hashicorp/terraform · error

Using the C:\Windows\Temp folder is not supported. Please us

Error message

Using the C:\Windows\Temp folder is not supported. Please use a different 'script_path'.

What it means

Raised by the WinRM communicator's parseConnectionInfo when the connection block's script_path normalizes under C:\Windows\Temp. Terraform copies the remote-exec script to script_path on the Windows target before executing it; files placed in the system temp folder are cleaned early during boot and can be deleted before the script runs, causing flaky provisioning. The check (line 113) is a hard block, not a warning.

Source

Thrown at internal/communicator/winrm/provisioner.go:114

// a ConnectionInfo struct
func parseConnectionInfo(v cty.Value) (*connectionInfo, error) {
	v, err := shared.ConnectionBlockSupersetSchema.CoerceValue(v)
	if err != nil {
		return nil, err
	}

	connInfo, err := decodeConnInfo(v)
	if err != nil {
		return nil, err
	}
	// Check on script paths which point to the default Windows TEMP folder because files
	// which are put in there very early in the boot process could get cleaned/deleted
	// before you had the change to execute them.
	//
	// TODO (SvH) Needs some more debugging to fully understand the exact sequence of events
	// causing this...
	if strings.HasPrefix(filepath.ToSlash(connInfo.ScriptPath), "C:/Windows/Temp") {
		return nil, fmt.Errorf(
			`Using the C:\Windows\Temp folder is not supported. Please use a different 'script_path'.`)
	}

	if connInfo.User == "" {
		connInfo.User = DefaultUser
	}

	// Format the host if needed.
	// Needed for IPv6 support.
	connInfo.Host = shared.IpFormat(connInfo.Host)

	if connInfo.Port == 0 {
		if connInfo.HTTPS {
			connInfo.Port = DefaultHTTPSPort
		} else {
			connInfo.Port = DefaultPort
		}
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Point script_path at a stable folder that survives boot, e.g. C:\Temp or the user profile: `script_path = "C:\\Temp\\terraform_%RAND%.cmd"` (the WinRM DefaultScriptPath).
2. Omit script_path entirely and let Terraform use DefaultScriptPath (C:/Temp/terraform_%RAND%.cmd).
3. Ensure the target folder exists and the WinRM user has write+execute permissions on it.

Example fix

// before
connection {
  type        = "winrm"
  script_path = "C:\\Windows\\Temp\\tf.cmd"
}

// after
connection {
  type        = "winrm"
  script_path = "C:\\Temp\\terraform_%RAND%.cmd"
}

// Reject the blocked Windows temp path before applying a winrm connection block.
path := filepath.ToSlash(strings.ToLower(connInfo.ScriptPath))
if strings.HasPrefix(path, "c:/windows/temp") {
    return errors.New("script_path must not be under C:\\Windows\\Temp; use C:\\Temp")
}

When it happens

Trigger: A `connection { type="winrm" script_path = "C:\\Windows\\Temp\\..." }` (any casing or separator style that ToSlash-normalizes to the `C:/Windows/Temp` prefix). Also when reusing a script_path default across OS targets without adapting it for WinRM.

Common situations: Sharing one script_path variable between ssh and winrm blocks, defaulting to the system temp folder out of habit, CI images whose TMP points at C:\Windows\Temp and the operator hardcodes that path.

Related errors

• connection type '%s' not supported
• Failed to parse ssh private key: %s
• Cannot set both 'source' and 'content'
• Must provide one of 'source' or 'content'
• source and content cannot both be null

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a45a6d2ccfecd330. Report an issue: GitHub.