Ansible, in fact, supports five different Windows authentication mechanisms as follows:
- Basic: Supports local accounts only
- Certificate: Supports local accounts only, conceptually similar to SSH key-based authentication
- Kerberos: Supports AD accounts
- NTLM: Supports both local and AD accounts
- CredSSP: Supports both local and AD accounts
It is worth noting that Kerberos, NTLM, and CredSSP all provide message encryption over HTTP, which improves security. However, we have already seen how easy it is to set up WinRM over HTTPS, and WinRM management over plain HTTP is not enabled by default anyway, so we will assume that the communication channel is already encrypted. WinRM is a SOAP protocol meaning it must run over ...
