hashicorp/packer · error

Error generating elevated runner: %s

Error message

Error generating elevated runner: %s

What it means

After successfully rendering the elevated command, createCommandTextPrivileged calls guestexec.GenerateElevatedRunner, which builds the PowerShell wrapper that runs the command as an elevated user (via a scheduled task on Windows). If that generation fails, the error wraps the cause and provisioning aborts. Generation depends on the provisioner implementing the guestexec task-name/password interfaces.

Source

Thrown at provisioner/powershell/provisioner.go:634

	// Prepare everything needed to enable the required env vars within the
	// remote environment
	err = p.prepareEnvVars(true)
	if err != nil {
		return "", err
	}
	ctxData := p.generatedData
	ctxData["Path"] = p.config.RemotePath
	ctxData["Vars"] = p.config.RemoteEnvVarPath
	p.config.ctx.Data = ctxData

	command, err = interpolate.Render(p.config.ElevatedExecuteCommand, &p.config.ctx)
	if err != nil {
		return "", fmt.Errorf("Error processing command: %s", err)
	}

	command, err = guestexec.GenerateElevatedRunner(command, p)
	if err != nil {
		return "", fmt.Errorf("Error generating elevated runner: %s", err)
	}

	return command, err
}

func (p *Provisioner) Communicator() packersdk.Communicator {
	return p.communicator
}

func (p *Provisioner) ElevatedUser() string {
	return p.config.ElevatedUser
}

func (p *Provisioner) ElevatedPassword() string {
	// Replace ElevatedPassword for winrm users who used this feature
	p.config.ctx.Data = p.generatedData
	elevatedPassword, _ := interpolate.Render(p.config.ElevatedPassword, &p.config.ctx)

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped cause; it names the specific generation step that failed.
2. If using elevated execution, ensure both elevated_user and elevated_password are correctly set (or rely on the auto-generated service account).
3. Verify the guest OS is Windows and supports the scheduled-task-based elevation mechanism.
4. Update the template to current Packer syntax; generated-data handling changed across versions.

Example fix

// before
"elevated_user": "Administrator"
// after (provide the paired password)
"elevated_user": "Administrator",
"elevated_password": "{{.WinRMPassword}}"

// ensure elevated execution config is complete
// HCL2:
// elevated_user = "Administrator"
// elevated_password = "{{.WinRMPassword}}"  # must be set when elevated_user is

When it happens

Trigger: GenerateElevatedRunner fails: it cannot build the elevated runner template, the elevated_user/elevated_password context is incomplete (e.g. elevated_password unset while elevated_user is set), or the provisioner fails to satisfy the required interface methods.

Common situations: Setting elevated_user without elevated_password (or vice versa) in the template; Windows guests where scheduled-task creation prerequisites are missing; older Packer versions with different generated-data keys after upgrading templates.

Related errors

• failed to generate elevated runner: %s
• Only one of script or scripts can be specified.
• Must supply an 'elevated_user' if 'elevated_password' provid
• Either a script file or inline script must be specified.
• Only a script file or an inline script can be specified, not

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e4862ccf7685ec91. Report an issue: GitHub.