diff --git a/ad-auth/tasks/sssd.yml b/ad-auth/tasks/sssd.yml
index dacd5de6c0228c67a976f73a9373f1d4df885120..654f5e359c085fce07ea8e1f46bdf2e711b1703c 100644
--- a/ad-auth/tasks/sssd.yml
+++ b/ad-auth/tasks/sssd.yml
@@ -26,6 +26,16 @@
       command: realm discover -v "{{ domain }}"
     - name: get a kerberos ticket
       shell: echo "{{ lookup('passwordstore', 'samba-admin') }}" | kinit Administrator
+      when: debian_version == "jessie"
+    - name: ensure pexpect is installed
+      apt: name=python-pexpect state=installed
+      when: debian_version == "stretch"
+    - name: get a kerberos ticket
+      expect:
+        command: kinit Administrator
+        responses:
+          "Password for Administrator@{{ domain.upper() }}": "{{ lookup('passwordstore', 'samba-admin') }}"
+      when: debian_version == "stretch"
     - name: leave any other realm
       command: realm leave
       register: result