Ansible for Windows – Troubleshooting

Managing Windows machines using Ansible is pretty straightforward and simple as in the document. You need to configure and enable WinRM on your Windows machine and then open WinRM ports 5985 and 5986(HTTPS) in the Windows Firewall (and also in the network firewall if any).

See other articles to learn how to manage windows using Ansible

• Configure Your Windows Host to be Managed by Ansible
• How to open WinRM ports in the Windows firewall
• Ansible Windows Management using HTTPS and SSL

But there are many cases where Ansible developers and users struggled to connect Windows machine from Ansible and I thought to publish common mistakes or errors and quick fixes for those issues.

Note: This is a living document and I will update this article whenever I find new issues or fixes related to the topic.

I have enabled WinRM and Firewall, how to verify ?

Simply check the port access using nc or any other available tools on your Ansible machine.

$ nc -vz 192.168.99.103 5985 
Connection to 192.168.99.103 port 5985 [tcp/wsman] succeeded !

I am facing Python Multiprocessing error while executing Ansible command

I am getting below error while executing ansible command.

$ ansible win2016 -m win_ping
objc[72452]: +[__NSCFConstantString initialize] may have been in progress in another thread when fork() was called.
objc[72452]: +[__NSCFConstantString initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.

Fix: This error occurs because of added security to restrict multithreading in macOS High Sierra and later versions of macOS.

$ export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

You can export this via zsh or bash profile permanently.

WinRM issue with Unencrypted User Account

$ ansible win2016 -m win_ping
win2016 | UNREACHABLE! => {
    "changed": false,
    "msg": "basic: the specified credentials were rejected by the server",
    "unreachable": true
}

Fix: Enable basic authentication and unencrypted data on the WinRM service

Please note, if you are using HTTPS authentication, you should not enable this configurations.

1. Enable basic authentication on the WinRM service

PS > winrm set winrm/config/service/auth '@{Basic="true"}'
Auth
    Basic = true
    Kerberos = true
    Negotiate = true
    Certificate = false
    CredSSP = false
    CbtHardeningLevel = Relaxed

2. Also allow transfer of unencrypted data on the WinRM service.

PS >  winrm set winrm/config/service '@{AllowUnencrypted="true"}'
Service
    RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = true
    Auth
        Basic = true
        Kerberos = true
        Negotiate = true
        Certificate = false
        CredSSP = false
        CbtHardeningLevel = Relaxed
    DefaultPorts
        HTTP = 5985
        HTTPS = 5986
    IPv4Filter = *
    IPv6Filter = *
    EnableCompatibilityHttpListener = false
    EnableCompatibilityHttpsListener = false
    CertificateThumbprint
    AllowRemoteAccess = true

You can check status using winrm get winrm/config/service.

References

• Setting up a Windows Host
• Windows Remote Management
• Configure WinRM to Use HTTP (VMWare Doc)