{"action":"opened","issue":{"url":"https://api.github.com/repos/chef/knife-windows/issues/176","labels_url":"https://api.github.com/repos/chef/knife-windows/issues/176/labels{/name}","comments_url":"https://api.github.com/repos/chef/knife-windows/issues/176/comments","events_url":"https://api.github.com/repos/chef/knife-windows/issues/176/events","html_url":"https://github.com/chef/knife-windows/issues/176","id":56960037,"number":176,"title":"knife winrm: Local account auth fails over SSL transport on systems joined to a domain","user":{"login":"adamedx","id":2422125,"avatar_url":"https://avatars.githubusercontent.com/u/2422125?v=3","gravatar_id":"","url":"https://api.github.com/users/adamedx","html_url":"https://github.com/adamedx","followers_url":"https://api.github.com/users/adamedx/followers","following_url":"https://api.github.com/users/adamedx/following{/other_user}","gists_url":"https://api.github.com/users/adamedx/gists{/gist_id}","starred_url":"https://api.github.com/users/adamedx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamedx/subscriptions","organizations_url":"https://api.github.com/users/adamedx/orgs","repos_url":"https://api.github.com/users/adamedx/repos","events_url":"https://api.github.com/users/adamedx/events{/privacy}","received_events_url":"https://api.github.com/users/adamedx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-08T17:46:33Z","updated_at":"2015-02-08T17:46:33Z","closed_at":null,"body":"If a system is joined to a domain, communication over an SSL listener on a remote system fails with a 401 error if credentials local to the remote system (i.e. non-domain credentials) are used, even when those credentials are part of the local administrators group and may be used to successfully communicate over ssl with the winrs tool in Windows or the Enter-PSSession command in PowerShell.\r\n\r\nHowever, if domain credentials are used for that same system, authentication succeeds and the commands are executed.\r\n\r\nHere's an example from master with verbose failure logging:\r\n`bundle exec knife winrm -f /Users/myuser/downloads/winrmcert.pem  -m mysystem.myorg.org -t ssl ipconfig -x 'administrator' -P 'xxxxx' -p 5986`\r\n\r\nWARNING: No knife configuration file found\r\n\r\nWARNING: --winrm-authentication-protocol option is not specified. Switching to Negotiate authentication\r\n\r\nDEBUG: Adding mysystem.myorg.com\r\n\r\nDEBUG: Trying WinRM communication with negotiate authentication and :ssl transport\r\n\r\nDEBUG: WinRM::WinRMWebService options: {:user=>\"administrator\", :pass=>\"xxxxxxx\", :basic_auth_only=>false, :disable_sspi=>true, :no_ssl_peer_verification=>false, :ca_trust_path=>\"/Users/myuser/downloads/winrmcert.pem\"}\r\n\r\nDEBUG: Endpoint: https://mysystem.myorg.com:5986/wsman\r\n\r\nDEBUG: Transport: ssl\r\n\r\nDEBUG: ipconfig\r\n\r\nERROR: Failed to authenticate to [\"mysystem.myorg.org\"] as administrator\r\n\r\nResponse: Bad HTTP response returned from server (401).\r\n\r\n```\r\nHint: Please check winrm configuration 'winrm get winrm/config/service' AllowUnencrypted flag on remote server.\r\n\r\n/opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/winrm-1.2.0/lib/winrm/http/transport.rb:48:in `send_request': Bad HTTP response returned from server (401). (WinRM::WinRMHTTPTransportError)\r\n```"}}