title: WinRM - the specified credentials were rejected by the server
body: <p>I am unable to get WinRM session in a python script.</p>
  
  <h2>Environment</h2>
  
  <pre><code>ad-dns.test.com    - Windows 2012 AD and DNS Server
  box88.test.com     - CentOS 7.2 : Kerberos, Python (Not joined to domain)
  box62.test.com     - Windows 2012 R2 Standard (Joined to domain)
  box63.test.com     - Windows 10 (Joined to domain)
  </code></pre>
  
  <hr>
  
  <h2>Configurations</h2>
  
  <p>I have enabled WinRM on Windows 10 and 2012 server through <a href="https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1" rel="noreferrer">ConfigureRemotingForAnsible.ps1</a> PowerShell script. These are the WinRM configurations.</p>
  
  <pre><code>PS C:\Windows\system32&gt; winrm get winrm/config
  Config
      MaxEnvelopeSizekb = 500
      MaxTimeoutms = 60000
      MaxBatchItems = 32000
      MaxProviderRequests = 4294967295
      Client
          NetworkDelayms = 5000
          URLPrefix = wsman
          AllowUnencrypted = false
          Auth
              Basic = true
              Digest = true
              Kerberos = true
              Negotiate = true
              Certificate = true
              CredSSP = false
          DefaultPorts
              HTTP = 5985
              HTTPS = 5986
          TrustedHosts = *
      Service
          RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
          MaxConcurrentOperations = 4294967295
          MaxConcurrentOperationsPerUser = 1500
          EnumerationTimeoutms = 240000
          MaxConnections = 300
          MaxPacketRetrievalTimeSeconds = 120
          AllowUnencrypted = false
          Auth
              Basic = true
              Kerberos = true
              Negotiate = true
              Certificate = false
              CredSSP = false
              CbtHardeningLevel = Relaxed
          DefaultPorts
              HTTP = 5985
              HTTPS = 5986
          IPv4Filter = *
          IPv6Filter = *
          EnableCompatibilityHttpListener = false
          EnableCompatibilityHttpsListener = false
          CertificateThumbprint
          AllowRemoteAccess = true
      Winrs
          AllowRemoteShellAccess = true
          IdleTimeout = 7200000
          MaxConcurrentUsers = 10
          MaxShellRunTime = 2147483647
          MaxProcessesPerShell = 25
          MaxMemoryPerShellMB = 1024
          MaxShellsPerUser = 30
  PS C:\Windows\system32&gt; 
  </code></pre>
  
  <p>I have prepared CentOS box as below</p>
  
  <pre><code># yum -y install python-pip python-devel krb5-devel krb5-libs krb5-workstation
  # pip install --upgrade pip
  # pip install  "pywinrm&gt;=0.1.1" kerberos pykerberos requests-kerberos isodate xmltodict
  
  # cat /etc/krb5.conf
  [libdefaults]
   default_realm = TEST.COM
  
  [realms]
   TEST.COM = {
    kdc = ad-dns.test.com
    admin_server   = ad-dns.test.com
    kpasswd_server = ad-dns.test.com
    default_domain = test.com
   }
  
  [domain_realm]
   .test.com = TEST.COM
   test.com = TEST.COM
  #
  
  # kinit vkumar@TEST.COM
  Password for vkumar@TEST.COM:
  # klist
  Ticket cache: FILE:/tmp/krb5cc_0
  Default principal: vkumar@TEST.COM
  
  Valid starting       Expires              Service principal
  2016-06-30T02:15:20  2016-06-30T12:15:20  krbtgt/TEST.COM@TEST.COM
      renew until 2016-07-01T02:15:16
  #
  </code></pre>
  
  <h2>Problem</h2>
  
  <p>Until now, everything appears smooth. The problem occurs when I try to use this kerberos ticket to authenticate the Windows servers using the below script.</p>
  
  <pre><code>#!/usr/bin/env python
  
  import winrm
  
  s = winrm.Session('box63.test.com', auth=('vkumar@TEST.COM', 'IamUsingKerbTicket'), transport='kerberos')
  r = s.run_cmd('ipconfig', ['/all'])
  print r.status_code
  print r.std_out
  print r.std_err
  
  
  # ./winrm_ipconfig.py
  Traceback (most recent call last):
    File "./winrm_ipconfig.py", line 6, in &lt;module&gt;
      r = s.run_cmd('ipconfig', ['/all'])
    File "/usr/lib/python2.7/site-packages/winrm/__init__.py", line 37, in run_cmd
      shell_id = self.protocol.open_shell()
    File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 132, in open_shell
      res = self.send_message(xmltodict.unparse(req))
    File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 207, in send_message
      return self.transport.send_message(message)
    File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 179, in send_message
      raise InvalidCredentialsError("the specified credentials were rejected by the server")
  winrm.exceptions.InvalidCredentialsError: the specified credentials were rejected by the server
  #
  </code></pre>
  
  <p>Not sure, why I see this error while <code>Event Logs</code> on Windows server show success. Apparently, I see three <code>Logon</code> and <code>Logoff</code> occurring at the same time. 
  <a href="https://i.stack.imgur.com/C520p.png" rel="noreferrer"><img src="https://i.stack.imgur.com/C520p.png" alt="Windows_Event_Logs"></a></p>
  
  <p>Not sure what I am missing here. Firewall is stopped/disabled on both CentOS &amp; Windows machines and times are also in sync.</p>