# WinRM Chicken / Egg

**URL:** <https://discourse.chef.io/t/winrm-chicken-egg/3779>\
**Category:** Chef Infra (archive)\
**Created:** [March 3, 2013, 8:38am UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779 "2013-03-03T08:38:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Angus\_Buchanan](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@Angus\_Buchanan](https://discourse.chef.io/u/Angus_Buchanan)\
**Post date:** [March 3, 2013, 8:38am UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779/1 "2013-03-03T08:38:30Z")

</div>

I’m familiar with the process of setting up WinRM to allow bootstrapping of  
machines with knife.

However, I’d like to be able to bootstrap machines without having to first  
log onto the machine and configure WinRM. That seems kinda pointless - if  
I’m going to have to log onto the machine to set up a WinRM listener, I  
might as well just install Chef while I’m at it. It also doesn’t scale at  
all…

I’m operating mostly in a cloudy world - combination of Rackspace and EC2.  
I’m considering using user data on EC2 to run the WinRM setup stuff… I  
assume Rackspace has an equivalent mechanism.

Is this pretty much the way to go? What I’d love would be the ability to  
run a script using my RDP credentials, but so far I’ve not seen a way to do  
this.

Am I missing a trick? I’d really love to be able to run a script which  
basically connects to the newly created cloud machine, and runs the winrm  
stuff to set up the ability to run knife over it. Pipe dream?

Thanks!

-aob

---

<div class="post-metadata">

**Author:** ![Chirag\_Jog](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/chirag_jog/32/450_2.png) [@Chirag\_Jog](https://discourse.chef.io/u/Chirag_Jog)\
**Post date:** [March 3, 2013, 9:39am UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779/2 "2013-03-03T09:39:58Z")

</div>

Hello Angus,

On EC2 (and other clouds that support userdata), we can pass a  
Powershell/Batch script that sets things up for us on a Standard Win 2k8  
Image.

Here is the script:

 winrm quickconfig -q winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="300"}' winrm set winrm/config '@{MaxTimeoutms="1800000"}' winrm set winrm/config/service '@{AllowUnencrypted="true"}' winrm set winrm/config/service/auth '@{Basic="true"}'

This should setup winrm for you pre-bootstrapping.

And here is the ec2 command:  
knife ec2 server create ..... --user-data enableWinRM.ps1...

Let me know if this helps!

Regards\*,\*  
_Chirag Jog_  
Chief Technology Officer,  
_Clogeny Technologies_ | [http://clogeny.com](http://clogeny.com)  
(M) 0091-9766619440 | Skype: chirag.jog

On Sun, Mar 3, 2013 at 2:08 PM, Angus Buchanan  
[angus.o.buchanan@gmail.com](mailto:angus.o.buchanan@gmail.com)wrote:

> I'm familiar with the process of setting up WinRM to allow bootstrapping  
> of machines with knife.
> 
> However, I'd like to be able to bootstrap machines without having to first  
> log onto the machine and configure WinRM. That seems kinda pointless - if  
> I'm going to have to log onto the machine to set up a WinRM listener, I  
> might as well just install Chef while I'm at it. It also doesn't scale at  
> all...
> 
> I'm operating mostly in a cloudy world - combination of Rackspace and EC2.  
> I'm considering using user data on EC2 to run the WinRM setup stuff... I  
> assume Rackspace has an equivalent mechanism.
> 
> Is this pretty much the way to go? What I'd love would be the ability to  
> run a script using my RDP credentials, but so far I've not seen a way to do  
> this.
> 
> Am I missing a trick? I'd really love to be able to run a script which  
> basically connects to the newly created cloud machine, and runs the winrm  
> stuff to set up the ability to run knife over it. Pipe dream?
> 
> Thanks!
> 
> -aob

---

<div class="post-metadata">

**Author:** ![Mat\_Schaffer](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/mat_schaffer/32/315_2.png) [@Mat\_Schaffer](https://discourse.chef.io/u/Mat_Schaffer)\
**Post date:** [March 3, 2013, 12:40pm UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779/3 "2013-03-03T12:40:01Z")

</div>

This is a great idea Chirag, thanks for posting!

In a slightly different but related topic, does anyone have info on doing  
this without turning off encryption?

-Mat

On Mar 3, 2013, at 4:40, Chirag Jog [chirag@clogeny.com](mailto:chirag@clogeny.com) wrote:

Hello Angus,

On EC2 (and other clouds that support userdata), we can pass a  
Powershell/Batch script that sets things up for us on a Standard Win 2k8  
Image.

Here is the script:

 winrm quickconfig -q winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="300"}' winrm set winrm/config '@{MaxTimeoutms="1800000"}' winrm set winrm/config/service '@{AllowUnencrypted="true"}' winrm set winrm/config/service/auth '@{Basic="true"}'

This should setup winrm for you pre-bootstrapping.

And here is the ec2 command:  
knife ec2 server create ..... --user-data enableWinRM.ps1...

Let me know if this helps!

Regards\*,\*  
_Chirag Jog_  
Chief Technology Officer,  
_Clogeny Technologies_ | [http://clogeny.com](http://clogeny.com)  
(M) 0091-9766619440 | Skype: chirag.jog

On Sun, Mar 3, 2013 at 2:08 PM, Angus Buchanan  
[angus.o.buchanan@gmail.com](mailto:angus.o.buchanan@gmail.com)wrote:

> I'm familiar with the process of setting up WinRM to allow bootstrapping  
> of machines with knife.
> 
> However, I'd like to be able to bootstrap machines without having to first  
> log onto the machine and configure WinRM. That seems kinda pointless - if  
> I'm going to have to log onto the machine to set up a WinRM listener, I  
> might as well just install Chef while I'm at it. It also doesn't scale at  
> all...
> 
> I'm operating mostly in a cloudy world - combination of Rackspace and EC2.  
> I'm considering using user data on EC2 to run the WinRM setup stuff... I  
> assume Rackspace has an equivalent mechanism.
> 
> Is this pretty much the way to go? What I'd love would be the ability to  
> run a script using my RDP credentials, but so far I've not seen a way to do  
> this.
> 
> Am I missing a trick? I'd really love to be able to run a script which  
> basically connects to the newly created cloud machine, and runs the winrm  
> stuff to set up the ability to run knife over it. Pipe dream?
> 
> Thanks!
> 
> -aob

---

<div class="post-metadata">

**Author:** ![Angus\_Buchanan](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@Angus\_Buchanan](https://discourse.chef.io/u/Angus_Buchanan)\
**Post date:** [March 3, 2013, 6:47pm UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779/4 "2013-03-03T18:47:20Z")

</div>

Thanks Chirag,

That's pretty much the direction I had started down. However I haven't yet  
worked out what happens with the Administrator password. If I launch a  
machine via the EC2 management console, there's a little dance I have to do  
to get the password for the Administrator, by providing my half of a key.

When I launch a machine with knife, I don't see where this comes in.  
Indeed knife ec2 requires the ssh key ID, but then waits for sshd (which  
of course never comes).

How to you automate the obtaining of the Admin credentials? Do you just  
pass in a run list which creates a known user?

$ knife ec2 server create -f t1.micro --user-data src/chef/enableWinRM.  
ps1 -I ami-d6929fa2 -Z eu-west-1a -S aob  
Instance ID: i-c048df8a  
Flavor: t1.micro  
Image: ami-d6929fa2  
Region: eu-west-1  
Availability Zone: eu-west-1a  
Security Groups: default  
Tags: {"Name"=\>"i-c048df8a"}  
SSH Key: aob

Waiting for server...................  
Public DNS Name: [ec2-46-137-43-193.eu-west-1.compute.amazonaws.com](http://ec2-46-137-43-193.eu-west-1.compute.amazonaws.com)  
Public IP Address: 46.137.43.193  
Private DNS Name: ip-10-227-21-126.eu-west-1.compute.internal  
Private IP Address: 10.227.21.126

Waiting for sshd...........................................

Thanks!

-aob

On Sun, Mar 3, 2013 at 9:39 AM, Chirag Jog [chirag@clogeny.com](mailto:chirag@clogeny.com) wrote:

> Hello Angus,
> 
> On EC2 (and other clouds that support userdata), we can pass a  
> Powershell/Batch script that sets things up for us on a Standard Win 2k8  
> Image.
> 
> Here is the script:
> 
> winrm quickconfig -q winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="300"}' winrm set winrm/config '@{MaxTimeoutms="1800000"}' winrm set winrm/config/service '@{AllowUnencrypted="true"}' winrm set winrm/config/service/auth '@{Basic="true"}'
> 
> This should setup winrm for you pre-bootstrapping.
> 
> And here is the ec2 command:  
> knife ec2 server create ..... --user-data enableWinRM.ps1...
> 
> Let me know if this helps!
> 
> Regards\*,\*  
> _Chirag Jog_  
> Chief Technology Officer,  
> _Clogeny Technologies_ | [http://clogeny.com](http://clogeny.com)  
> (M) 0091-9766619440 | Skype: chirag.jog
> 
> On Sun, Mar 3, 2013 at 2:08 PM, Angus Buchanan \<[angus.o.buchanan@gmail.com](mailto:angus.o.buchanan@gmail.com)
> 
> > wrote:
> 
> > I'm familiar with the process of setting up WinRM to allow bootstrapping  
> > of machines with knife.
> > 
> > However, I'd like to be able to bootstrap machines without having to  
> > first log onto the machine and configure WinRM. That seems kinda pointless
> > 
> > - if I'm going to have to log onto the machine to set up a WinRM listener,  
> > I might as well just install Chef while I'm at it. It also doesn't scale  
> > at all...
> > 
> > I'm operating mostly in a cloudy world - combination of Rackspace and  
> > EC2. I'm considering using user data on EC2 to run the WinRM setup  
> > stuff... I assume Rackspace has an equivalent mechanism.
> > 
> > Is this pretty much the way to go? What I'd love would be the ability to  
> > run a script using my RDP credentials, but so far I've not seen a way to do  
> > this.
> > 
> > Am I missing a trick? I'd really love to be able to run a script which  
> > basically connects to the newly created cloud machine, and runs the winrm  
> > stuff to set up the ability to run knife over it. Pipe dream?
> > 
> > Thanks!
> > 
> > -aob

---

<div class="post-metadata">

**Author:** ![Chirag\_Jog](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/chirag_jog/32/450_2.png) [@Chirag\_Jog](https://discourse.chef.io/u/Chirag_Jog)\
**Post date:** [March 3, 2013, 6:53pm UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779/5 "2013-03-03T18:53:25Z")

</div>

Hi Angus,  
Yes - thats a bit of a pain. I had gone ahead and added support in the  
knife plugin to fetch the windows password - that code hasn't been merged  
yet(its part of a larger feature-set) - but here is the patch for the same  
you can use:

> <https://github.com/chirag-jog/knife-ec2/commit/bd4d7dea6554b1a2d2f75782f2da64a4b54588e4>
>
> If Kerberos use Private IP Address

Regards\*,\*  
_Chirag Jog_  
Chief Technology Officer,  
_Clogeny Technologies_ | [http://clogeny.com](http://clogeny.com)  
(M) 0091-9766619440 | Skype: chirag.jog

On Mon, Mar 4, 2013 at 12:17 AM, Angus Buchanan  
[angus.o.buchanan@gmail.com](mailto:angus.o.buchanan@gmail.com)wrote:

> Thanks Chirag,
> 
> That's pretty much the direction I had started down. However I haven't  
> yet worked out what happens with the Administrator password. If I launch a  
> machine via the EC2 management console, there's a little dance I have to do  
> to get the password for the Administrator, by providing my half of a key.
> 
> When I launch a machine with knife, I don't see where this comes in.  
> Indeed knife ec2 requires the ssh key ID, but then waits for sshd (which  
> of course never comes).
> 
> How to you automate the obtaining of the Admin credentials? Do you just  
> pass in a run list which creates a known user?
> 
> $ knife ec2 server create -f t1.micro --user-data src/chef/enableWinRM.  
> ps1 -I ami-d6929fa2 -Z eu-west-1a -S aob  
> Instance ID: i-c048df8a  
> Flavor: t1.micro  
> Image: ami-d6929fa2  
> Region: eu-west-1  
> Availability Zone: eu-west-1a  
> Security Groups: default  
> Tags: {"Name"=\>"i-c048df8a"}  
> SSH Key: aob
> 
> Waiting for server...................  
> Public DNS Name: [ec2-46-137-43-193.eu-west-1.compute.amazonaws.com](http://ec2-46-137-43-193.eu-west-1.compute.amazonaws.com)  
> Public IP Address: 46.137.43.193  
> Private DNS Name: ip-10-227-21-126.eu-west-1.compute.internal  
> Private IP Address: 10.227.21.126
> 
> Waiting for sshd...........................................
> 
> Thanks!
> 
> -aob
> 
> On Sun, Mar 3, 2013 at 9:39 AM, Chirag Jog [chirag@clogeny.com](mailto:chirag@clogeny.com) wrote:
> 
> > Hello Angus,
> > 
> > On EC2 (and other clouds that support userdata), we can pass a  
> > Powershell/Batch script that sets things up for us on a Standard Win 2k8  
> > Image.
> > 
> > Here is the script:
> > 
> > winrm quickconfig -q winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="300"}' winrm set winrm/config '@{MaxTimeoutms="1800000"}' winrm set winrm/config/service '@{AllowUnencrypted="true"}' winrm set winrm/config/service/auth '@{Basic="true"}'
> > 
> > This should setup winrm for you pre-bootstrapping.
> > 
> > And here is the ec2 command:  
> > knife ec2 server create ..... --user-data enableWinRM.ps1...
> > 
> > Let me know if this helps!
> > 
> > Regards\*,\*  
> > _Chirag Jog_  
> > Chief Technology Officer,  
> > _Clogeny Technologies_ | [http://clogeny.com](http://clogeny.com)  
> > (M) 0091-9766619440 | Skype: chirag.jog
> > 
> > On Sun, Mar 3, 2013 at 2:08 PM, Angus Buchanan \<  
> > [angus.o.buchanan@gmail.com](mailto:angus.o.buchanan@gmail.com)\> wrote:
> > 
> > > I'm familiar with the process of setting up WinRM to allow bootstrapping  
> > > of machines with knife.
> > > 
> > > However, I'd like to be able to bootstrap machines without having to  
> > > first log onto the machine and configure WinRM. That seems kinda pointless
> > > 
> > > - if I'm going to have to log onto the machine to set up a WinRM listener,  
> > > I might as well just install Chef while I'm at it. It also doesn't scale  
> > > at all...
> > > 
> > > I'm operating mostly in a cloudy world - combination of Rackspace and  
> > > EC2. I'm considering using user data on EC2 to run the WinRM setup  
> > > stuff... I assume Rackspace has an equivalent mechanism.
> > > 
> > > Is this pretty much the way to go? What I'd love would be the ability  
> > > to run a script using my RDP credentials, but so far I've not seen a way to  
> > > do this.
> > > 
> > > Am I missing a trick? I'd really love to be able to run a script which  
> > > basically connects to the newly created cloud machine, and runs the winrm  
> > > stuff to set up the ability to run knife over it. Pipe dream?
> > > 
> > > Thanks!
> > > 
> > > -aob

---

<div class="post-metadata">

**Author:** ![Stephen\_Nelson\_Smith](https://avatars.discourse-cdn.com/v4/letter/s/eada6e/32.png) [@Stephen\_Nelson\_Smith](https://discourse.chef.io/u/Stephen_Nelson_Smith)\
**Post date:** [March 3, 2013, 7:58pm UTC](https://discourse.chef.io/t/winrm-chicken-egg/3779/6 "2013-03-03T19:58:46Z")

</div>

Hi Chriag,

On 3 March 2013 18:53, Chirag Jog [chirag@clogeny.com](mailto:chirag@clogeny.com) wrote:

> I had gone ahead and added support in the knife  
> plugin to fetch the windows password - that code hasn't been merged yet(its  
> part of a larger feature-set) - but here is the patch for the same you can  
> use:
> 
> [Wait for Windows password to be available · chirag-jog/knife-ec2@bd4d7de · GitHub](https://github.com/chirag-jog/knife-ec2/commit/bd4d7dea6554b1a2d2f75782f2da64a4b54588e4)

That's pretty awesome stuff. Looking at the rest of your fork, how  
much of this works? I'm actually about to spin up a bunch of EC2  
Windows machines for a training course... being able to combine the  
winrm bootstrap and the getting the admin password in one command  
would be amazing.

Just for a try I cloned your repo and bundled it up and ran a bundle  
exec knife ec2 server create... I got:

Waiting for sshd  
ERROR: ArgumentError: wrong number of arguments (1 for 2)

Before I dive in... should I expect this to just work, or is this in a  
state of flux?

## S.

Stephen Nelson-Smith,  
Founder, Principal Consultant,  
Atalanta Systems Ltd,  
Web: [http://agilesysadmin.net](http://agilesysadmin.net)  
Twitter: @lordcope  
Skype: atalanta.systems  
Direct: +44 (0) 1329 550203  
Mobile: +44 (0) 7917 101919

Atalanta Systems: The Agile Infrastructure Enablers  
[http://atalanta-systems.com](http://atalanta-systems.com)