# Working with Ansible on Windows Hosts **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [November 12, 2018, 9:07pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013 "2018-11-12T21:07:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 12, 2018, 9:07pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/1 "2018-11-12T21:07:10Z")
Hello All, did anyone figured out working with ansible on windows host, if so please give me the process and info how you guys get this working on windows. thanks, Narmada ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 12, 2018, 9:32pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/2 "2018-11-12T21:32:59Z")
Depends on what you mean by working on Windows, Ansible can remotely connect to a Windows host and execute modules against that. We have numerous docs and a quick Google search will give you lots of info and blog posts detailing how this can be done. If you want to know if you can run Ansible as a controller on a Windows host, you cannot do this natively. The easiest way is to use Windows Subsystem for Linux (WSL) or setup a VM and run it from that. There are also numerous guides out there detailing these steps which are a quick Google search away. Thanks Jordan ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 12, 2018, 9:52pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/3 "2018-11-12T21:52:29Z")
Thanks Jordan, yeah i am trying to use windows as hosts and i spent lot of time setting up windows machines as hosts. i tried kerberos as well but no luck. ---
**Author:** ![Thad\_Guidry](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@Thad\_Guidry](https://forum.ansible.com/u/Thad_Guidry)\ **Post date:** [November 12, 2018, 10:46pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/4 "2018-11-12T22:46:10Z")
Since your using Windows, you might also want to know that the ecosystem is not only Ansible… DSC also provides the rest of what you often need. [https://www.ansible.com/blog/using-the-win\_dsc-module-in-ansible](https://www.ansible.com/blog/using-the-win_dsc-module-in-ansible) ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 12, 2018, 10:57pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/5 "2018-11-12T22:57:12Z")
Thanks Thad, i am already using DSC for server configuration, but after going thorugh Ansible felt like using single component for both linux and windows. my ping play book is not at all working on windows hosts. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 12, 2018, 11:50pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/6 "2018-11-12T23:50:46Z")
If you’ve already attempted to connect but failing it would be best to share what you have done as well as any errors you are getting back. I can definitely tell you it is possible but without knowing what issues you are having it’s hard to point you in the right direction. Some things that would be good to know are; - The inventory you are using - The playbook you are running with - The command and output when you run with -vvv so we can see the errors - If you are running with Kerberos, a copy of the /etc/krb5.conf file - Whether you can run ‘kinit user@DOMAIN’ outside of Ansible successfully Thanks Jordan ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 13, 2018, 12:44am UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/7 "2018-11-13T00:44:15Z")
krb5.config includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin\_server = FILE:/var/log/kadmind.log [libdefaults] dns\_lookup\_realm = false ticket\_lifetime = 24h renew\_lifetime = 7d forwardable = true rdns = false default\_realm = [XYZ.COM](http://XYZ.COM) default\_ccache\_name = KEYRING:persistent:%{uid} [realms] [XYZ.COM](http://XYZ.COM) = { kdc = [USERNAME@XYZ.COM](mailto:USERNAME@XYZ.COM) } [domain\_realm] .[xyz.com](http://xyz.com) = [XYZ.COM](http://XYZ.COM) [xyz.com](http://xyz.com) = [XYZ.COM](http://XYZ.COM) ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 13, 2018, 2:19am UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/8 "2018-11-13T02:19:07Z")
You’re missing the most important thing, what’s the error you are receiving and whether you kinit can get the user’s token. Briefly looking at it - The KDC as has [USER...@XYZ.COM](mailto:USER...@XYZ.COM), this should be a hostname and not an account of the domain controller - Your inventory file has ansibel\_ssh\_user, this has incorrect spelling and isn’t needed because you have defined ansible\_user in the group vvariables - You have ansible\_winrm\_message\_encryption: always but because you are running over https this isn’t needed, you can omit this value Please share the output you are getting, preferably run Ansible with -vvv, and try and run kinit manually outside of Ansible to verify your kerb setup is correct. Thanks Jordan ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 13, 2018, 5:02pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/9 "2018-11-13T17:02:58Z")
Thanks Jordan, i tried like what you mentioned above, but this is the error I am getting fatal: [servername]: UNREACHABLE! =\> {“changed”: false, “msg”: “Kerberos auth failure for principal [username@xyz.com](mailto:username@xyz.com) with subprocess: kinit: Cannot find KDC for realm "[xyz.com](http://xyz.com)" while getting initial credentials”, “unreachable”: true} please suggest with some solution… thanks, Narmada ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 13, 2018, 7:47pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/10 "2018-11-13T19:47:58Z")
So that error is saying it failed to run kinit to get a kerb ticket for the user ‘user…@xyz.com’. This isn’t necessarily an Ansible issue but a problem with how your Kerberos setup is done. It is saying it cannot contact/find the KDC in the realm ‘[xyz.com](http://xyz.com)’ so the one you have configured in your /etc/krb5.conf may not be correct or just not reachable. Make sure the value for ‘kdc’ in the realms section is a valid hostname for your domain controller and that the host is able to resolve it to an actual host. Thanks Jordan ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 13, 2018, 8:59pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/11 "2018-11-13T20:59:41Z")
Now i am getting another new error, somehow i amble to create a kinit ticket but the error is (Caused by NewConnectionError(‘\: Failed to establish a new connection: [Errno 111] Connection refused’,))", “unreachable”: true} ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 13, 2018, 9:56pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/12 "2018-11-13T21:56:01Z")
That either means the Firewall is blocking that port of you have no HTTPS WinRM listener. To verify what listeners are active you can run ‘winrm enumerate winrm/config/listener’ on your Windows host. ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 13, 2018, 10:24pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/13 "2018-11-13T22:24:32Z")
PS H:\> winrm enumerate winrm/config/listener Listener [Source=“GPO”] Address = \* Transport = HTTP Port = 5985 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 0.00.000.000, , 127.0.0.1, ::1, fe80::5efe:10.33.138.118%5, fe80::7008:2200:c50:e8f4%3 Listener [Source=“Compatibility”] Address = \* Transport = HTTP Port = 80 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 0.00.000.000, 127.0.0.1, ::1, fe80::5efe:10.33.138.118%5, fe80::7008:2200:c50:e8f4%3 Listener [Source=“Compatibility”] Address = \* Transport = HTTPS Port = 443 Hostname = \<[Servername.domain.com](http://Servername.domain.com)\> Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 0.00.000.000, 127.0.0.1, ::1, fe80::5efe:10.33.138.118%5, fe80::7008:2200:c50:e8f4%3 PS H:\> this is my inbound rules ![image.png](https://us1.discourse-cdn.com/ansible/optimized/2X/6/68452ae97ea91d24b00c7afa2c3c72df71e39420_2_539x36.png) ---
**Author:** ![Lucas\_Jackson](https://avatars.discourse-cdn.com/v4/letter/l/59ef9b/32.png) [@Lucas\_Jackson](https://forum.ansible.com/u/Lucas_Jackson)\ **Post date:** [November 13, 2018, 10:27pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/14 "2018-11-13T22:27:43Z")
Your problem is you’re not listening on port 5986 ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 13, 2018, 11:21pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/15 "2018-11-13T23:21:33Z")
Thanks Lucas, is there any way i can make it listen on port 5986, or can we use 5985 to connect. but here is from my windows host PS H:\> winrm enumerate winrm/config/listener Listener [Source=“GPO”] Address = \* Transport = HTTP Port = 5985 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 0.00.000.000, , 127.0.0.1, ::1, Listener [Source=“Compatibility”] Address = \* Transport = HTTP Port = 80 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 0.00.000.000, 127.0.0.1, ::1, Listener [Source=“Compatibility”] Address = \* Transport = HTTPS Port = 443 Hostname = \<[Servername.domain.com](http://servername.domain.com/)\> Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 0.00.000.000, 127.0.0.1, ::1, ---
**Author:** ![Lucas\_Jackson](https://avatars.discourse-cdn.com/v4/letter/l/59ef9b/32.png) [@Lucas\_Jackson](https://forum.ansible.com/u/Lucas_Jackson)\ **Post date:** [November 13, 2018, 11:36pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/16 "2018-11-13T23:36:12Z")
It’s up to you, depends on the use case. Preferably using https over 5986. Good script to use for configuring winrm for ansible [https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1](https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) You can configure the listener manually if you prefer but script works well ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 14, 2018, 12:21am UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/17 "2018-11-14T00:21:00Z")
Thanks all, I am able to run ping module on windows machines. ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 14, 2018, 12:28am UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/18 "2018-11-14T00:28:17Z")
Lucas or someone can help me with this, currently on my krb5.config i added only 1 [host@DOMAIN.com](mailto:host@DOMAIN.com), but if i want to run on multiple windows machines do i need to add all my hosts on krb5.config file. thanks, Narmada ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [November 14, 2018, 6:40pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/19 "2018-11-14T18:40:54Z")
thanks, it worked , I am able to ping windows hosts but i have one more challenge In my kerberos file i am adding my host name to the realms , so if i need to run a script or anything on multiple windows hosts do i need to add all those host under realms [realms] [XYZ.COM](http://XYZ.COM) = { kdc =[HOSTNAME1.XYZ.COM](http://HOSTNAME1.XYZ.COM) kdc =[HOSTNAME2.XYZ.COM](http://HOSTNAME2.XYZ.COM) } ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 14, 2018, 7:47pm UTC](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013/20 "2018-11-14T19:47:46Z")
You only need to have your kdc (domain controller) in the realms section. This file is used by the local krb5 libraries to know what host to talk to when getting a kerberos ticket. Windows hosts you are authenticating too just need to be resolvable in DNS but don’t need to exist in your krb5.conf file. Thanks Jordan [Next page](https://forum.ansible.com/t/working-with-ansible-on-windows-hosts/29013.md?page=2)