Chef-run winrm WinRM::WinRMAuthorizationError

Chef Infra (archive)
1

Hi there,
Can anybody help me what caused this error?

Workstation on Linux:

$ chef-run 'winrm://Administrator:password@xx.xx.x.xxx' sv_os_config::win_os_hardening --no-ssl-verify
[✔] Packaging cookbook... done!
[✔] Generating local policyfile... exporting... done!
[✖] Applying sv_os_config::win_os_hardening from /home/username/chef/chef-repo/cookbooks/sv_os_config to target.
└── [✖] [xx.xx.x.xxx] WinRM::WinRMAuthorizationError

CHEFINT001

An unexpected error has occurred:

  WinRM::WinRMAuthorizationError

If you are not able to resolve this issue, please contact Chef support
at workstation@chef.io and include the log file and stack trace from the
locations below:

  /home/username/.chef-workstation/logs/default.log
  /home/username/.chef-workstation/logs/stack-trace.log

Windows 2016 winrm config

PS C:\Users\Administrator> winrm get winrm/config
Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = false
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts
    Service
        RootSDDL = <masked string>
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 1500
        EnumerationTimeoutms = 240000
        MaxConnections = 300
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = true
        Auth
            Basic = true
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = false
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = *
        IPv6Filter = *
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint
        AllowRemoteAccess = true
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 7200000
        MaxConcurrentUsers = 2147483647
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 2147483647
        MaxMemoryPerShellMB = 2147483647
        MaxShellsPerUser = 2147483647

The following two commands ran successfully, but not the chef-run command.

$ inspec exec test/integration/profile/controls/win_os_hardening_test.rb -t 'winrm://Administrator:password@xx.xx.x.xxx'

$ knife winrm 'name:nodename' --winrm-user Administrator -a ipaddress 'chef-client -l info -L C:\chef\client.log' --winrm-password password
2

Are you really sure of the password you typed ? AuthorizationError has few chances to be something else than that, with redacted logs we can't be sure nor spot a typo so I'm asking just in case.

Could be a train vs knife internal winrm difference too, but I would expect something else as error message than an authorization thing

3

Hi Tensibai, I am sure the password I typed was correct, any chances that the error was caused by the winrm configruation?

4

Other issue might be a chance of firewall enabled on the instance if the password and username is right. Look for correct firewall rules or disable it for temporary fix.

5

I managed to solve this by changing the format of the options to the below:

chef-run winrm://xx.xx.x.xxx --user Administrator --password password sv_os_config::win_os_hardening

Although the Chef docs says it should work even if I use the origin one...