# Knife-windows bootstrap failing with WinRMAuthorizationError using ssl and domain authentication

**URL:** <https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594>\
**Category:** Chef Infra (archive)\
**Created:** [January 13, 2016, 1:37pm UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594 "2016-01-13T13:37:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![martinheg](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/martinheg/32/1233_2.png) [@martinheg](https://discourse.chef.io/u/martinheg)\
**Post date:** [January 13, 2016, 1:37pm UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594/1 "2016-01-13T13:37:50Z")

</div>

I know there are a number of previous posts with issues similar to this but haven't been able to find an identical one with a solution that works for me.  
I'm trying to run a 'knife bootstrap windows winrm' command from a windows workstation using ssl and domain authentication to bootstrap a windows node and am getting this error:

`ERROR: Failed to authenticate to myhost as mydomain\myusername Response: WinRM::WinRMAuthorizationError Hint: Make sure to profix domain usernames with the correct domain name. Hint: Local user names should be prefixed with computer name or IP address.`

Here's the bootstrap command I'm trying:

`knife bootstrap windows winrm --winrm-transport ssl *myhost* --winrm-user 'mydomain\myusername' --winrm-password 'mypassword' --winrm-ssl-verify-mode verify_none`

The remote machine is configured with a https winrm listener created using the command:  
`new-item -address * -force -path wsman:\localhost\listener -port 5986 -hostname myhost -transport https -certificatethumbprint mythumbprint`

The certificate thumbprint comes from a self-signed certificate created using the `knife windows cert generate` command.

Basic authentication is disabled from a GPO:  
 ![](https://sea2.discourse-cdn.com/flex016/images/transparent.png)

I have also tried using the `-f pemfile` option for the bootstrap command using the .pem file for the same certificate, but without success.

I have been referencing this extremely [helpful resource](http://www.hurryupandwait.io/blog/understanding-and-troubleshooting-winrm-connection-and-authentication-a-thrill-seekers-guide-to-adventure?rq=ssl) from Matt Wrock.  
I tried using the New-SelfSignedCertificateEx tool suggested there to create a certificate with the IsCA flag set to $true (with the intention of using that cert for the https listener) but the tool doesn't create a certificate for me...

A bootstrap without ssl (using sspinegotiate and the winrm-s patch) **does work** , but I want to use ssl.

Workstation:  
Windows 7 (Powershell 4)  
winrm (1.3.4)  
winrm-s (0.3.1)  
knife-windows (1.1.1)

Target Node:  
Windows 2008 R2 Ent

(Note the workstation is in a different domain to the node)

Would appreciate any guidance anyone has.  
Thanks in advance,  
Martin

---

<div class="post-metadata">

**Author:** ![Steven\_Murawski](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/steven_murawski/32/1450_2.png) [@Steven\_Murawski](https://discourse.chef.io/u/Steven_Murawski)\
**Post date:** [January 13, 2016, 8:14pm UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594/2 "2016-01-13T20:14:26Z")

</div>

Hey Martin,

Couple of things to try -

Have you restarted the WinRM service after creating the new listener?  
Is the firewall open for port 5896?  
Are you able to create a PowerShell remoting session over SSL to the node from the workstation?

I’ve also experienced winrm being left in an odd state after GPO controls were put in place, but nothing I could ever consistently reproduce.

Steve

---

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [January 13, 2016, 8:21pm UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594/3 "2016-01-13T20:21:12Z")

</div>

The fact that you are getting a `WinRM::WinRMAuthorizationError` means you are getting a `401` from the winrm endpoint so that likely eliminates any problems with SSL/certificate setup. You are successfully getting through to the winrm service and just failing to authenticate.

Your command looks correct and if you are able to authenticate using SSPI then the credentials must be correct as well.

For the sake of sanity and because I don’t personally use domains much these days, I created a dummy controller and joined another machine to that domain. Then ran:

```auto
knife winrm -m 192.168.137.98 ipconfig --winrm-transport ssl --winrm-user 'kitchen\vagrant' --winrm-password 'vagrant' --winrm-ssl-verify-mode verify_none 

```

This worked. The only key diffrence I can think of is that my workstation is windows 10. You might also see if you can create a normal remote powershell session with the same user making sure to specify `-UseSSL`.

---

<div class="post-metadata">

**Author:** ![martinheg](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/martinheg/32/1233_2.png) [@martinheg](https://discourse.chef.io/u/martinheg)\
**Post date:** [January 14, 2016, 10:32am UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594/4 "2016-01-14T10:32:52Z")

</div>

Thanks for the suggestions guys… still no luck unfortunately.

I hadn’t restarted the WinRM service, but doing so hasn’t helped. The firewall is open.

Running this command to open a remote PowerShell session does work:

`$session = New-PSSession -ComputerName hostname -Port 5986 -Credential 'domain\username' -UseSSL`

---

<div class="post-metadata">

**Author:** ![martinheg](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/martinheg/32/1233_2.png) [@martinheg](https://discourse.chef.io/u/martinheg)\
**Post date:** [January 14, 2016, 1:58pm UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594/5 "2016-01-14T13:58:47Z")

</div>

And just to confirm, that yes it is a 401 status code that is being caught resulting in the `WinRM::WinRMAuthorizationError` error.

Tried passing the credentials in the format of username@domain also (as well as domain/username) but to no avail.

---

<div class="post-metadata">

**Author:** ![martinheg](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/martinheg/32/1233_2.png) [@martinheg](https://discourse.chef.io/u/martinheg)\
**Post date:** [February 29, 2016, 11:29am UTC](https://discourse.chef.io/t/knife-windows-bootstrap-failing-with-winrmauthorizationerror-using-ssl-and-domain-authentication/7594/6 "2016-02-29T11:29:48Z")

</div>

This issue was resolved by upgrading the WinRm gem to 1.7.0 which includes [this](https://github.com/WinRb/WinRM/pull/186) fix for nodes where `CbtHardeningLevel` is set to `Strict` (in my case via a GPO as can be seen in the winrm output in my initial post).  
Thanks Matt for resolving!