Chef: dsc_resource bails with PowershellCmdletException on Windows host with non standard winrm port

[Sauraus]

Cookbook version
All

Chef-client version
Chef 12.x & 13.x

Platform Details
Windows

Scenario:
dsc_resource cannot operate on a system that's running winrm on a non standard port.

Steps to Reproduce:
Create a Windows systems, follow all the steps to configure winrm such that you can bootstrap the node. Now change the port on which winrm listens on the host to be something else than 5985, try to run chef-client on the node now. When the convergence hits a dsc_resource the client run will bail with the error below.

Expected Result:
dsc_resource executes properly irrespective of the port on which winrm is listening.

Actual Result:
Chef::Exceptions::PowershellCmdletException
Powershell Cmdlet failed: The client cannot connect to the destination specified in the request. Verify that the service on the destination is
running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the
destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the
destination to analyze and configure the WinRM service: "winrm quickconfig".

• CategoryInfo : ConnectionError: (root/Microsoft/...gurationManager:String) [], CimException
• FullyQualifiedErrorId : HRESULT 0x80338012
• PSComputerName : localhost

[NAshwini]

Hi @Sauraus,
I configure the WinRm service to listen on port 8888 other than default port i.e port 5985.
and was able to reproduce the issue by a recipe with DSC resource as:

dsc_resource 'dsc_test_eg' do
   resource :archive
   property :ensure, 'Present'
   property :path, 'D:\dsc_test.zip'
   property :destination, 'D:\Ashwini'
end

This recipe internally run power-shell command as:
Invoke-DscResource -Method test -Name archive -Property @{ensure='Present';path='D:\\dsc_test.zip';destination='D:\\Ashwini'} -Module PSDesiredStateConfiguration -Verbose

If we want to run any DscResource command without any connection error we need to configure WinRm perfectly with any below approach:

1. To configure WinRM with default port setting by three methods as: https://blogs.msdn.microsoft.com/wmi/2009/03/17/three-ways-to-configure-winrm-listeners/

1. If we want to set port other than default port 5985 for eg port 8888:
   i. Need to add specific port to winrm/config/Listener
   By command winrm set winrm/config/Listener?Address=*+Transport=HTTP '@{Port="8888"}'
   ii. Then set that particular port as a default port
   By command winrm set winrm/config/Client/DefaultPorts @{HTTP="8888"}
   iii. Open this port by adding inbound rule in firewall setting.

2. I have tried to find other alternatives by not setting port 8888 as the default port. But haven't got any solution. I was trying to add GPO by gpmc.msc or with gpedit.msc to set allow automatic configuration of listeners which can able to listen to ports other than default but found that it is been suppressed & replaced by feature Allow remote server management through WinRM.
   can be referred by :
   https://social.technet.microsoft.com/Forums/office/en-US/e4aa3b95-608f-46c3-af06-06f57b02b455/why-dont-i-have-the-allow-automatic-configuration-of-listeners-group-policy-option-for-winrm?forum=winserverGP

Server Manager relies on default WinRM listener settings & without that winrm service does not run properly can be seen from the post: Windows remote Management (WinRM) listener settings (https://docs.microsoft.com/en-us/windows-server/administration/server-manager/configure-remote-management-in-server-manager)

Please let us know in case of any query.
Thank you.

[Sauraus]

winrm set winrm/config/Client/DefaultPorts @{HTTP="8888"} this is the option that I was missing thanks.

PS. winrm set winrm/config/Listener?Address=*+Transport=HTTP '@{Port="8888"}' you need to remove the ' else you get an error like this call winrm set winrm/config/Listener?Address=*+Transport=HTTP '@{Port="17777"}' Error: Invalid use of command line. Type "winrm -?" for help.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.