Ansible WinRM shows 401 Unauthorized when pywinrm works with no problem

[Tianwei Liu]

Hi,

I am having this weird problem that my ansible will always show 401 error when trying to connect my windows machine via winrm. Although I can use pywinrm with no problem at all authenticating with the exact same account and password.

My inventory:

[windows]

192.168.2.3

[windows:vars]

ansible_ssh_user=ansible

ansible_ssh_password=ansible

ansible_ssh_port=5986

ansible_connection=winrm

I can run the example from: https://github.com/diyan/pywinrm and get results with no problem but my ansible ping results in 401.

$ ansible windows -i inventory.yml -m win_ping -vvvv

<192.168.2.3> ESTABLISH WINRM CONNECTION FOR USER: ansible on PORT 5986 TO 192.168.2.3

<192.168.2.3> WINRM CONNECT: transport=plaintext endpoint=https://192.168.2.3:5986/wsman

<192.168.2.3> WINRM CONNECTION ERROR: 401 Unauthorized.

192.168.2.3 | FAILED => 401 Unauthorized. 

[J Hawkesworth]

Which ansible version are you using?  (run 'ansible --version' to find out).

Generally 401 means the expected password doesn't match the one you supplied.

You could check the event log on the windows machine for more information.

Also, did you run https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1 ?

[Aleksander Sjåfjell]

Hi, Tianwei Liu. Did you find a solution for this problem? 

I am experiencing the exact same result. I can run winrm-commands directly, but Ansible gives me 401, access denied. If i run 

ansible all -i windows.yml -m win_ping -vvvv

Where windows.yml is as follows:

[all]

192.168.50.4

[all:vars]

ansible_user="vagrant"

ansible_password="vagrant"

ansible_port="5985"

ansible_connection="winrm"

I get the following output:

<192.168.50.4> ESTABLISH WINRM CONNECTION FOR USER: aas on PORT 5986 TO 192.168.50.4

<192.168.50.4> WINRM CONNECT: transport=plaintext endpoint=https://192.168.50.4:5986/wsman

<192.168.50.4> WINRM CONNECTION ERROR: 401 Unauthorized.

What i find a bit weird is that user is specified as 'aas' (my OSX user). It seems that the username from inventory file is not used. All help apprecieated.

[J Hawkesworth]

I wonder if this is still looking for the older name

ansible_ssh_user instead of ansible_user ?

You don't mention which version of ansible you are using.

I haven't checked but if it is older than current dev I think you will need to use the name 

ansible_ssh_user in your group vars 

same thing will apply for 

ansible_ssh_password

and 

ansible_ssh_port

even though winrm is not using ssh for the transport, the settings needed ssh in them for historical reasons.

Jon

[kevin....@gmail.com]

Try changing:

ansible_ssh_password=ansible

to

ansible_ssh_pass=ansible

That tripped me up with 1.9.4.

Same thing would apply to your windows.yml.

Kev

On Wednesday, October 21, 2015 at 5:48:13 PM UTC+1, Tianwei Liu wrote:

[Krishna Chaitanya]

Hi, 

I am facing same issue even after changing ansible_ssh_password to ansible_password.

Facing issue with 401 unauthorized error for winrm connection. Need help