Issues configuring WinRM while deploying a Windows VM on Azure via API - powershell

Question

When deploying on Azure via REST API a VM with Windows2008-SQL-Server template, we need to configure WinRM with a powershell script to enable basic auth. For doing so we use the Azure extension 'CustomScriptExtension' that loads a script from our blobstorage and runs it.
The script's output has errors and Powershell doesn’t respond on port 5985.
We use the SQL-Server-2008R2-SP2-10.50.4319.0-Standard-ENU-Win2008R2 template.
In the deployment we set a listener that uses as protocol ‘Http’.
We open the 5985 port and at the end of the VM provisioning we are able to open a socket on it.
Code:
winrm quickconfig -q
winrm set winrm/config/winrs '#{MaxMemoryPerShellMB="300"}'
winrm set winrm/config '#{MaxTimeoutms="1800000"}'
winrm set winrm/config/service '#{AllowUnencrypted="true"}'
winrm set winrm/config/service/auth '#{Basic="true"}'
For each script's command we have the following error:
Message = Access is denied. \\n\\nError number: -2147024891 0x80070005\\nAccess is denied.
Once the provisioning of the VM is done, we can log in using Remote Desktop and if we launch the powershell script from there, it perfectly works.
After some research we have found this article that proposes a possible solution, but the problem with it is that it exposes a security issue, because the script needs an admin password as parameter.
We are looking for other advice or for a workaround. We are working with a full automated workflow so sadly “hand-made solutions” are not an option for us. Thanks in advance for any help.

Answer 1

I've done this to make the Chef client bootstrap work on an Azure Windows VM. In my case, in addition to what you've done, I had to open 5985 on the Windows Firewall and enable the 5985 endpoint on the cloud service. It was a PITA, but it got the job done.