Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

vsecgod — Thu, 23 Jun 2011 00:01:25 GMT

omg this was a lifesaver, could not figure out what was causing this error!

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Albecool — Fri, 12 Feb 2010 00:41:03 GMT

Thank you, Thank you, Thank you. Works like a charm.

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

John Howard -MSFT — Tue, 15 Dec 2009 19:58:33 GMT

Josh - without the output from both sides, it's impossible to diagnose anything here.

Thanks,

John.

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Josh Franklin — Sat, 14 Nov 2009 06:01:54 GMT

so strange, in my office, with the system set up behing a smoothwall firewall, I am able to get my laptop talking with my hpyer-v server.

I bring the system home, hook it up identically, and it gives me an

Cannot connect ot the RPC Services on computer 'VVS1' please make sure your RPC serve is running.

I use hosts files as there is not yet a DNS set up on the network and can NSlookup from server to client without a problem. From client to server it was erroring out, but once I added the domain suffix to the TCP connection it started working without an issue.

INFO: Computername is VVS1

INFO: Computer is in workgroup VECTOR

INFO: Current user is VVS1\joshf

INFO: Assuming /mode:server as the role is installed

INFO: Build 7600.16385.amd64fre.win7_rtm.090713-1255

INFO: Detected Windows 7/Windows Server 2008 R2 OS

-------------------------------------------------------------------------------

DACL for WMI Namespace root\cimv2

Required for Hyper-V remote mangement: Allow, EnabAct, RemEnab, InheritAce

HVRemote also sets NoPropInheritAce and ValidInheritFlags

-------------------------------------------------------------------------------

\ (S-1-5-21-1762662943-3239234248-1774531117-1001)

Allow: EnabAct RemEnab (33)

Flags: InheritAce NoPropInheritAce ValidInheritFlags (6)

\ (S-1-5-21-1762662943-3239234248-1774531117-1002)

Allow: EnabAct RemEnab (33)

Flags: InheritAce NoPropInheritAce ValidInheritFlags (6)

VVS1\joshf (S-1-5-21-1762662943-3239234248-1774531117-1003)

Allow: EnabAct RemEnab (33)

Flags: InheritAce NoPropInheritAce ValidInheritFlags (6)

BUILTIN\Administrators (S-1-5-32-544)

Allow: Exec FullWrt PartWrt ProvWrt EnabAct RemEnab RdSec EdSec (393279)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\NETWORK SERVICE (S-1-5-20)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\LOCAL SERVICE (S-1-5-19)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\Authenticated Users (S-1-5-11)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

-------------------------------------------------------------------------------

DACL for WMI Namespace root\virtualization

Required for Hyper-V remote mangement: Allow, EnabAct, RemEnab, InheritAce

HVRemote also sets NoPropInheritAce and ValidInheritFlags

-------------------------------------------------------------------------------

\ (S-1-5-21-1762662943-3239234248-1774531117-1001)

Allow: EnabAct RemEnab (33)

Flags: InheritAce NoPropInheritAce ValidInheritFlags (6)

\ (S-1-5-21-1762662943-3239234248-1774531117-1002)

Allow: EnabAct RemEnab (33)

Flags: InheritAce NoPropInheritAce ValidInheritFlags (6)

VVS1\joshf (S-1-5-21-1762662943-3239234248-1774531117-1003)

Allow: EnabAct RemEnab (33)

Flags: InheritAce NoPropInheritAce ValidInheritFlags (6)

BUILTIN\Administrators (S-1-5-32-544)

Allow: Exec FullWrt PartWrt ProvWrt EnabAct RemEnab RdSec EdSec (393279)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\NETWORK SERVICE (S-1-5-20)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\LOCAL SERVICE (S-1-5-19)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\Authenticated Users (S-1-5-11)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

-------------------------------------------------------------------------------

Contents of Authorization Store Policy

-------------------------------------------------------------------------------

Hyper-V Registry configuration:

- Store: msxml://C:\ProgramData\Microsoft\Windows\Hyper-V\InitialStore.xml

- Service Application: Hyper-V services

Application Name: Hyper-V services

Operation Count: 34

100 - Read Service Configuration

105 - Reconfigure Service

200 - Create Virtual Switch

205 - Delete Virtual Switch

210 - Create Virtual Switch Port

215 - Delete Virtual Switch Port

220 - Connect Virtual Switch Port

225 - Disconnect Virtual Switch Port

230 - Create Internal Ethernet Port

235 - Delete Internal Ethernet Port

240 - Bind External Ethernet Port

245 - Unbind External Ethernet Port

250 - Change VLAN Configuration on Port

255 - Modify Switch Settings

260 - Modify Switch Port Settings

265 - View Switches

270 - View Switch Ports

275 - View External Ethernet Ports

280 - View Internal Ethernet Ports

285 - View VLAN Settings

290 - View LAN Endpoints

295 - View Virtual Switch Management Service

300 - Create Virtual Machine

305 - Delete Virtual Machine

310 - Change Virtual Machine Authorization Scope

315 - Start Virtual Machine

320 - Stop Virtual Machine

325 - Pause and Restart Virtual Machine

330 - Reconfigure Virtual Machine

335 - View Virtual Machine Configuration

340 - Allow Input to Virtual Machine

345 - Allow Output from Virtual Machine

350 - Modify Internal Ethernet Port

355 - Allow Virtual Machine Snapshot

1 role assignment(s) were located

Role Assignment 'Administrator' (Targetted Role Assignment)

- All Hyper-V operations are selected

- There are 4 member(s) for this role assignment

- BUILTIN\Administrators (S-1-5-32-544)

- S-1-5-21-1762662943-3239234248-1774531117-1001 (S-1-5-21-1762662943-3239234

248-1774531117-1001)

- S-1-5-21-1762662943-3239234248-1774531117-1002 (S-1-5-21-1762662943-3239234

248-1774531117-1002)

- VVS1\joshf (S-1-5-21-1762662943-3239234248-1774531117-1003)

-------------------------------------------------------------------------------

Contents of Group Distributed COM Users

-------------------------------------------------------------------------------

1 member(s) are in Distributed COM Users

- VVS1\joshf

-------------------------------------------------------------------------------

DACL for COM Security Launch and Activation Permissions

-------------------------------------------------------------------------------

BUILTIN\Administrators (S-1-5-32-544)

Allow: LocalLaunch RemoteLaunch LocalActivation RemoteActivation (31)

\Everyone (S-1-1-0)

Allow: LocalLaunch LocalActivation (11)

BUILTIN\Distributed COM Users (S-1-5-32-562)

Allow: LocalLaunch RemoteLaunch LocalActivation RemoteActivation (31)

BUILTIN\Performance Log Users (S-1-5-32-559)

Allow: LocalLaunch RemoteLaunch LocalActivation RemoteActivation (31)

-------------------------------------------------------------------------------

Firewall Settings for Hyper-V

-------------------------------------------------------------------------------

Public Firewall Profile is active

Enabled: Hyper-V (REMOTE_DESKTOP_TCP_IN)

Enabled: Hyper-V (MIG-TCP-In)

Enabled: Hyper-V (RPC)

Enabled: Hyper-V (RPC-EPMAP)

Enabled: Hyper-V - WMI (Async-In)

Enabled: Hyper-V - WMI (TCP-Out)

Enabled: Hyper-V - WMI (TCP-In)

Enabled: Hyper-V - WMI (DCOM-In)

-------------------------------------------------------------------------------

Firewall Settings for Windows Management Instrumentation (WMI)

-------------------------------------------------------------------------------

Public Firewall Profile is active

Enabled: Windows Management Instrumentation (ASync-In)

Enabled: Windows Management Instrumentation (WMI-Out)

Enabled: Windows Management Instrumentation (WMI-In)

Enabled: Windows Management Instrumentation (DCOM-In)

Note: Above firewall settings are not required for Hyper-V Remote Management

-------------------------------------------------------------------------------

IP Configuration

-------------------------------------------------------------------------------

Windows IP Configuration

Host Name . . . . . . . . . . . . : VVS1

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 3:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Vector.int

Physical Address. . . . . . . . . : 90-E6-BA-4E-3D-A7

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::f104:d946:5537:b26e%211(Preferred)

IPv4 Address. . . . . . . . . . . : 192.168.0.5(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.0.0

Lease Obtained. . . . . . . . . . : Friday, November 13, 2009 8:31:12 PM

Lease Expires . . . . . . . . . . : Friday, November 13, 2009 10:31:12 PM

Default Gateway . . . . . . . . . : 192.168.0.254

DHCP Server . . . . . . . . . . . : 192.168.0.254

DHCPv6 IAID . . . . . . . . . . . : -745478470

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-8D-F2-CC-90-E6-BA-4E-3D-A7

DNS Servers . . . . . . . . . . . : 192.168.0.254

192.168.0.1

NetBIOS over Tcpip. . . . . . . . : Enabled

-------------------------------------------------------------------------------

Testing connectivity to client: n120053 (2 tests in total)

-------------------------------------------------------------------------------

Test 1

------

This test verifies your DNS infrastructure. For Hyper-V remote management,

VVS1 must be able to resolve the IP address of n120053.

If you do not have a DNS infrastructure, test 1 may legitimately fail.

However, you will have to edit \windows\system32\drivers\etc\hosts on this

computer to add an entry for n120053.

If you have a DNS infrastructure and test 1 fails, this is a strong

indication that Hyper-V remote management will not work.

a) Verify that n120053 is the correct client name

b) On VVS1, run ipconfig /flushdns

c) On n120053, run ipconfig /registerDNS

If you have a DNS infrastructure and test 1 succeeds, verify the IPv4

address returned matches the IPv4 address of n120053. This can be

found by running ipconfig /all on n120053.

If you find the incorrect IP address is returned, follow steps a) to c)

described above, plus step d) below.

d) Check the hosts file on VVS1 for incorrect entries.

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~

Server: HADRIANS

Address: 192.168.0.254

Name: n120053

Address: 192.168.0.200

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~

Test 2

------

This test attempts to ping n120053. Like test 1, the aim is to

verify name resolution. Examine the output to ensure the IP address is

that of n120053.

If an incorrect IP address is shown, follow resolution steps a)

through d) listed above.

A ping timeout is OK. It is likely the firewall on the client machine

is blocking inbound pings. No action need be taken.

If the ping cannot locate n120053, you may need to add an entry

in \windows\system32\drivers\etc (described above). If you have a DNS

infrastructure, follow steps a) through c).

This test may take a second or two...

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~

Pinging n120053 [192.168.0.200] with 32 bytes of data:

Reply from 192.168.0.200: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.0.200:

Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~

INFO: Are running the latest version

I'm now scratching my head. . .

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jpavly — Fri, 25 Sep 2009 12:24:45 GMT

Thanks a lot, that totally worked!

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

John Howard -MSFT — Thu, 09 Jul 2009 19:28:22 GMT

Greg - glad you resolved it :)

Cheers,

John.

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Greg L — Thu, 09 Jul 2009 19:25:19 GMT

Ok, at the last moment, I found the source of my problem. My the network adapter in my Vista client, running as a VM in Sun VirtualBox, was configured with NAT. Once I switched it to bridged, all worked fine. Thanks, sorry for the false alarm.

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Greg L — Thu, 09 Jul 2009 19:17:50 GMT

Thanks for such detailed work. I've followed the examples to a "T" but this problem persists for me: Once I've connected to the Hyper-V server from the client (Vista Ent 64, SP2), I get an RPC error. After refreshing the detail pane simply says "loading virtual machines" but nothing ever comes up. I can manage the server settings, and have even created a VM, but I cannot see them. I disabled the firewall on both server and client and the same thing happens. Any ideas? Thanks!

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Larry — Tue, 30 Jun 2009 19:01:51 GMT

John, you are definately a legend!! We need guys like you around. :)

Cheers

re: Part 2 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

dbinfl — Sat, 23 May 2009 06:12:46 GMT

Wow! I just followed these instructions, and indeed got this working. So, hats off to you for taking the time to document and post this; I sure appreciate it.

Now, as to MS, maybe they could make this a little harder, but why bother since they've pretty much aced this in the PITA department (including a reboot -- wouldn't be complete without a reboot).

Thanks for this and all the other helpful posts I've found here.

cheers