---
title: "Change a password over Kerberos through the Network Connector"
slug: "execution-how-to-change-a-password-over-kerberos-through-the-network-connector"
updated: 2026-11-03T14:47:51Z
published: 2026-11-03T14:47:51Z
canonical: "docs.senhasegura.io/execution-how-to-change-a-password-over-kerberos-through-the-network-connector"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Change a password over Kerberos through the Network Connector

Change a Windows credential password over Kerberos when Segura™ Platform reaches the Active Directory domain only through the Network Connector. This procedure configures the password-change template, the device, and the credential, then runs and verifies the change.

## Requirements

- Segura™ Platform 4.2.0 or later.
- The kerberos-connect container is deployed on the Network Connector. See [Deploy the kerberos-connect container on the Network Connector](/v4.2/docs/network-connector-how-to-deploy-the-kerberos-connect-container).
- Administrative permission to create templates and to edit devices and credentials.
- The target Windows device is reachable from the Network Connector agent over WinRM: port 5985 for HTTP, or 5986 for HTTPS.

## Steps

### Step 1: Create the password-change template

1. On Segura™ Platform, open the **Grid Menu** and select Executions.
2. Go to **Settings > Template**.
3. Click **View actions**, represented by the three vertical dots, and select **+ New**.
4. In the **Execution template** window, complete the following fields:
  - **Name**: a name that identifies the template.
  - **Enabled**: select **Yes**.
  - **Executor**: select **Ansible**.
  - **Execution type**: select **Change password**.
  - **Playbook**: select **SNC Windows Kerberos change password**.
5. Click **Save**.

### Step 2: Configure the device

1. Open the **Grid Menu** and select Devices.
2. Select the target device, or create a new one. See [How to configure devices on Network Connector](/docs/network-connector-how-to-configure-devices-on-network-connector).
3. On the **Information** tab:

Attention

Kerberos requires the device addressed by FQDN and the domain in uppercase, matching the case that the Active Directory domain accepts.
  - **Device name** and **IP, Hostname or management URL**: enter the device FQDN, for example `WS2019-KERBEROS.winrm.example.com`.
  - **Domain**: enter the Active Directory domain in uppercase, for example `WINRM.EXAMPLE.COM`.
4. On the **Connectivity** tab:
  - In the Network Connector field, select the agent that reaches the device.
  - Add a **Windows RM** connectivity entry with the WinRM port: `5985` for HTTP, or `5986` for HTTPS.
5. Click **Save**.

### Step 3: Configure the credential

1. Open the **Grid Menu** and select PAM Core.
2. Go to **Credentials > All**, then select the credential or create a new one. See [How to set up a credential in Segura™](/docs/pam-credential-how-to-set-up-a-credential-in-senhasegura).
3. On the **Information** tab:
  - **Username**: the domain account.
  - **Password type**: select **Domain user**.
  - **Device**: select the device from Step 2.
  - **Domain**: enter the realm in uppercase, matching the device domain.
4. On the **Additional settings** tab, add an extra field:
  - **Name**: `USE_KERBEROS`
  - **Value**: `true`
5. On the **Execution settings** tab, under **Credential password change settings**:
  - Select **Enable automatic change**.
  - **Change plugin**: select **Ansible**.
  - **Change template**: select the template from Step 1.
6. Click **Save**.

### Step 4: Request and verify the password change

1. In PAM Core, go to **Credentials > Password change requests**.
2. Click **Request password change**, then confirm the request.
3. In Executions, go to **All operations**. Click **Filter** to refresh the list until the status changes from **Executing** to **Successfully completed**.
Info

Open the operation details to review the Ansible execution logs for the run.
4. In PAM Core, go to **Credentials > All credentials**, then click the key icon to confirm the password was updated.

## Related topics

- [Deploy the kerberos-connect container on the Network Connector](/v4.2/docs/network-connector-how-to-deploy-the-kerberos-connect-container): the prerequisite setup.
- For the direct WinRM path without the Network Connector, see [How to change a password with Kerberos authentication for Windows RM](/v4.2/docs/execution-how-to-change-a-password-with-kerberos-authentication-for-windows-rm).

---

Do you still have questions? Reach out to the [Segura™ Community](https://community.senhasegura.io/).