[chef] Re: Re: Re: knife bootstrap windows winrm - timeout.

["Steven Murawski" < >]

                                        Hey Steve,

Just FYI, if you are using knife bootstrap windows ...., you are using knife-windows (that capability isn't in core Chef yet).

Anyway, as you noticed with the AllowUnencrypted setting, that is due to the fact that we are missing libraries for Linux and Mac that can do Windows negotiate authentication.  We've got work in progress (mostly from Bryan's team) to make that configuration and security story much better/easier, but for the time being we are stuck with that.

Steve

Steven Murawski

Community Software Development Engineer @ Chef

Microsoft MVP - PowerShell
http://stevenmurawski.com

On 4/16/2015 1:17:24 AM, Button, Steve < > wrote:

1) Some questions and a guess:

What version of knife-windows are you using?

​I'm using knife on a Mac, and it's Chef: 11.16.2​

 

Are you really logging in as plain administrator, or are you using a domain account?

​Yes, plain administrator​

 

Are you running this on a Windows workstation?

​On a Mac​

 

If your answers are "0.8.4", "yes plain local Administrator", and "yes, windows workstation", then try this instead:

knife bootstrap windows winrm 'server.nightly.bla' -r 'app::base' -x .\administrator -P 'xyz'

That is, specify .\Administrator instead of Administrator. In 0.8.4 this triggers the use of the negotiate protocol for authentication.

​Tried that, same thing. But I'm not using knife-windows.​

 

2) You can also use these commands to test your remote winrm configuration:

This should give you a few lines of text that doesn't look like an error (change the IP):

test-wsman 192.158.5.105

Run this in powershell, enter Administrator and the password on the remote machine

$Credential = Get-Credential

You'll need to trust the remote machine probably for the following tests. The output for test-wsman should be similar to the last time you ran it.

winrm set winrm/config/client '@{TrustedHosts="192.168.5.105"}'

test-wsman 192.168.5.105 -Authentication Basic -Credential $Credential

test-wsman 192.168.5.105 -Authentication Negotiate -Credential $Credential

3) Finally if you're still having problems, run and share the output of "winrm get winrm/config/service"

​.... Ahhh! (slaps forehead)

When running that command I notice that 

AllowUnencrypted

 was​

 

​set to false. 

I'm now getting an error about my .pem file missing, but I can solve that one hopefully.

Many thanks! ... and there are some useful commands you've shown me for a Linux admin, using a Mac to build Windows machines! :-)