{"record":{"id":"7ac1df97fe77fa3e","repo":"hashicorp/packer","slug":"must-supply-an-elevated-user-if-elevated-passwo","errorCode":null,"errorMessage":"Must supply an 'elevated_user' if 'elevated_password' provided","messagePattern":"Must supply an 'elevated_user' if 'elevated_password' provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/powershell/provisioner.go","lineNumber":231,"sourceCode":"\tif p.config.Scripts == nil {\n\t\tp.config.Scripts = make([]string, 0)\n\t}\n\n\tif p.config.Vars == nil {\n\t\tp.config.Vars = make([]string, 0)\n\t}\n\n\tp.config.remoteCleanUpScriptPath = fmt.Sprintf(`c:/Windows/Temp/packer-cleanup-%s.ps1`, uuid.TimeOrderedUUID())\n\n\tvar errs error\n\tif p.config.Script != \"\" && len(p.config.Scripts) > 0 {\n\t\terrs = packersdk.MultiErrorAppend(errs,\n\t\t\terrors.New(\"Only one of script or scripts can be specified.\"))\n\t}\n\n\tif p.config.ElevatedUser == \"\" && p.config.ElevatedPassword != \"\" {\n\t\terrs = packersdk.MultiErrorAppend(errs,\n\t\t\terrors.New(\"Must supply an 'elevated_user' if 'elevated_password' provided\"))\n\t}\n\n\tif p.config.Script != \"\" {\n\t\tp.config.Scripts = []string{p.config.Script}\n\t}\n\n\tif len(p.config.Scripts) == 0 && p.config.Inline == nil {\n\t\terrs = packersdk.MultiErrorAppend(errs,\n\t\t\terrors.New(\"Either a script file or inline script must be specified.\"))\n\t} else if len(p.config.Scripts) > 0 && p.config.Inline != nil {\n\t\terrs = packersdk.MultiErrorAppend(errs,\n\t\t\terrors.New(\"Only a script file or an inline script can be specified, not both.\"))\n\t}\n\n\tif p.config.ExecuteCommand == \"\" {\n\t\tif p.config.Inline != nil && len(p.config.Scripts) == 0 {\n\t\t\tp.config.ExecuteCommand = p.defaultExecuteCommand()\n\t\t\tlog.Printf(\"Using inline default execute command %s\", p.config.ExecuteCommand)","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/powershell/provisioner.go#L213-L249","documentation":"Running scripts elevated (as Administrator) requires an account, so elevated_password alone is meaningless — the provisioner cannot know which user to elevate as. Prepare rejects a config where elevated_user is empty but elevated_password is set. It is a fail-fast credential-pairing validation.","triggerScenarios":"A powershell provisioner block with elevated_password = \"...\" set but elevated_user omitted or interpolating to an empty string.","commonSituations":"elevated_user sourced from a variable that resolves empty at build time; copying an example that only set elevated_password; secret-management templating that supplies the password but not the username.","solutions":["Add elevated_user to the provisioner block alongside elevated_password.","If elevation is not needed, remove elevated_password entirely.","If elevated_user comes from a variable, give the variable a non-empty value/default."],"exampleFix":"// before\nprovisioner \"powershell\" {\n  scripts            = [\"./setup.ps1\"]\n  elevated_password  = var.admin_password\n}\n\n// after\nprovisioner \"powershell\" {\n  scripts           = [\"./setup.ps1\"]\n  elevated_user     = \"Administrator\"\n  elevated_password = var.admin_password\n}","handlingStrategy":"validation","validationCode":"// Ensure the elevated_user/elevated_password pair is complete:\nassert {\n  condition     = var.elevated_password == \"\" || var.elevated_user != \"\"\n  error_message = \"elevated_user must be set when elevated_password is provided.\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat elevated_user and elevated_password as an atomic pair — always set or always omit both.","Check variable values resolve non-empty for every build target.","Run packer validate before building."],"tags":["packer","provisioner","powershell","config-validation"],"backgroundTag":"missing-required-argument","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}