Must supply an 'elevated_user' if 'elevated_password' provid

Error message

Must supply an 'elevated_user' if 'elevated_password' provided

What it means

Running scripts elevated (as Administrator) requires an account, so elevated_password alone is meaningless — the provisioner cannot know which user to elevate as. Prepare rejects a config where elevated_user is empty but elevated_password is set. It is a fail-fast credential-pairing validation.

Source

Thrown at provisioner/powershell/provisioner.go:231

	if p.config.Scripts == nil {
		p.config.Scripts = make([]string, 0)
	}

	if p.config.Vars == nil {
		p.config.Vars = make([]string, 0)
	}

	p.config.remoteCleanUpScriptPath = fmt.Sprintf(`c:/Windows/Temp/packer-cleanup-%s.ps1`, uuid.TimeOrderedUUID())

	var errs error
	if p.config.Script != "" && len(p.config.Scripts) > 0 {
		errs = packersdk.MultiErrorAppend(errs,
			errors.New("Only one of script or scripts can be specified."))
	}

	if p.config.ElevatedUser == "" && p.config.ElevatedPassword != "" {
		errs = packersdk.MultiErrorAppend(errs,
			errors.New("Must supply an 'elevated_user' if 'elevated_password' provided"))
	}

	if p.config.Script != "" {
		p.config.Scripts = []string{p.config.Script}
	}

	if len(p.config.Scripts) == 0 && p.config.Inline == nil {
		errs = packersdk.MultiErrorAppend(errs,
			errors.New("Either a script file or inline script must be specified."))
	} else if len(p.config.Scripts) > 0 && p.config.Inline != nil {
		errs = packersdk.MultiErrorAppend(errs,
			errors.New("Only a script file or an inline script can be specified, not both."))
	}

	if p.config.ExecuteCommand == "" {
		if p.config.Inline != nil && len(p.config.Scripts) == 0 {
			p.config.ExecuteCommand = p.defaultExecuteCommand()
			log.Printf("Using inline default execute command %s", p.config.ExecuteCommand)

View on GitHub (pinned to eb36e3c3e4)

Solutions

Add elevated_user to the provisioner block alongside elevated_password.
If elevation is not needed, remove elevated_password entirely.
If elevated_user comes from a variable, give the variable a non-empty value/default.

Example fix

// before
provisioner "powershell" {
  scripts            = ["./setup.ps1"]
  elevated_password  = var.admin_password
}

// after
provisioner "powershell" {
  scripts           = ["./setup.ps1"]
  elevated_user     = "Administrator"
  elevated_password = var.admin_password
}

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the elevated_user/elevated_password pair is complete:
assert {
  condition     = var.elevated_password == "" || var.elevated_user != ""
  error_message = "elevated_user must be set when elevated_password is provided."
}

Prevention

Treat elevated_user and elevated_password as an atomic pair — always set or always omit both.
Check variable values resolve non-empty for every build target.
Run packer validate before building.

When it happens

Trigger: A powershell provisioner block with elevated_password = "..." set but elevated_user omitted or interpolating to an empty string.

Common situations: elevated_user sourced from a variable that resolves empty at build time; copying an example that only set elevated_password; secret-management templating that supplies the password but not the username.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/7ac1df97fe77fa3e. Report an issue: GitHub.