opscode/knife-windows — pull request #11 by pmorton (2012-02-23 03:34:52+00:00)
Title: KNIFE_WINDOWS-17 WinRm Detects the need for NTLM Authentication

@schisamo Knife winrm will currently only work with basic authentication which means that you are unable to authenticate with domain accounts. There are two things going on in this pull request.

If the user specified a username with a \ in it, assume that they are doing domain authentication and set basic to false. Basic will be set to true when a \ is not detected in the users name.
In order for this to work, https://github.com/schisamo/em-winrm/pull/4 needs to be pulled and closed.

Negotiate will mess up if you have gssapi install and negotiate enabled, but have an unsupported or broken implementation of gssapi. So if you are specifying credentials, clearly you do not want to do kerberos authentication, so disable it and your troubles will go away.
There is an open pull request on WinRM to provide an option to disable Gssapi in the negotiation stack. It does not need to be closed prior accepting this pull request as the added option will only help when your kerberos environment is funky. https://github.com/zenchild/WinRM/pull/19