WinRM error: Server 2022 autounattend.xml

[wd40]

Hello,
Its my first time posting here so please let me know if I should provide more informations / this is the right channel.

I have an issue with winrm after I fully automate the Windows setup of a server 2022 VM via autounattended.xml in NTlite.
After the setup I get the following winrm Error from a different host when trying to remote into the new system:

The exact error is different every time I reinstall the VM...

Some Info about my setup:
- Installation is done in a Hyper-V Gen 2 VM
- Windows Edition: 2022 Desktop Datacenter
- Winrm config is applied via GPO - This is working fine if I try this out on a fresh, manually installed system

So far I have tried the following:
- Download a new ISO from Microsoft directly
- Reload the ISO in NTLite
- Test my GPO settings with a fresh client
- Removing some options from NTlite so I had to manually selct them. This ultimately ultimatly leaded to #1
- Login to the VM and force a gpupdate / reboot
- Searching online for the error which was not very helpful

So I guess there is somewhere an issue with my autounattended.xml configuration....

The goal was to do the default configuration of the server via NTlite and later on use ansible to customize the installation futher in my homelab.

I have attached my autounattended.xml as .png and .xml for you.

Any help is appreciated as I'm a bit at my wit's end here :/

Thank you guys in advance!

 

[garlin]

The unattended config can't break a GPO, unless the PC didn't properly join the domain. Did you confirm other GPO settings were applied?
Did you remove any components from the install image?

 

[wd40]

Hello garlin,

I am only doing chnages to the Unattended section so far. i am not even trimming the editions.
After the client is configured the RDP GPO is applied correctly I can remote into the freshly installed VM with my domain account So they seems to be applied correctly.
The GUI also seems to confirm this

Here is was gpresult /R is showing



This time I have also used my domain admin credentialsto join the device to my domain - same outcome.

I also just noticed that when I load the ISO from cache there is a Message "Loaded Unsuported Removals" I usually load the ISO again each time so I have not noticed this before. Could this have anything to do with NTlite running in a Windows 11 VM?


Anyways, thanks for your suggestions so far!

 

[garlin]

That looks correct, in terms of the GPO applied to this client.

I believe "(unsupported removals)" is because you're using a Server EVAL image, instead of the normal Server release. There's some known weirdness with modifying EVAL because some of the features are changed to make it work for a limited time.

Sorry I don't have an AD environment to test again. All I know is NTLite doesn't know anything about WinRM. On Windows, the normal software is bundled with PS and all it does is enable a listener service, and open the firewall for connections.

 

[wd40]

Thank you for your explanation.

I just tried the same settings with a Windows 11 ISO and winrm seems to work there. So I guess it really could be an issue with the eval ISO...
What a shame that I dont have a official ISO to test against :/

I figured that this would be an edge case here, it seems like I will try again with good old sysprep or get a official non eval ISO.


Thanks for your help!

 

[wd40]

So I got my hands on a official non Eval ISO but the Issue was persisting.
I have now spend a considerable amount of time to figure this out the soloution is not to use the option "User locale" in both places when no local User is created, which makes total sense in hindsight
It seems like this is enteriely a Windows issue, not one from NTlite.
Maybe it would be a good idea to add a remark in the explanation field not to populate this when no user account is created through autounattneded?

Hopefully this will save someone from troubleshooting this issue for hours like I did...

On another note the official non eval ISO also got rid of the errormessage "Unsuported modifacations" I havent tested if it would work with the eval ISO if someone needs this information I can of course test this.

Also thanks to Garlin for his suggestions!
Anyway here is my working autounattened for anyone interested: