Hyper-V management

Vertigo · 12 Jul 2016 at 17:25

Urgh, this again. Sure I've had this before but can't remember how I solved it.

Just installed new Hyper-V 2012 R2 server box which I want to allow certain people to manage but only to start/stop VMs etc.

I've used the Authorization Manager to configure the relevant groups for the relevant access but the Hyper-V manager refuses to even connect, throwing a generic access denied error.

What have I missed?

d_brennen · 12 Jul 2016 at 17:27

WinRM enabled everywhere?

Vertigo · 13 Jul 2016 at 07:55

The service is running on the server if that's what you mean - is there anything else I need to enable?

d_brennen · 13 Jul 2016 at 08:20

It's hard to say, the gotcha in my experience is enabling WinRM. It has to be done on all clients AND the host

Code:

winrm quickconfig

run from powershell

Vertigo · 13 Jul 2016 at 08:25

Appears to be running (delayed auto start) on all machines.

What's really strange is that, even if I add the relevant user to the existing Administrator role via AZMan, it still does work, which suggests it's not these permissions but something else blocking it. Just don't know what as no firewalls are in place.

d_brennen · 13 Jul 2016 at 08:32

This MSDN article may be of help, last section especially

https://msdn.microsoft.com/en-us/virtualization/hyperv_on_windows/user_guide/remote_host_management

But you probably saw this already

Vertigo · 13 Jul 2016 at 10:30

Thanks but none of that appears relevant to my situation.

I've tried everything but nothing works. Literally the only thing that will allow a user to remotely manage Hyper-V is adding them to the local Administrators group on the server - nothing else will even allow connection to the Hyper-V server.

This is ridiculous. Microsoft are utter morons.

Vertigo · 13 Jul 2016 at 11:03

I've just found one report from someone with the exact same issue saying they were told by Microsoft that it was a known issue that wouldn't be fixed.

They were using an 8.1 client rather than 10 as I am but apparently MS said that, in order to remotely access and manage Hyper-V on a 2012R2 server from an 8.1 client, the user had to be a member of the local administrators group, end of. This despite them adding a dedicated Hyper-V Administrators group.

Hopeless.

d_brennen · 13 Jul 2016 at 18:03

Vertigo1 said:
I've just found one report from someone with the exact same issue saying they were told by Microsoft that it was a known issue that wouldn't be fixed.

They were using an 8.1 client rather than 10 as I am but apparently MS said that, in order to remotely access and manage Hyper-V on a 2012R2 server from an 8.1 client, the user had to be a member of the local administrators group, end of. This despite them adding a dedicated Hyper-V Administrators group.

Hopeless.

Can't been right, from 10 anyway. I recall 7 Pro and below were non-starters for remote HyperV management.

If a user just needs to restart VMs, how about some PS scripting? They'd need HyperV Admin credentials and appropriate permission to run scrips of course