ahead and enabled winRM and configured with the following settings: > > > > winrm quickconfig -q > > > > winrm set winrm/config/winrs ‘@{MaxMemoryPerShellMB=“300”}’ > > > > winrm set winrm/config ‘@{MaxTimeoutms=“1800000”}’ > > > > winrm set winrm/config/service ‘@{AllowUnencrypted=“true”}’ > > > > > > > > winrm set winrm/config/service/auth ‘@{Basic=“true”}’ > > > > > > > > | ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 2, 2016, 11:00pm UTC](https://forum.ansible.com/t/winrm/20426/2 "2016-02-02T23:00:01Z")
maybe this might be a bit more insight: ansible windows -m win\_ping -vvvv \<10.40.1.31\> ESTABLISH WINRM CONNECTION FOR USER: **root** on PORT 5986 TO XXXXXXX \<10.40.1.31\> WINRM CONNECT: transport=plaintext endpoint=[https://XXXXX:5986/wsman](https://XXXXX:5986/wsman) \<10.40.1.31\> WINRM CONNECTION ERROR: 500 WinRMTransport. [Errno 111] Connection refused 10.40.1.31 | FAILED =\> 500 WinRMTransport. [Errno 111] Connection refused I’ve got a group\_var/windows.yml: ansible\_user: user@domain.local ansible\_password: XXXXXXXX ansible\_port: 5986 ansible\_connection: winrm # The following is necessary for Python 2.7.9+ when using default WinRM self-signed certificates: ansible\_winrm\_server\_cert\_validation: ignore ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [February 3, 2016, 1:45pm UTC](https://forum.ansible.com/t/winrm/20426/3 "2016-02-03T13:45:48Z")
You have ansible\_user: user@domain.local set, implying that you want to use a domain user. When you run, the following is shown: transport=plaintext endpoint=[https://XXXXX:5986/wsman](https://xxxxx:5986/wsman) The transport needs to be kerberos to connect with a domain user. I suspect you are missing the python kerberos library. If this can’t be loaded then ansible will attempt a plaintext connection which I am fairly certain won’t work with a domain user. You don’t mention which OS you are running ansible on but you probably need to install python-kerberos from yum or pykerberos from pip Hope this helps Jon ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 3, 2016, 3:33pm UTC](https://forum.ansible.com/t/winrm/20426/4 "2016-02-03T15:33:50Z")
That’s a good start, I am using CentOS, and I was able to run yum install python-kerberos just now. However, still seems to be getting same message when rerunning: Installed: python-kerberos.x86\_64 0:1.1-15.el7 Complete! [root@bamagent06 ansible]# **ansible windows -m win\_ping -vvvv** \<10.40.1.31\> ESTABLISH WINRM CONNECTION FOR USER: root on PORT 5986 TO xx.xx.xx.xx \<10.40.1.31\> WINRM CONNECT: transport=plaintext endpoint=[https://xx.xx.xx.xx:5986/wsman](https://xx.xx.xx.xx:5986/wsman) \<10.40.1.31\> WINRM CONNECTION ERROR: 500 WinRMTransport. [Errno 111] Connection refused 10.40.1.31 | FAILED =\> 500 WinRMTransport. [Errno 111] Connection refused It’s as if it’s not using my group\_vars/windows.yml to pick up the creds. ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 3, 2016, 3:56pm UTC](https://forum.ansible.com/t/winrm/20426/5 "2016-02-03T15:56:27Z")
I’ve tested kerberos following [http://docs.ansible.com/ansible/intro\_windows.html#id9](http://docs.ansible.com/ansible/intro_windows.html#id9). I ran kinit user@DOMAIN.LOCAL and it doesn’t come back with anything but it also doesn’t come back with a failure. I also try inputting the wrong password on purpose and it throws a “kinit: Preauthentication failed while getting initial credentials” leading me to believe kerberos auth is working fine…I don’t understand why its not using kerberos and using “root” and plaintext. I even tried to set the ansible\_user/password/host/port in the hosts file for that inventory group. ---
**Author:** ![Joe\_Levis](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@Joe\_Levis](https://forum.ansible.com/u/Joe_Levis)\ **Post date:** [February 3, 2016, 4:49pm UTC](https://forum.ansible.com/t/winrm/20426/6 "2016-02-03T16:49:53Z")
Nikhil, I ran into many problems getting kerberos to work with ansible as well, but finally got it working. First, ensure that you’ve obtained a valid kerberos ticket by running ‘klist’ on the command line after running your kinit command. Please post that back here if you can. Second, make sure your Linux box where you’re running Ansible is registered on the same domain as the Windows server you are trying to connect to. Third, your ansible\_user domain needs to be in all CAPS like so user@DOMAIN.LOCAL Let us know what you come up with. -Joe ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 3, 2016, 5:16pm UTC](https://forum.ansible.com/t/winrm/20426/7 "2016-02-03T17:16:55Z")
Just an update, but still having issues…I realized I was using ansible 1.9.4 and the syntax is a bit different than ansible 2.0 (e.g ansible\_ssh\_user vs. ansible\_user), now seeing this error: [root@bamagent06 ansible]# ansible windows -m win\_ping -vvvv \ ESTABLISH WINRM CONNECTION FOR USER: on PORT 5986 TO XX.XX.XX.XX \ WINRM CONNECT: **transport=kerberos** endpoint=[https://XX.XX.XX.XX:5986/wsman](https://XX.XX.XX.XX:5986/wsman) XX.XX.XX.XX | FAILED =\> Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 586, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 789, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 968, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect self.protocol = self.\_winrm\_connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 269, in send\_message krb\_ticket = KerberosTicket(self.krb\_service) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 205, in **init** kerberos.authGSSClientStep(krb\_context, ‘’) GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘ **Server not found in Kerberos database** ’, -1765328377)) ---
**Author:** ![Joe\_Levis](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@Joe\_Levis](https://forum.ansible.com/u/Joe_Levis)\ **Post date:** [February 3, 2016, 5:49pm UTC](https://forum.ansible.com/t/winrm/20426/8 "2016-02-03T17:49:05Z")
Right, so like I said in my previous response: make sure your Linux box is registered on the Windows domain. Run ‘dnsdomainname’ to check if your Linux machine is joined to a domain. If not, you need to use something like PBIS to do so: [https://community.spiceworks.com/how\_to/80336-join-ubuntu-14-04lts-to-a-windows-domain-using-pbis-open](https://community.spiceworks.com/how_to/80336-join-ubuntu-14-04lts-to-a-windows-domain-using-pbis-open) -Joe ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 3, 2016, 10:31pm UTC](https://forum.ansible.com/t/winrm/20426/9 "2016-02-03T22:31:00Z")
OK, so i setup a new ubuntu serer and followed instructions on tying to domain and looks to be successful…here is the latest error: root@ansible02:/etc/ansible# ansible windows -m win\_ping -vvvv Using /etc/ansible/ansible.cfg as config file Loaded callback minimal of type stdout, v2.0 An exception occurred during task execution. The full traceback is: Traceback (most recent call last): File “/usr/lib/pymodules/python2.7/ansible/executor/process/worker.py”, line 114, in run self.\_shared\_loader\_obj, File “/usr/lib/pymodules/python2.7/ansible/executor/task\_executor.py”, line 119, in run res = self.\_execute() File “/usr/lib/pymodules/python2.7/ansible/executor/task\_executor.py”, line 366, in \_execute self.\_connection = self.\_get\_connection(variables=variables, templar=templar) File “/usr/lib/pymodules/python2.7/ansible/executor/task\_executor.py”, line 582, in \_get\_connection connection = self.\_shared\_loader\_obj.connection\_loader.get(conn\_type, self.\_play\_context, self.\_new\_stdin) File “/usr/lib/pymodules/python2.7/ansible/plugins/ **init**.py”, line 326, in get self.\_module\_cache[path] = self.\_load\_module\_source(‘.’.join([self.package, name]), path) File “/usr/lib/pymodules/python2.7/ansible/plugins/ **init**.py”, line 313, in \_load\_module\_source module = imp.load\_source(name, path, module\_file) File “/usr/lib/pymodules/python2.7/ansible/plugins/connection/winrm.py”, line 28, in import xmltodict **ImportError: No module named xmltodict** 10.40.1.31 | FAILED! =\> { “failed”: true, “stdout”: “” } root@ansible02:/etc/ansible# ansible-playbook -i hosts ipconfig.yml PLAY [test raw module] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [run ipconfig] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* **An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ImportError: No module named xmltodict** fatal: [10.40.1.31]: FAILED! =\> {“failed”: true, “stdout”: “”} PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 10.40.1.31 : ok=0 changed=0 unreachable=0 failed=1 ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 3, 2016, 10:37pm UTC](https://forum.ansible.com/t/winrm/20426/10 "2016-02-03T22:37:47Z")
sorry for buggin you all soo much, but i feel im almost there! root@ansible02:/etc/ansible# ansible windows -m win\_ping -vvvv Using /etc/ansible/ansible.cfg as config file Loaded callback minimal of type stdout, v2.0 \<10.40.1.31\> ESTABLISH WINRM CONNECTION FOR USER: agent@domain.LOCAL on PORT 5986 TO 10.40.1.31 10.40.1.31 | FAILED! =\> { “failed”: true, “msg”: “ERROR! kerberos: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243)), ssl: 500 WinRMTransport. [Errno 111] Connection refused” } ro ---
**Author:** ![Nikhil\_Shah](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@Nikhil\_Shah](https://forum.ansible.com/u/Nikhil_Shah)\ **Post date:** [February 3, 2016, 11:24pm UTC](https://forum.ansible.com/t/winrm/20426/11 "2016-02-03T23:24:20Z")
I’d like to thank you all, i was able to resolve my windows issue. Few things I had to do was the following: 1. Use Ubuntu instead of CentOS (which is not the reason for the issues) 2. Install PBIS and set that stuff up 3. Follow the instructions on [http://docs.ansible.com/ansible/intro\_windows.html](http://docs.ansible.com/ansible/intro_windows.html) 4. pip install xmltodict 5. pip install pywinrm 6. Install apt-get install krb5-user (to be able to run kinit) 7. Kept getting “ssl: 500 WinRMTransport” so i ended up using HTTP port 5985 (Ill figure out the whole SSL stuff at a later point) Thanks guys! ---
**Author:** ![Gilberto\_Valentin](https://avatars.discourse-cdn.com/v4/letter/g/b4bc9f/32.png) [@Gilberto\_Valentin](https://forum.ansible.com/u/Gilberto_Valentin)\ **Post date:** [February 4, 2016, 3:31pm UTC](https://forum.ansible.com/t/winrm/20426/12 "2016-02-04T15:31:58Z")
I am glad you got this working. I have to prepare for this same setup and wondering if you have any comprehensive notes that you can share here?