[chef] Chef and Windows Active directory

["Deprez, Tom" < >]

Hi,

 

I’ve been bootstrapping Windows servers in a lab environment using local admin accounts and this has worked fine (bootstrap command is run from a Windows server). However, we’re now trying to integrate this into production and would like to use an AD account when bootstrapping the server. This is failing with the following error:

 

D:\chef-repo>knife bootstrap windows winrm 10.175.1.21 --winrm-user="domain\build_chef" --winrm-password="password"

Bootstrapping Chef on 10.175.1.21

ERROR: Failed to authenticate to ["10.175.1.21"] as domain\build_chef

Response: Bad HTTP response returned from server (401).

ERROR: Batch render command returned

 

On the server I am trying to bootstrap, I get this error in the security logs:

Account For Which Logon Failed:

                Security ID:                           NULL SID

                Account Name:                    Build_Chef

                Account Domain:                 BMGUK

 

Failure Information:

                Failure Reason:                    An Error occured during Logon.

                Status:                                    0xC000005E

                Sub Status:                            0x0

 

Detailed Authentication Information:

                Logon Process:                     NtLmSsp

                Authentication Package:    NTLM

                Transited Services:              -

                Package Name (NTLM only):              -

                Key Length:                           0

 

 

Any ideas on why this is failing? And why is it trying to use NTLM rather than Kerberos?

 

The user is in the local administrators group so has access to the server.

 

Thanks

Tom

HBVB trading as Bauer Corporate Services (BCS) is a division of the Bauer Media
Group the largest consumer publisher in the UK, and second largest commercial 
radio broadcaster. BCS provides financial services and manages and develops IT 
systems on which our UK publishing, broadcast, digital and partner businesses depend.

The information in this email is intended only for the addressee(s) named above. 
Access to this email by anyone else is unauthorised. If you are not the intended 
recipient of this message any disclosure, copying, distribution or any action 
taken in reliance on it is prohibited and may be unlawful. HBVB do not warrant that
any attachments are free from viruses or other defects and accept no liability for
any losses resulting from infected email transmissions.

Please note that any views expressed in this email may be those of the originator
and do not necessarily reflect those of this organisation.

HBVB  is registered in England; Registered address is
1 Lincoln Court, Lincoln Road, Peterborough, PE1 2RF.

Registration number 8453545