Kerberos auth is likely your problem- as soon as you rename the computer, the Kerberos service ticket is no longer valid, as it has the original hostname baked into it.
I see two options that might work: either use NTLM or CredSSP (at least for that task), or do the rename as a "run now-ish" scheduled task (you'd still need to avoid a race where the rename occurs before the Ansible task that schedules it has returned). This could probably also be fixed by having pywinrm/requests-kerberos only pass the Kerberos auth headers on the initial connection (since it reuses the underlying HTTP connection), but that's non-HTTP-RFC compliant and will likely cause problems for people running through proxies and other things that might cause the underlying connection to be broken. This is the way the Microsoft PS client stack does it, but I'm not sure how much hassle it'd be to implement (it's several layers away from the Ansible code in requests-kerberos)- doing it right might require changes to requests/urllib3 directly. -Matt On Friday, April 7, 2017 at 2:37:09 PM UTC-7, Jonathan Coupal wrote: > > Hi, for some reason I'm really struggling with executing domain-related > activities on Windows machines that are domain members. Two specific things > that I'm trying to do is Rename-Computer and Remove-Computer. Note that I > am using Kerberos for authentication and am not passing through credentials > stored in any files. > > When I try Rename-Computer I get an access denied error, if I supply the > "DomainCredential" switch to include my username, the Ansible task simply > sits there forever and I have to cancel the task. > > Anyone have similar experiences? Ideas? > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscr...@googlegroups.com. To post to this group, send email to ansible-project@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/787eef44-9f32-4022-84db-76477689526a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
