Windows Builder

by hashicorpf706481af9b8No license890 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 3 days ago

Build Windows images with Packer using WinRM communicator and PowerShell provisioners. Use when creating Windows AMIs, Azure images, or VMware templates.

Instructions onlyDevOps & Cloud

AI-generated overview

Provides Packer patterns for building Windows images with the WinRM communicator and PowerShell provisioners.

What it does: This skill documents platform-agnostic patterns for building Windows machine images with Packer, covering WinRM communicator configuration for AWS and Azure sources, PowerShell provisioners for installing software and Windows updates, and cleanup steps. It also lists common issues such as WinRM timeouts, PowerShell execution policy, and long build times. It is instruction-only and produces configuration guidance rather than files.
When to use it: Use it when creating Windows AMIs, Azure managed images, or VMware templates with Packer. It is also relevant when troubleshooting WinRM connectivity, PowerShell provisioning, or lengthy Windows builds.
Requirements: Packer and a target platform such as AWS or Azure; Azure examples reference client_id, client_secret, subscription_id, and tenant_id variables. Network access is needed to reach the base images and package sources. No scripts ship with the skill; the WinRM setup script is shown as an inline example.

Windows Builder

Platform-agnostic patterns for building Windows images with Packer.

Reference: WinRM Communicator

Note: Windows builds incur significant costs and time. Expect 45-120 minutes per build due to Windows Updates. Failed builds may leave resources running - always verify cleanup.

WinRM Communicator Setup

Windows requires WinRM for Packer communication.

AWS Example

hcl

source "amazon-ebs" "windows" {  region        = "us-west-2"  instance_type = "t3.medium"
  source_ami_filter {    filters = {      name = "Windows_Server-2022-English-Full-Base-*"    }    most_recent = true    owners      = ["amazon"]  }
  ami_name = "windows-server-2022-${local.timestamp}"
  communicator   = "winrm"  winrm_username = "Administrator"  winrm_use_ssl  = true  winrm_insecure = true  winrm_timeout  = "15m"
  user_data_file = "scripts/setup-winrm.ps1"}

source "amazon-ebs" "windows" {  region        = "us-west-2"  instance_type = "t3.medium"
  source_ami_filter {    filters = {      name = "Windows_Server-2022-English-Full-Base-*"    }    most_recent = true    owners      = ["amazon"]  }
  ami_name = "windows-server-2022-${local.timestamp}"
  communicator   = "winrm"  winrm_username = "Administrator"  winrm_use_ssl  = true  winrm_insecure = true  winrm_timeout  = "15m"
  user_data_file = "scripts/setup-winrm.ps1"}

WinRM Setup Script (scripts/setup-winrm.ps1)

powershell

<powershell># Configure WinRMwinrm quickconfig -qwinrm set winrm/config '@{MaxTimeoutms="1800000"}'winrm set winrm/config/service '@{AllowUnencrypted="true"}'winrm set winrm/config/service/auth '@{Basic="true"}'
# Configure firewallnetsh advfirewall firewall add rule name="WinRM 5985" protocol=TCP dir=in localport=5985 action=allownetsh advfirewall firewall add rule name="WinRM 5986" protocol=TCP dir=in localport=5986 action=allow
# Restart WinRMnet stop winrmnet start winrm</powershell>

<powershell># Configure WinRMwinrm quickconfig -qwinrm set winrm/config '@{MaxTimeoutms="1800000"}'winrm set winrm/config/service '@{AllowUnencrypted="true"}'winrm set winrm/config/service/auth '@{Basic="true"}'
# Configure firewallnetsh advfirewall firewall add rule name="WinRM 5985" protocol=TCP dir=in localport=5985 action=allownetsh advfirewall firewall add rule name="WinRM 5986" protocol=TCP dir=in localport=5986 action=allow
# Restart WinRMnet stop winrmnet start winrm</powershell>

Azure Example

hcl

source "azure-arm" "windows" {  client_id       = var.client_id  client_secret   = var.client_secret  subscription_id = var.subscription_id  tenant_id       = var.tenant_id
  managed_image_resource_group_name = "images-rg"  managed_image_name                = "windows-${local.timestamp}"
  os_type         = "Windows"  image_publisher = "MicrosoftWindowsServer"  image_offer     = "WindowsServer"  image_sku       = "2022-datacenter-g2"
  location = "East US"  vm_size  = "Standard_D2s_v3"
  # Azure auto-configures WinRM  communicator   = "winrm"  winrm_use_ssl  = true  winrm_insecure = true  winrm_timeout  = "15m"  winrm_username = "packer"}

source "azure-arm" "windows" {  client_id       = var.client_id  client_secret   = var.client_secret  subscription_id = var.subscription_id  tenant_id       = var.tenant_id
  managed_image_resource_group_name = "images-rg"  managed_image_name                = "windows-${local.timestamp}"
  os_type         = "Windows"  image_publisher = "MicrosoftWindowsServer"  image_offer     = "WindowsServer"  image_sku       = "2022-datacenter-g2"
  location = "East US"  vm_size  = "Standard_D2s_v3"
  # Azure auto-configures WinRM  communicator   = "winrm"  winrm_use_ssl  = true  winrm_insecure = true  winrm_timeout  = "15m"  winrm_username = "packer"}

PowerShell Provisioners

Install Software

hcl

build {  sources = ["source.amazon-ebs.windows"]
  # Install Chocolatey  provisioner "powershell" {    inline = [      "Set-ExecutionPolicy Bypass -Scope Process -Force",      "iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"    ]  }
  # Install applications  provisioner "powershell" {    inline = [      "choco install -y googlechrome",      "choco install -y 7zip",    ]  }
  # Install IIS  provisioner "powershell" {    inline = [      "Install-WindowsFeature -Name Web-Server -IncludeManagementTools"    ]  }}

build {  sources = ["source.amazon-ebs.windows"]
  # Install Chocolatey  provisioner "powershell" {    inline = [      "Set-ExecutionPolicy Bypass -Scope Process -Force",      "iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"    ]  }
  # Install applications  provisioner "powershell" {    inline = [      "choco install -y googlechrome",      "choco install -y 7zip",    ]  }
  # Install IIS  provisioner "powershell" {    inline = [      "Install-WindowsFeature -Name Web-Server -IncludeManagementTools"    ]  }}

Windows Updates

hcl

provisioner "powershell" {  inline = [    "Install-PackageProvider -Name NuGet -Force",    "Install-Module -Name PSWindowsUpdate -Force",    "Import-Module PSWindowsUpdate",    "Get-WindowsUpdate -Install -AcceptAll -AutoReboot",  ]  timeout = "2h"}
# Wait for rebootsprovisioner "windows-restart" {  restart_timeout = "30m"}

provisioner "powershell" {  inline = [    "Install-PackageProvider -Name NuGet -Force",    "Install-Module -Name PSWindowsUpdate -Force",    "Import-Module PSWindowsUpdate",    "Get-WindowsUpdate -Install -AcceptAll -AutoReboot",  ]  timeout = "2h"}
# Wait for rebootsprovisioner "windows-restart" {  restart_timeout = "30m"}

Cleanup

hcl

provisioner "powershell" {  inline = [    "# Clear temp files",    "Remove-Item -Path 'C:\\Windows\\Temp\\*' -Recurse -Force -ErrorAction SilentlyContinue",    "# Clear Windows Update cache",    "Stop-Service -Name wuauserv -Force",    "Remove-Item -Path 'C:\\Windows\\SoftwareDistribution\\*' -Recurse -Force -ErrorAction SilentlyContinue",    "Start-Service -Name wuauserv",  ]}

provisioner "powershell" {  inline = [    "# Clear temp files",    "Remove-Item -Path 'C:\\Windows\\Temp\\*' -Recurse -Force -ErrorAction SilentlyContinue",    "# Clear Windows Update cache",    "Stop-Service -Name wuauserv -Force",    "Remove-Item -Path 'C:\\Windows\\SoftwareDistribution\\*' -Recurse -Force -ErrorAction SilentlyContinue",    "Start-Service -Name wuauserv",  ]}

Common Issues

WinRM Timeout

Increase winrm_timeout to 15m or more
Verify security group allows ports 5985/5986
Check user data script completed successfully

PowerShell Execution Policy

hcl

provisioner "powershell" {  inline = [    "Set-ExecutionPolicy Bypass -Scope Process -Force",    "# Your commands here",  ]}

provisioner "powershell" {  inline = [    "Set-ExecutionPolicy Bypass -Scope Process -Force",    "# Your commands here",  ]}

Long Build Times

Windows Updates can take 1-2 hours
Use pre-patched base images when available
Set provisioner timeout = "2h"

References

Source and attribution

Source:hashicorp/agent-skillsinplugins/packer/skills/windows-builderat commitf706481

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from hashicorp/agent-skills

Terraform Test

hashicorp

Guides writing and running Terraform tests with .tftest.hcl files, run blocks, assertions, mocks and CI integration.

Software Development890updated 3 days ago

Terraform Style Guide

hashicorp

Generates and reviews Terraform HCL code following HashiCorp's official style conventions and best practices.

DevOps & Cloud890updated 3 days ago

Terraform Stacks

hashicorp

Guides writing and validating HashiCorp Terraform Stacks configuration files for multi-environment infrastructure.

DevOps & Cloud890updated 3 days ago

Terraform Policy

hashicorp

Writes, tests and converts Terraform Policy files (.policy.hcl, .policytest.hcl) and Sentinel policies.

Software Development890updated 3 days ago

Refactor Module

hashicorp

Guides refactoring monolithic Terraform configurations into reusable, maintainable modules with migration and tests.

Software Development890updated 3 days ago

Provider Resources

hashicorp

Implement Terraform Provider resources and data sources using the Plugin Framework: CRUD operations, schema design, plan modifiers and validators, not-found handling, waiters for eventually consistent APIs, import support, resource design principles, and required acceptance test coverage. Use when adding or changing a resource or data source, deciding whether an API concept should be a resource, wiring a resource to the provider's configured client, handling drift or resource-not-found, or reviewing a resource implementation before submission.

Awaiting classification890updated 3 days ago

Windows Builder

Windows Builder

WinRM Communicator Setup

AWS Example

WinRM Setup Script (scripts/setup-winrm.ps1)

Azure Example

PowerShell Provisioners

Install Software

Windows Updates

Cleanup

Common Issues

References

Source and attribution

More from hashicorp/agent-skills

Terraform Test

Terraform Style Guide

Terraform Stacks

Terraform Policy

Refactor Module

Provider Resources

More in DevOps & Cloud

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist