Unable to Provision Windows 10 VMs Over Secure WinRM (5986)

[0xdeadbeefJERKY]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.13

• provider.azurerm: version = "~> 1.23"

Affected Resource(s)

• azurerm_virtual_machine
• azurerm_key_vault
• azurerm_key_vault_certificate
• local-exec provisioner (winrm)

Terraform Configuration Files

Code was directly copied from the example in this repository, substituting the credentials for my active Azure subscription credentials and modifying the storage_image_reference as follows:

  storage_image_reference {
    publisher = "MicrosoftWindowsDesktop"
    offer     = "Windows-10"
    sku       = "RS5-Pro"
    version   = "latest"
  }

Debug Output

Set both TF_LOG and TF_LOG_PATH, but the content is never written to the specified file. Will update once this is resolved.

Panic Output

N/A

Expected Behavior

Terraform deploys a Windows 10 (RS5 Pro) VM and "provisions" said VM by running cd C:\Windows and subsequently execute dir using the secure WinRM provider (over HTTPS using port 5986). This is facilitated by automatically generating a Key Vault and self-signed certificate.

Actual Behavior

The VM is created, but the provisioning process hangs and ultimately times out, resulting in the following error:

azurerm_virtual_machine.example (remote-exec): Connecting to remote host via WinRM...
azurerm_virtual_machine.example (remote-exec):   Host: 40.117.156.102
azurerm_virtual_machine.example (remote-exec):   Port: 5986
azurerm_virtual_machine.example (remote-exec):   User: testadmin
azurerm_virtual_machine.example (remote-exec):   Password: true
azurerm_virtual_machine.example (remote-exec):   HTTPS: true
azurerm_virtual_machine.example (remote-exec):   Insecure: true
azurerm_virtual_machine.example (remote-exec):   NTLM: false
azurerm_virtual_machine.example (remote-exec):   CACert: false
azurerm_virtual_machine.example: Still creating... (18m11s elapsed)

Error: Error applying plan:

1 error(s) occurred:

* azurerm_virtual_machine.example: timeout - last error: unknown error Post https://40.117.156.102:5986/wsman: dial tcp 40.117.156.102:5986: connect: connection refused

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

Steps to Reproduce

1. Clone aforementioned repository containing this example
2. Substitute storage_image_reference block with Windows 10 values, for example:

storage_image_reference {
    publisher = "MicrosoftWindowsDesktop"
    offer     = "Windows-10"
    sku       = "RS5-Pro"
    version   = "latest"
  }

3. terraform init
4. terraform apply

Important Factoids

N/A

References

• WINRM provisioner doesn't work on Azure #2436
• Intended method of configuring an Azure VM for WinRM? #27

[grayzu]

Does this work for you with the example as is? In other words, does it work when you use a Windows Server SKU but does not work when you use a Windows client SKU?

[0xdeadbeefJERKY]

Yes, as I mentioned in my notes, the example works just fine using Windows Server, but fails using Windows Desktop (Windows 10, in this case).

[grayzu]

Does it work if you configure the Windows 10 image manually (without Terraform)? The reason that I ask is that I know there are some difference in how server and client work with WinRM so want to determine if this is an issue with the TF configuration or something else.

[0xdeadbeefJERKY]

@grayzu I'm not able to test this manually using my personal account, as it seems the Windows 10 VMs are only available for use if you or your company is contracted under a volume licensing agreement (which I am not). From what I know about enabling WinRM on Windows desktops (e.g., Windows 10), the process is the same as the one used in the aforementioned example (populate the unattended installation files and ultimately call winrm to configure), so I don't think this is the issue. However, I don't have intimate knowledge of how the Windows 10 VMs in Azure are initialized, etc. Thanks again for looking into this!

[tombuildsstuff]

@0xdeadbeefJERKY as @grayzu has mentioned I believe the defaults for WinRM on a Client and a Server are different; out of interest if you provision a Windows Client VM, remote in and run winrm /quickconfig manually - are you able to connect using the following null resource?

resource "null_resource" "test" {
  provisioner "remote-exec" {
    connection {
      host     = "IP or FQDN of the machine"
      user     = "someusername"
      password = "ThisIsDog2029"
      timeout  = "3m"
      type     = "winrm"
      https    = true
      port     = 5986
      use_ntlm = true
      insecure = true
    }
  }
}

In addition, it'd be good to confirm if ports 5985 and 5986 are open in the Windows Firewall, which may also be another candidate here?

Thanks!

[akingscote]

@tomasaschan
Dosent look like those WinRM settings work with the Win10 image im trying:

 storage_image_reference {
    publisher = "MicrosoftWindowsDesktop"
    offer     = "Windows-10"
    sku       = "rs5-pro" # 1809 Pro
    version   = "latest"
  }

[tomasaschan]

@akingscote you want @tombuildsstuff :)

[tombuildsstuff]

👋

As @grayzu has mentioned the configuration for WinRM differs between Windows Client (Windows 10) and Windows Server - but on the host/image themselves rather than within Terraform.

Since this configuration is outside the scope of this forum, I'm going to close this issue for the moment - but I'm going to point you towards this example which includes an example of using sysprep to enable WinRM which I believe should assist you here.

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!