title: Packer cannot communicate with AWS windows server 2016 instances to build custom ami
body: <p>I am using packer 0.12.1 to build an AWS ami based on the existing windows server 2016 ami.</p>
  
  <p>The way I used to get it to work with windows server 2012 is to specify in the packer template:</p>
  
  <pre><code>"communicator": "winrm",
  "winrm_username": "Administrator",
  "winrm_use_ssl": true,
  "winrm_insecure": true,
  "user_data_file":"./ec2-userdata-winserver2016.ps1",
  </code></pre>
  
  <p>And the user data file would look like:</p>
  
  <pre><code>&lt;powershell&gt;
  
  write-output "Running User Data Script"
  write-host "(host) Running User Data Script"
  
  Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force -ErrorAction Ignore
  
  # Don't set this before Set-ExecutionPolicy as it throws an error
  $ErrorActionPreference = "stop"
  
  # Remove HTTP listener
  Remove-Item -Path WSMan:\Localhost\listener\listener* -Recurse
  
  $Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName "packer"
  New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint -Force
  
  # WinRM
  write-output "Setting up WinRM"
  write-host "(host) setting up WinRM"
  
  cmd.exe /c winrm quickconfig -q
  cmd.exe /c winrm set "winrm/config" '@{MaxTimeoutms="1800000"}'
  cmd.exe /c winrm set "winrm/config/winrs" '@{MaxMemoryPerShellMB="1024"}'
  cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
  cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'
  cmd.exe /c winrm set "winrm/config/service/auth" '@{Basic="true"}'
  cmd.exe /c winrm set "winrm/config/client/auth" '@{Basic="true"}'
  cmd.exe /c winrm set "winrm/config/service/auth" '@{CredSSP="true"}'
  cmd.exe /c winrm set "winrm/config/listener?Address=*+Transport=HTTPS" "@{Port=`"5986`";Hostname=`"packer`";CertificateThumbprint=`"$($Cert.Thumbprint)`"}"
  cmd.exe /c netsh advfirewall firewall set rule group="remote administration" new enable=yes
  cmd.exe /c netsh firewall add portopening TCP 5986 "Port 5986"
  cmd.exe /c net stop winrm
  cmd.exe /c sc config winrm start= auto
  cmd.exe /c net start winrm
  
  &lt;/powershell&gt;
  </code></pre>
  
  <p>This works fine in windows server 2012, but not anymore in windows server 2016.</p>
  
  <p>For server 2016, the output of packer is:</p>
  
  <pre><code>==&gt; eu-west-1-builder: Waiting for auto-generated password for instance...
      eu-west-1-builder: It is normal for this process to take up to 15 minutes,
      eu-west-1-builder: but it usually takes around 5. Please wait.
      eu-west-1-builder:  
      eu-west-1-builder: Password retrieved!
  ==&gt; eu-west-1-builder: Waiting for WinRM to become available...
  </code></pre>
  
  <p>And it hangs until timeout.</p>
  
  <p>As AWS release windows server 2016 ami fairly recently, I couldn't find much information. I am not really a windows guru (I am usually on linux)</p>
  
  <p>Any help / suggestions would be greatly appreciated.</p>