# Basic Question about Bootstrapping Windows Nodes

**URL:** <https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112>\
**Category:** Chef Infra (archive)\
**Created:** [December 26, 2016, 5:29pm UTC](https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112 "2016-12-26T17:29:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amsharm](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@amsharm](https://discourse.chef.io/u/amsharm)\
**Post date:** [December 26, 2016, 5:29pm UTC](https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112/1 "2016-12-26T17:29:01Z")

</div>

I’m new to Chef and trying to bootstrap a Windows node using knife. I’m running the following command from my workstation: knife bootstrap windows winrm **.** \*.\*\*\*.\*\*\* -x Administrator -P \*\*\*\*\*\*

In response, I get “Doing old-style registration with validation key at C:/ … Delete your validation key in order to use your user credentials instead.” The validation key it’s referring to is the organization validator that my workstation uses to connect to the Chef server. Why is it using this validation key to connect to the node and not the password I specify in the command? Is it because of how I have my knife.rb set up?

---

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [December 26, 2016, 8:19pm UTC](https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112/2 "2016-12-26T20:19:44Z")

</div>

Hi there, this can definitely be confusing. Let me try to explain a bit what you are seeing. The validation key on your work station really is not used to connect to the server. Its an artifact historically used to register new nodes with your chef server via knife. When you use knife bootstrap, knife copies it to the node you are trying to bootstrap and it uses that key temporarily to authenticate with the chef server as a one time action and then it is given its own dedicated client key. As of chef client 12.2 (well over a year ago), this is no longer necessasy. Instead of copying the validation key as a temporary auth token to the new node, knife can use your own client key to generate the permanent client key that will be used by the new node. In order to use this newer “validator-less” model, simply delete your validator key entry from your knife.config.

Furthermore, the credentials you provided on the command line are not used until after your node has been registered with the server. They are the credentials used by knife to logon to the new node (via ssh or winrm) and run the newly installed chef-client for the node’s very first converge.

Hope this makes sense.

Matt

---

<div class="post-metadata">

**Author:** ![jugatsu](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jugatsu](https://discourse.chef.io/u/jugatsu)\
**Post date:** [December 28, 2016, 4:37am UTC](https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112/3 "2016-12-28T04:37:49Z")

</div>

By the way, guys, what is best practice to workaround winrm issues like .net or sql installs when bootstraping windows nodes via knife bootstrap? knife bootstrap does’t have yet elevated command switch.

---

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [December 28, 2016, 7:55am UTC](https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112/4 "2016-12-28T07:55:47Z")

</div>

What you can do is bootstrap the node without a runlist. Then once your node is registered, use `knife node run_list set` to set the run list. Now any subsequent chef-client run should converge the new run list. You could use `knife winrm` with an elevated shell to do that or if you run chef from a scheduled task or windows service, those recipes should now work.

---

<div class="post-metadata">

**Author:** ![amsharm](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@amsharm](https://discourse.chef.io/u/amsharm)\
**Post date:** [December 28, 2016, 5:10pm UTC](https://discourse.chef.io/t/basic-question-about-bootstrapping-windows-nodes/10112/5 "2016-12-28T17:10:58Z")

</div>

Great answer. Yes, makes sense. I’ll delete this validator key and remove it’s reference from knife.config. Thanks again