{"record":{"id":"3eca4a68fa1fb05c","repo":"hashicorp/packer","slug":"failed-to-generate-elevated-runner-s","errorCode":null,"errorMessage":"failed to generate elevated runner: %s","messagePattern":"failed to generate elevated runner: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":722,"sourceCode":"\t// sbom-generate subcommand and invoked the scanner binary directly.\n\tnormalizedExecuteCommand := normalizeScannerExecuteCommand(executeCommand)\n\tif normalizedExecuteCommand != executeCommand {\n\t\tlog.Printf(\"[INFO] execute_command compatibility: injected 'sbom-generate' subcommand\")\n\t\texecuteCommand = normalizedExecuteCommand\n\t}\n\n\t// Render the execute command template\n\tcmdStr, err := interpolate.Render(executeCommand, &renderCtx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to render execute_command: %s\", err)\n\t}\n\n\t// For Windows with elevated user, wrap command with elevated runner\n\tif isWindows && p.config.ElevatedUser != \"\" {\n\t\tlog.Printf(\"Using elevated user '%s' for scanner execution\", p.config.ElevatedUser)\n\t\televatedCmd, err := guestexec.GenerateElevatedRunner(cmdStr, p)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to generate elevated runner: %s\", err)\n\t\t}\n\t\tcmdStr = elevatedCmd\n\t}\n\n\tlog.Printf(\"Executing: %s\", cmdStr)\n\n\t// Execute scanner\n\tvar stdout, stderr bytes.Buffer\n\tcmd := &packersdk.RemoteCmd{\n\t\tCommand: cmdStr,\n\t\tStdout:  &stdout,\n\t\tStderr:  &stderr,\n\t}\n\n\tif err := comm.Start(ctx, cmd); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to start scanner: %s\", err)\n\t}\n","sourceCodeStart":704,"sourceCodeEnd":740,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L704-L740","documentation":"Returned by runScanner (provisioner/hcp-sbom/provisioner.go:722) when guestexec.GenerateElevatedRunner fails to build the Windows elevated-command wrapper for the rendered scanner command. This path only runs on Windows guests when elevated_user is set; the wrapper script embeds the command and credentials for a run-as execution.","triggerScenarios":"Configuring elevated_user (and elevated_password) in the hcp-sbom provisioner on a Windows build when GenerateElevatedRunner cannot produce the runner script — typically a template/render failure inside the elevated-runner generation or invalid characters/state in the command string it must embed.","commonSituations":"Setting elevated_user on non-Windows-looking commands; special characters in execute_command that break the generated PowerShell/XML escaping; missing or malformed elevated_password causing the runner template render to fail; using this option with a communicator that lacks WinRM elevated-run support.","solutions":["Read the wrapped inner error from the message; it names the exact elevated-runner generation failure.","If elevation is not required, remove elevated_user/elevated_password so the plain command runs instead.","Simplify execute_command: remove characters that need heavy escaping (quotes, $, backticks) and place complex logic into a script executed by the scanner.","Verify elevated_password is set and valid when elevated_user is configured; use environment variables or a vault rather than inline secrets.","Confirm you are on a Windows guest with a communicator (WinRM/SSH) that supports elevated execution."],"exampleFix":"// before: no password supplied for elevated user\nelevated_user = \"Administrator\"\n// after: provide the password so the elevated runner can be generated\nelevated_user = \"Administrator\"\nelevated_password = \"${var.winrm_password}\"","handlingStrategy":"try-catch","validationCode":"// Only request elevation when both fields are set and guest is Windows\nif cfg.ElevatedUser != \"\" && cfg.ElevatedPassword == \"\" { /* fail fast: missing password */ }","typeGuard":null,"tryCatchPattern":"elevatedCmd, err := guestexec.GenerateElevatedRunner(cmdStr, p)\nif err != nil {\n    return \"\", fmt.Errorf(\"failed to generate elevated runner: %w\", err)\n}","preventionTips":["Set elevated_password whenever elevated_user is set.","Keep execute_command free of characters needing heavy PowerShell escaping.","Only use elevation on Windows guests with a supporting communicator.","Skip elevated_user when the scanner does not actually need admin rights."],"tags":["packer","windows","provisioner","elevated"],"backgroundTag":"elevated-runner-generation-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}