What causes "failed to generate elevated runner: %s" in hashicorp/packer?

Read the wrapped inner error from the message; it names the exact elevated-runner generation failure.

failed to generate elevated runner: %s

Error message

failed to generate elevated runner: %s

What it means

Returned by runScanner (provisioner/hcp-sbom/provisioner.go:722) when guestexec.GenerateElevatedRunner fails to build the Windows elevated-command wrapper for the rendered scanner command. This path only runs on Windows guests when elevated_user is set; the wrapper script embeds the command and credentials for a run-as execution.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:722

	// sbom-generate subcommand and invoked the scanner binary directly.
	normalizedExecuteCommand := normalizeScannerExecuteCommand(executeCommand)
	if normalizedExecuteCommand != executeCommand {
		log.Printf("[INFO] execute_command compatibility: injected 'sbom-generate' subcommand")
		executeCommand = normalizedExecuteCommand
	}

	// Render the execute command template
	cmdStr, err := interpolate.Render(executeCommand, &renderCtx)
	if err != nil {
		return "", fmt.Errorf("failed to render execute_command: %s", err)
	}

	// For Windows with elevated user, wrap command with elevated runner
	if isWindows && p.config.ElevatedUser != "" {
		log.Printf("Using elevated user '%s' for scanner execution", p.config.ElevatedUser)
		elevatedCmd, err := guestexec.GenerateElevatedRunner(cmdStr, p)
		if err != nil {
			return "", fmt.Errorf("failed to generate elevated runner: %s", err)
		}
		cmdStr = elevatedCmd
	}

	log.Printf("Executing: %s", cmdStr)

	// Execute scanner
	var stdout, stderr bytes.Buffer
	cmd := &packersdk.RemoteCmd{
		Command: cmdStr,
		Stdout:  &stdout,
		Stderr:  &stderr,
	}

	if err := comm.Start(ctx, cmd); err != nil {
		return "", fmt.Errorf("failed to start scanner: %s", err)
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Read the wrapped inner error from the message; it names the exact elevated-runner generation failure.
If elevation is not required, remove elevated_user/elevated_password so the plain command runs instead.
Simplify execute_command: remove characters that need heavy escaping (quotes, $, backticks) and place complex logic into a script executed by the scanner.
Verify elevated_password is set and valid when elevated_user is configured; use environment variables or a vault rather than inline secrets.
Confirm you are on a Windows guest with a communicator (WinRM/SSH) that supports elevated execution.

Example fix

// before: no password supplied for elevated user
elevated_user = "Administrator"
// after: provide the password so the elevated runner can be generated
elevated_user = "Administrator"
elevated_password = "${var.winrm_password}"

Defensive patterns

Strategy: try-catch

Validate before calling

// Only request elevation when both fields are set and guest is Windows
if cfg.ElevatedUser != "" && cfg.ElevatedPassword == "" { /* fail fast: missing password */ }

Try / catch

elevatedCmd, err := guestexec.GenerateElevatedRunner(cmdStr, p)
if err != nil {
    return "", fmt.Errorf("failed to generate elevated runner: %w", err)
}

Prevention

Set elevated_password whenever elevated_user is set.
Keep execute_command free of characters needing heavy PowerShell escaping.
Only use elevation on Windows guests with a supporting communicator.
Skip elevated_user when the scanner does not actually need admin rights.

When it happens

Trigger: Configuring elevated_user (and elevated_password) in the hcp-sbom provisioner on a Windows build when GenerateElevatedRunner cannot produce the runner script — typically a template/render failure inside the elevated-runner generation or invalid characters/state in the command string it must embed.

Common situations: Setting elevated_user on non-Windows-looking commands; special characters in execute_command that break the generated PowerShell/XML escaping; missing or malformed elevated_password causing the runner template render to fail; using this option with a communicator that lacks WinRM elevated-run support.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/3eca4a68fa1fb05c. Report an issue: GitHub.