Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

John Howard : Part 1 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ???COMPUTERNAME???

Mon, 31 Mar 2008 03:56:17 GMT

PingBack from http://blogs.technet.com/jhoward/archive/2008/03/28/part-1-hyper-v-remote-management-you-do-not-have-the-requested-permission-to-complete-this-task-contact-the-administrator-of-the-authorization-policy-for-the-computer-computername.aspx

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Ryan — Tue, 01 Apr 2008 06:39:55 GMT

John,

Thank you for all the great information, however, I am still having problems. I am running Hyper-V on Server Core and I am trying to access it from a workstation running Vista SP1 with the Hyper-V console installed. Both computers are added to the same domain and both computer have my domain username added as a member of the local administrators group. I applied the Hyper-V RC0 update to the install.wim file, I then installed server core using the updated wim. I am getting the "don't have requested permission" error on my workstation. What is interesting is that the first time I opened the management console, it worked and I was able to configure my virtual switches. Now it won't let me change any settings. Any ideas?

Thanks,

Ryan Lenkersdorfer

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 01 Apr 2008 06:55:00 GMT

Hi Ryan. I'm in the process of setting up a private domain outside of the Microsoft corporate network to work through the same steps in a controlled domain scenario - the fairly complex corpnet enforced policies and IPSec make it difficult to track down issues without a private domain. It's unlikely I'll get my private network walkthrough finished before the end of the week, but I'll post up my results as soon as I can - I guess parts one two AND three weren't enough. I don't have any suggestions currently. Sorry!

Cheers,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Dale Unroe — Tue, 01 Apr 2008 15:54:57 GMT

I too have experienced a difference between the first run of the Hyper-V mmc UI from my Vista managment and the subsequent runs. Specifically I need to change the path to where the Virtual Hard Drives are to be stored and located; howver, I'm unable and am getting a message:

---------------------------

Remote File Browser

---------------------------

You may not browse the local file system when connecting to a remote Hyper-V server.

---------------------------

-------------------------

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Dale Unroe — Tue, 01 Apr 2008 16:21:10 GMT

going through step 14 above - the \ProgramData directory (as part of the path to the InitialStore.xml) is apparently a Hidden directory as it isn't directly browsable. I did a search and then copied the path; however, you can simple cut and paste the path from Step 14 instructions or type it out.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Alberto — Tue, 01 Apr 2008 16:24:18 GMT

Thanks John. I now have a Windows Server 2008 Core DC, a Windows server 2008 NAP, a windows Server 2003 exchange 2007 sp1 server all in the same Core Hyper-v black box.

A complete network for testing and funny.

I do hope this issues are RC0 related, though. I'll stay tuned to your blog.

You deserve a good italian pizza! :)

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Wed, 02 Apr 2008 05:29:20 GMT

@Ryan - no I have a test environment up and running, I'll try this and get back to you.

@Dale - am investigating. I saw this once too, but was not able to reproduce it or get a list of steps to make it happen.

@Alberto - Curry would be nicer :) (Although "American" curry takes a lot of getting used to after my "British" indian cuisine up-bringing). Glad you got it going.

Thanks,

John

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

HiltonT — Wed, 02 Apr 2008 16:51:14 GMT

Hi John,

I get to step 13 fine, however when I connect to the WMI Control, it connects fine, but the "Security" tab contains only the "Root" and no namespaces below this.

Any ideas why?

(Server is WS2K8 Ent Core with Hyper-V RC0 and guest is Vista x86 SP1 with RSAT and Hyper-V Management tools loaded.)

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

George — Thu, 03 Apr 2008 04:36:19 GMT

Thanks for the lesson. Everything you showed worked fine for me as far as you went, but when I go to add my first virtual machine I get an error that the Wizard cannot load because I do not have permission. Did I miss a step?

Actually I can move the error message box to one side and navigate the wizard, but when I hit finish it throws another permissions error and I am forced to acknowledge and close the wizard. Any thoughts?

Thanks again for getting me this far.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Thu, 03 Apr 2008 05:03:09 GMT

George - if you can connect in the first place, then it sounds like you didn't setup the AZMan bit correctly. Can you run the script on the server core machine and confirm that under IE on the remote machine, the correct SID is in the administrator part like in the screenshot above.

Thanks,

John.

Remotely managing your Server Core using Compmgmt.msc

The things that are better left unspoken — Thu, 03 Apr 2008 12:32:44 GMT

Remote management of Server Core installations helps you. It prevents you from having to struggle with

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

George — Thu, 03 Apr 2008 13:39:35 GMT

As a matter of fact I ran the vbs script on the server in the first place.

After I edited the initial store XML file, I reimported it into AZMan (deleting the previous initial store entry).

When I look in AZMan at the "Administrator" role assignment I see my specified domain\username listed as a "user" type right under the "Administrators(BUILTIN\Administrators)" group.

I am conected to the hyperv server and see the "No virtual machines were found..." message. It just seems I am missing whatever permission is needed to create new VMs.

Part 5. Domain client to Workgroup Server: Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

John Howard — Sat, 05 Apr 2008 05:49:55 GMT

So far, I’ve covered the following Hyper-V Remote Management scenarios: Workgroup: Vista client to remote

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Tony — Fri, 11 Apr 2008 09:38:37 GMT

I have the same problem as HiltonT above, where I open the WMI Control Properties Security Tab and expanding the "Root" node displays nothing. The "plus" sign button goes away and no child of "Root" ever appears.

All the steps leading up to that point were fine and I can connect via RDC and I can browse to the administrative shares in the file explorer. I just can;t seem to get any of the "root" children.

Any ideas?

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Sat, 12 Apr 2008 02:32:02 GMT

Ryan/Tony (Hilton - already sent you an email).

Can both of you email me using the link at the top. This is not something we can reproduce in house, so I'd like to understand a bit more about the configuration.

- Verification of domain vlient to domain server (same domain), or combination of workgroup/domain, or workgroup-workgroup (same workgroup)

- x86 vs x64 client

- Whether the client was RTM Vista then upgraded to SP1 or a "slipstream" install.

- SKU (Business/Enterprise/Ultimate)

- Whether UAC is enabled (Server and client)

- Whether user is a local administrator (Server and client)

- Whether windows firewall is turned off or on (server and client)

- Whether there's any additional software installed on server or client (eg Antivirus)

- If domain joined, whether there could be group policy being pushed down to the firewall settings

If the firewall is currently on, one suggestion from a colleage to also try:

>>Can you try add

>> %windir%\System32\wbem\unsecapp.exe

>> into Firewall.cpl to unlock the app.

>> Then reconnect in the UI, it should work.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Sat, 12 Apr 2008 02:33:54 GMT

George - did you reboot the server after applying the AZMan changes?

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

evan — Wed, 16 Apr 2008 03:14:42 GMT

Any update on nothing displayed below the root node? I also am running into this.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

evan — Wed, 16 Apr 2008 05:14:12 GMT

Since I also had the issue where only Root would show I just followed step 13 and applied it only to Root. Was able to get it working! Not sure of the security implication, but I'm running it all privately anyway. Thanks for the great info John. Figuring out a problem like this wouldn't t have been possible a few years back. You guys at Microsoft are doing a good job opening everything up.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Wed, 16 Apr 2008 05:27:24 GMT

Evan - thanks for the feedback :)

Glad you got it going. We're still investigating and can't currently repro the problem in-house but working with a couple of people who have given us some great information to work on. I'll post up more info when we have a workaround and understand the problem.

Cheers,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 25 Apr 2008 00:42:51 GMT

For those that cannot expand the "root" note, in Tony's case, this was resolved by not having followed the instructions on the Vista machine to enable anonymous logon remote access in DCOM Security (step 15 above).

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

peter — Sat, 26 Apr 2008 22:55:17 GMT

You might want to reoder the guide so step 15 is before step 13 if thats the fix to the empty root issue.

I followed step 15 and then the root wasn't empty but it also wouldn't expand so I just applied the right to the root as mentioned above.

Working great now thanks for the Guide!

Peter

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Lance Fisher — Wed, 14 May 2008 09:46:32 GMT

Thanks!!!!

I would also suggest putting step 15 before step 13 in your guide :)

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 16 May 2008 20:32:28 GMT

Peter/Lance - finally got a chance to update it.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Rob Prideaux — Thu, 05 Jun 2008 15:54:10 GMT

Christopher!

Then sacrifice a goat at the dark of the moon!!!

Your explanantions are tremendous John - but it is a tortuous process, is it not??? :)

Hyper-V Monitor Gadget for Windows Sidebar

Mindre.net — Sat, 21 Jun 2008 21:15:50 GMT

Hyper-V Monitor Gadget for Windows Sidebar

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Taylor H — Sun, 22 Jun 2008 04:27:59 GMT

I verified Windows Management Instrumentation (WMI) group is enabled:

--Inbound Rules--

Windows Management Instrumentation (ASync-In)

Windows Management Instrumentation (DCOM-In)

Windows Management Instrumentation (WMI-In)

--Outbound Rules--

Windows Management Instrumentation (WMI-Out)

Yet, I cannot connect with the Hyper-V Manager unless I disable the firewall on the Server Core Install.

What did I miss?

Part 4. Domain joined environment: Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

John Howard — Thu, 26 Jun 2008 00:48:51 GMT

So after even more feedback and questions, part 4 of this series provides the walkthrough steps necessary

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

AndrewL — Fri, 27 Jun 2008 00:20:52 GMT

This guide is worth its weight in Gold, If it were printed on paper 100 times. Thanks a lot.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Mads Nissen — Fri, 04 Jul 2008 15:57:19 GMT

Hi!

I also had the empty WMI root node issue. For me it was due to my clientmachine firewall settings. Had norton running and it didn't ask (as it usually do) about the ports beeing used for WMI. Turned it off and the wmi tree appeared.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Tom Lantz — Fri, 11 Jul 2008 17:58:53 GMT

Hi John! Thanks for the great information. I have a strange problem. I cannot connect to server running Hyper-V from my laptop running Vista SP1 but I can connect from other workstations running Vista SP1. Seem like the problem is on my machine but I am not sure where to look. Any thought would be helpful.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 11 Jul 2008 19:26:57 GMT

Tom - difficult to diagnose based on the info above. Do you want to email me using the link at the top with some more information on the specifics of the error you're hitting, maybe some ipconfig /all output from a working and non-working machine plus the server, a simple ping test, and info about what domain/workgroup each machine is in.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

PBaldwin — Wed, 16 Jul 2008 20:08:52 GMT

Hello John - Followed your guide but couldn't get the Hyper-V Manager to connect so went back to the beginning. I get to the WMI edits, attempt to add a user and rather than be prompted for username/password I get "The program cannot open the required dialog box because it cannot determine whether the computer named ... is joined to a domain". Press close and I get the "RPC Server Unavailable". It worked a few hours ago!

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Wed, 16 Jul 2008 22:08:19 GMT

@PBaldwin

In my experience, you typically see things like this due to time synchronisation in a domain not operating correctly. Is there a difference of more than a minute or so between the server core machine and the management client?

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

PBaldwin — Thu, 17 Jul 2008 12:46:39 GMT

Hi John - Nope, times were alright.

Tried "netsh firewall set service fileandprint enable": Humm, I'll review the hole this makes later, but it got by the WMI hurdle mentioned above.

Couldn't then add a user/group to WMI Security (just like you describe for AZMan) so edited the Authenticated User entry. Nope, still can't connect Hyper-V Manager to server (I'm still running as Administrator on client - same password on server).

So try "CMDKEY" as per your Part 5: The Hyper-V Manager springs to life with connection to server! Whipee! (And I can again add users to WMI Security and the "Local Users and Groups" snap-in is now functional as a bonus!).

Now I logon as my ordinary user on the client and again use CMDKEY. Damn, Hyper-V Manager doesn't give me the previous error box but instead says "the Virtual Machine Management service is not available".

Almost there: Any suggestions?

Thanks

Paul

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

PBaldwin — Thu, 17 Jul 2008 13:57:03 GMT

Update: In replacing the Authenticated User WMI Security entry with "Hyper-V Administrators" I'd neglected a tick for "enable account". I also found that my XML edits for AZMan had gone (don't think I should have renamed the server after editing it). BTW running CMDKEY didn't get me out of hand-editing this file!

On reboot everything is just rosey.

Don't know why I needed CMDKEY to make this work. Might help others struggling with this. But thanks for this article because there is no way I'd have got this far without it!

Paul

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Timbo — Sat, 19 Jul 2008 00:49:01 GMT

John - Thanks for the great guide.. never thought trying to setup a system without a domain would cause so much trouble.

I'm Having the same problem as GEORGE stated previously. Followed everything to the tee... and all worked as expected until attempting to run the New -> Virtual Machine... which yields an error "Loading Wizard Page Failed. You might not have permissions to perform this task"

You can move the pop-up away, but after you finish entering details it gives another error "The server encountered an error while configuring hard disk on <machinename>. You might not have the permission to perform this task.

Looking at the location it has created two folders "Virtual Machines" and "Snapshots", so it doesn't appear to be a disk permisisons issue. I was able to finish the Wizard without attaching a disk.

When trying to add a Hard Disk after the Virtual Server is "The Server encountered an error trying to create the virtual hard disk. You might not have permissions to perform this task".

So I got everything else but a disk? Any ideas.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Sat, 19 Jul 2008 00:55:06 GMT

Timbo - I'm pretty sure you'll see this error if you have older bits on the management computer. Are you sure you're running RTM bits on both server and client (950050 for server and 952627 for vista sp1 client).

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Tim — Sat, 19 Jul 2008 01:16:12 GMT

Hyper-V Manager Client: 6.0.6001.18004

Not sure how to tell on the server side.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Sat, 19 Jul 2008 01:23:49 GMT

Tim - 18004 is RC1 (IIRC). RTM release is 18016. Apply the KB articles I mentioned above to both sides, and the problem should go away.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Tim — Sat, 19 Jul 2008 02:10:53 GMT

John - Thanks Again, worked like a charm.

Just for others to note...

wmic qfe list {To get a list of installed Patches)

Wusa.exe Windows6.0-KB950050-x64.msu /quiet {To Install on core)

Cheers!

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Jason — Fri, 01 Aug 2008 02:45:55 GMT

Great Walthrough!! Thanks for the help. I couldn't connect after running through the tutorial, though. I configured server core with Automatic Updates and trusted it to install the latest update needed for Hyper-V. So I went through this tutorial thinking I was good-to-go. It took me almost a full day to find the problem. Save yourself some time and make sure you download the newest update (KB950050) and manually install it on the server!

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Derek Davis — Tue, 12 Aug 2008 17:54:41 GMT

Great Information, but I do have an issue getting to the WMI Permissions. When I use Computer Management MMC to attach to my Server Core machine, I navigate to the WMI Control and Right-Click on "Properties", I get

Failed to connect to \\servername because "WMI:Access Denied"

KB950050 is installed on Server Core, and 952627 for vista sp1 client installed on Vista 32 Bit.

The Vista Machine is running as a virtual PC on my laptop. Don't know if this could cause any craziness?

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 12 Aug 2008 19:58:17 GMT

Derek - have you enabled remote management on the server? It also depends if you are domain joined or in a workgroup. If you are workgroup, do you have matching usernames and passwords both sides?

There should be no issue running the remote management machine under Virtual PC.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Amir — Tue, 12 Aug 2008 20:59:38 GMT

John, Great detailed information and walk-through! Thank you for your time and sharing it.

However, I have not been able to connect and I am getting the same "WMI:Access Denied" issue as Derek mentioned above with the difference that I am running Vista on my physical laptop.

My laptop is joined to the domain of business coorporation and the Windows Server 2008 is part of a workgroup at my home. I have followed allthe steps to the letter. The Remote Server Administration Tools for the Hyper-V Tool is also enabled and the properly allowed through firewall extensions. I can Remote Desktop to the server just fine and as extra caution I have added the server IP address to my "hosts" file as well. when i try to connect to the server from Vista Hyper-V Manager, after few seconds, I get "the operation on computer '<the server IP address>' failed.

Any idea, what is missing?

Thanks,

Amir

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Derek Davis — Wed, 13 Aug 2008 23:33:53 GMT

john,

I joined my Vista machine (Actually a Vista Virtual SP1 PC on my laptop) to the domain and it worked. I can connect to the server fine now.

My question now is - When I installed a Virtual Server on top of the Server Core, it would not install the Network, nor the HID Miniport. (I assume this is the mouse).

I did not have Hyper-V slipstreamed when I installed 2K8 onto the virtual machine... so I am wondering if that might help? Or, is there a way to update the installation of 2K8 so that KB950050 is included. (Remember, there isn't a network installed on the VM)

Thanks!

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Thu, 14 Aug 2008 03:33:18 GMT

Thanks Derek for the update.

What you are seeing is by design and a result of the beta version of Hyper-V being present on the Windows Server 2008 media and the beta integration services which run in a VM including the drivers to support networking are not compatible with Hyper-V RTM. The easiest solution is simply to insert vmguest.iso into the virtual CD drive of the virtual machine by selecting Actions/Insert Integration Services setup disk in virtual machine connection, and running setup in the VM.

Alternately:

- Slipstream KB950050 into the media/WDS image (as you mention)

- Add a legacy network adapter which is supported in-box in Windows Server 2008 to allow you to get to download KB950050 (but remember to go back to a "synthetic" NIC afterwards for the performance gains)

- Have the update on an ISO using a third party tool - but in reality, as it's already present on vmguest.iso, a little redundant.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

wminkjan — Sun, 07 Sep 2008 15:12:29 GMT

Be aware of the fact that by default the user account on thews08 server will expire. When this happens you will get the "RPC service unavailable"error.

re: Part 3 - Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Donald Roy Airey — Thu, 09 Oct 2008 04:24:15 GMT

John,

Great post. I've got a strange error. I'm able to run Hyper-V Manager just fine when my laptop is connected to the same subnet as the Hyper-V host. But when I take my laptop out of the data center and try to connect in over the internet, I get the RPC Error. Everything else is the same. Any ideas why changing from a subnet to the Internet might cause it to choke?

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Greg Brail — Mon, 13 Oct 2008 23:20:08 GMT

Thanks so much for this blog -- I was rather shocked when, after installing Hyper-V Server 2008 on a little-used PC with no domain or anything, that there was no easy way to bring up a VM on it without going through all this! But the product looks good now that I can actually use it.

Anyway, after following these instructions, I was running in to a few problems:

-- Remote "Computer Management" works fine, but when I click on "Disk Management" the process blocks for a minute or two and displays an "RPC service unavailable" error

-- When right-clicking on the "WMI Control" part of "Computer Management" to set security policies, I was unable to expand the "Root" folder the way that the instructions described. Instead, the process blocked for a minute or two

-- Hyper-V Manager comes up fine and connects to the server, but after a minute or two it displays the "RPC service unavailable" message

These three problems are all the same -- the server cannot make callbacks to the management client using DCOM.

In my case, the root cause was that my firewall -- Windows OneCare -- was blocking all incoming traffic to port 135 (the RPC service "endpoint mapper" port).

Once I enabled incoming access to port 135, all these things worked fine.

I should point out that first of all, I have no domains anywhere, so things might work differently in that case. And second of all, port 135 has been associated with many seucurity holes over th years, so I told OneCare to only allow connections from my local subnet, which at least helps avoid some of them.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 17 Oct 2008 00:11:16 GMT

Donald - I would have to defer to WMI under-the-covers networking experts (and I assure you I am not - Hyper-V utilizes WMI rather than us dealing with WMI internals), but I believe this will probably be due to some firewalling or routing issue. WMI is not "firewall friendly". A workaround many people use in this situation is for a VPN or a Temrinal Server publishing the application. That is significantly more secure for Internet access.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

George — Sun, 19 Oct 2008 09:04:58 GMT

Microsoft is NOT ready for this solution. This is only sentence I can say.

Hyper-V .. clue on configuring

Microsoft Technologies in Daily Usage — Mon, 20 Oct 2008 21:28:25 GMT

Well guys ... kalo dah ada yang coba Hyper V ... let's disccuss this .. i was trying to install Hyper

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Dillon Griffiths — Wed, 22 Oct 2008 00:24:33 GMT

Any thoughts why I would get this error when following step 12:

C:\Users\administrator>net localgroup "Distributed COM Users" /add tpa01vh01\dillon

System error 1376 has occurred.

The specified local group does not exist.

Thank you!

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Wed, 22 Oct 2008 01:18:46 GMT

Dillon - is it possible that you're running on a non-English locale system (the group names are localized).

Can you save the following as group.vbs and run it using "cscript group.vbs" from a command prompt. That should list the actual localgroups on your machine.

Set cGroups = GetObject("WinNT://localhost")

cGroups.Filter = Array("group")

For Each oGroup In cGroups

wscript.echo oGroup.Name

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Nick Ou — Wed, 29 Oct 2008 11:51:04 GMT

John, Thank you very much. I did out of this issue per your walkthrough. I used the same account administrator both on the hyper-v server and hyper-v manager(remote management clinet). at step 14, i added the "authenticated user". after reboot the hyper-v server, hyper-v manger working. :) Thanks again!

Nick

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

David — Sat, 01 Nov 2008 20:00:53 GMT

Hello John,

I am having the same trouble as Dillon G. I am just running the Hyper-V Server 2008 on my system. So I have tried to run the "group.vbs" script but I am have some difficulity in creating the script on the system.

I run the command "net localgroup" and get the following...

C:\>net localgroup

Aliases for \\[MyServerName]

-----------------------------------

*Administrators

*Backup Operators

*Certificate Service DCOM Access

*Cryptographic Operators

*Distributed COM Users

*Event Log Readers

*Guests

*IIS_IUSRS

*Network Configuration Operators

*Performance Log Users

*Performance Monitor Users

*Power Users

*Print Operators

*Remote Desktop Users

*Replicator

*Users

The command completed successfully.

So I see the "*Distributed COM Users" group.

Any suggestions?

Thanks,

David

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 04 Nov 2008 19:31:57 GMT

David - I confess, I'm completely stumped. Do you get this for all groups and all users using net localgroup, or just the Distributed COM Users group?

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Adam — Wed, 05 Nov 2008 00:56:26 GMT

I had the same problem as Dillon and David, running the script showed that I indeed had the DCOM Users group, all I did to fix it was copy and paste the group from the net localgroup command into the command to add the user to the group and it worked fine - even though I could not see any notable difference between the command here, and the command I entered... Go figure...

Hyper-V Management Console on Vista x64

Geek Noise — Wed, 05 Nov 2008 02:34:09 GMT

Hyper-V Management Console on Vista x64

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Bryan Oser — Wed, 05 Nov 2008 05:17:15 GMT

Did all steps and I'm expriencing the same as David

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Martin — Wed, 05 Nov 2008 15:08:54 GMT

I got the same error when I tried to add my user to the "Distributed COM Users group". For me it was the quotation marks that messed it up. If I just copied the command and then pasted it in to the command prompt it wouldn't work, but when I typed the command it worked.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

ecscomp — Sat, 08 Nov 2008 02:31:00 GMT

John,

Question, more like questions; My Hyper-v server 2008 test scenario is on a workgroup with a vista client Remote Management. I have went most of the steps that I am able to perform. OKay! I am able to RDP the Hyper-v server, but not able to Hyper-V manage. I can ping the Vista RM computer from the Hyper-v server, but not able to ping the Hyper-v server from the Vista RM computer. My goal is to create 3 VM to play with EBS 2008, however is seems like I can't pass Vista RM to create and manage the VM machines.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 11 Nov 2008 06:30:10 GMT

ecscomp - this is most likely a DNS issue. Rather than ping (as the firewall will probably block you in a default installation), try an nslookup on each machine of the other machine. It must work both ways. If it doesnt' run an ipconfig /all on each machine and then add the IP address to \windows\system32\drivers\etc\hosts as a workaround to DNS to verify if that is indeed the cause.

Thanks,

John.

Configure Hyper-V Remote Management in seconds

John Howard - Hyper-V and virtualization blog — Sat, 15 Nov 2008 04:44:06 GMT

It has been a little quiet on the blog front, but sometimes, at least in this case, I hope I've come

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Elbaramouny — Mon, 17 Nov 2008 17:25:56 GMT

David's problem is due to double quote formate. Just remove them and retype them again in the shell

Configure Hyper-V Remote Management in seconds

HyperVoria — Tue, 18 Nov 2008 00:34:30 GMT

Announcing "HVRemote"...., a tool to "automagically" configure Hyper-V Remote Management

Hyper-V Remote Management Configuration Utility

Microsoft, su tecnología y yo — Tue, 18 Nov 2008 23:49:31 GMT

Hola Una herramienta imprescindible para configurar los servidores con Hyper-V para que se puedan administra

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

M.Salah — Sat, 22 Nov 2008 23:56:56 GMT

Dear Mr. Jhon

thank you very much

i tried your script, but i have the same error

"I verified Windows Management Instrumentation (WMI) group is enabled:

--Inbound Rules--

Windows Management Instrumentation (ASync-In)

Windows Management Instrumentation (DCOM-In)

Windows Management Instrumentation (WMI-In)

--Outbound Rules--

Windows Management Instrumentation (WMI-Out)

Yet, I cannot connect with the Hyper-V Manager unless I disable the firewall on the Server Core Install.

What did I miss?"

like Mr. taylor

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Sun, 23 Nov 2008 00:12:10 GMT

M.Salah

Please can you

- run hvremote /show on both the server and the client

- ipconfig /all on both the server and the client

- verify that a ping of the server from the client, and ping from the client to the server hits the correct address as shown in ipconfig /all

- Verify that the username and password you are using (if workgroup) is exactly the same on both sides.

- Verify that you did try restarting both client and server (with the firewall enabled)

- That you don't have any alternate firewall software installed either side (eg OneCare etc)

If you can post the results back, that will give me what I need to diagnose.

Thanks,

John.

How to resolve errors like "Cannot connect to the RPC service, make sure your RPC service is running" with Hyper-V Server and Hyper-V Manager

David Overton's Blog — Sun, 23 Nov 2008 04:45:12 GMT

In my last post on installing Hyper-V for my home setup I said I had a number of issues.  One was

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Maurizio — Wed, 26 Nov 2008 18:27:56 GMT

Solution for add user in "Distributed COM Users group" (STEP 12), type: net localgroup “Distributed COM Users” /add "jhoward-hp2\john". Bye!!!

How to resolve errors like "Cannot connect to the RPC service, make sure your RPC service is running" with Hyper-V Server and Hyper-V Manager

David Overton's Blog — Wed, 03 Dec 2008 04:04:30 GMT

In my last post on installing Hyper-V for my home setup I said I had a number of issues.  One was

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

TMcLeod — Thu, 04 Dec 2008 02:42:40 GMT

John,

Thanks for the effort in writing (and maintaining) this blog.

There is quite a bit of good information here. However, after following the directions exactly, I still cannot connect to Hyper-V Server 2008 from Vista SP1 in a workgroup without disabling the server firewall.

The process is failing at step 13, because I cannot connect to the Hyper-V Server with the Computer Managment mmc. The error popup says "Computer \\VT-HYPER-V cannot be managed. (null) 'Chose another computer' from the Action menu to manage a different computer." Oh, so helpful.

When I disable the firewall on the server, I can connect, albeit to only some of the management functions.

Following your instructions above, (to M. Salah) I have verified that both machines can ping each other at their correct (IP4) addresses and that the logon names and passwords are exactly the same. (It was necessary to use the hosts file on the client).

Here is the output from HVRemore /show on the client:

C:\Windows\system32>cscript \Users\Thomas\Desktop\HVRemote.wsf /show

Microsoft (R) Windows Script Host Version 5.7

Hyper-V Remote Management Configuration & Checkup Utility

John Howard, Microsoft Corporation.

http://blogs.technet.com/jhoward

Version 0.3 20th Nov 2008

INFO: Computername is DEV-PRECM70

INFO: Computer is in workgroup WORKGROUP

INFO: Current user is Dev-PrecM70\Thomas

INFO: Assuming /mode:client as the Hyper-V role is not installed

-------------------------------------------------------------------------------

DACL for COM Security Access Permissions

-------------------------------------------------------------------------------

\Everyone (S-1-1-0)

Allow: LocalLaunch RemoteLaunch (7)

BUILTIN\Performance Log Users (S-1-5-32-559)

Allow: LocalLaunch RemoteLaunch (7)

BUILTIN\Distributed COM Users (S-1-5-32-562)

Allow: LocalLaunch RemoteLaunch (7)

NT AUTHORITY\ANONYMOUS LOGON (S-1-5-7)

Allow: LocalLaunch RemoteLaunch (7)

-------------------------------------------------------------------------------

ANONYMOUS LOGON Machine DCOM Access

-------------------------------------------------------------------------------

WARN: ANONYMOUS LOGON does have remote access

This setting should only be enabled if required as security on this

machine has been lowered. It is needed if you need to manage Hyper-V

on a remote server which is either in an an untrusted domain from this

machine, or both machines are in a workgroup.

Use hvremote /Mode:Client /AnonDCOM:Revoke to turn off

-------------------------------------------------------------------------------

Firewall Settings for Hyper-V Management Clients

-------------------------------------------------------------------------------

Private Firewall Profile is active

Enabled: Hyper-V Management Clients - WMI (Async-In)

Enabled: Hyper-V Management Clients - WMI (TCP-Out)

Enabled: Hyper-V Management Clients - WMI (TCP-In)

Enabled: Hyper-V Management Clients - WMI (DCOM-In)

-------------------------------------------------------------------------------

Windows Firewall exception rule(s) for mmc.exe

-------------------------------------------------------------------------------

Private Firewall Profile is active

Enabled: Microsoft Management Console (UDP)

Enabled: Microsoft Management Console (TCP)

INFO: Are running the latest version

and on the server with the firewall enabled:

Microsoft (R) Windows Script Host Version 5.7

Hyper-V Remote Management Configuration & Checkup Utility

John Howard, Microsoft Corporation.

http://blogs.technet.com/jhoward

Version 0.3 20th Nov 2008

INFO: Computername is VT-HYPER-V

INFO: Computer is in workgroup WORKGROUP

INFO: Current user is VT-HYPER-V\Administrator

INFO: Assuming /mode:server as the role is installed

INFO: This machine has the Hyper-V (v1) QFE installed (KB950050)

-------------------------------------------------------------------------------

DACL for WMI Namespace root\cimv2

Required for Hyper-V remote mangement: Allow, EnabAct, RemEnab, InheritAce

HVRemote also sets NoPropInheritAce and ValidInheritFlags

-------------------------------------------------------------------------------

BUILTIN\Administrators (S-1-5-32-544)

Allow: Exec FullWrt PartWrt ProvWrt EnabAct RemEnab RdSec EdSec (393279)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\NETWORK SERVICE (S-1-5-20)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\LOCAL SERVICE (S-1-5-19)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\Authenticated Users (S-1-5-11)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

-------------------------------------------------------------------------------

DACL for WMI Namespace root\virtualization

Required for Hyper-V remote mangement: Allow, EnabAct, RemEnab, InheritAce

HVRemote also sets NoPropInheritAce and ValidInheritFlags

-------------------------------------------------------------------------------

BUILTIN\Administrators (S-1-5-32-544)

Allow: Exec FullWrt PartWrt ProvWrt EnabAct RemEnab RdSec EdSec (393279)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\NETWORK SERVICE (S-1-5-20)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\LOCAL SERVICE (S-1-5-19)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

NT AUTHORITY\Authenticated Users (S-1-5-11)

Allow: Exec ProvWrt EnabAct (19)

Flags: InheritAce InheritedAce ValidInheritFlags (18)

-------------------------------------------------------------------------------

Contents of Authorization Store Policy

-------------------------------------------------------------------------------

Hyper-V Registry configuration:

- Store: msxml://C:\ProgramData\Microsoft\Windows\Hyper-V\InitialStore.xml

- Service Application: Hyper-V services

Application Name: Hyper-V services

Operation Count: 33

100 - Read Service Configuration

105 - Reconfigure Service

200 - Create Virtual Switch

205 - Delete Virtual Switch

210 - Create Virtual Switch Port

215 - Delete Virtual Switch Port

220 - Connect Virtual Switch Port

225 - Disconnect Virtual Switch Port

230 - Create Internal Ethernet Port

235 - Delete Internal Ethernet Port

240 - Bind External Ethernet Port

245 - Unbind External Ethernet Port

250 - Change VLAN Configuration on Port

255 - Modify Switch Settings

260 - Modify Switch Port Settings

265 - View Switches

270 - View Switch Ports

275 - View External Ethernet Ports

280 - View Internal Ethernet Ports

285 - View VLAN Settings

290 - View LAN Endpoints

295 - View Virtual Switch Management Service

300 - Create Virtual Machine

305 - Delete Virtual Machine

310 - Change Virtual Machine Authorization Scope

315 - Start Virtual Machine

320 - Stop Virtual Machine

325 - Pause and Restart Virtual Machine

330 - Reconfigure Virtual Machine

335 - View Virtual Machine Configuration

340 - Allow Input to Virtual Machine

345 - Allow Output from Virtual Machine

350 - Modify Internal Ethernet Port

1 role assignment(s) were located

Role Assignment 'Administrator' (Targetted Role Assignment)

- All Hyper-V operations are selected

- There are 1 member(s) for this role assignment

- BUILTIN\Administrators (S-1-5-32-544)

-------------------------------------------------------------------------------

Contents of Group Distributed COM Users

-------------------------------------------------------------------------------

1 member(s) are in Distributed COM Users

- VT-HYPER-V\Thomas

-------------------------------------------------------------------------------

DACL for COM Security Launch and Activation Permissions

-------------------------------------------------------------------------------

BUILTIN\Administrators (S-1-5-32-544)

Allow: LocalLaunch RemoteLaunch LocalActivation RemoteActivation (31)

\Everyone (S-1-1-0)

Allow: LocalLaunch LocalActivation (11)

BUILTIN\Distributed COM Users (S-1-5-32-562)

Allow: LocalLaunch RemoteLaunch LocalActivation RemoteActivation (31)

BUILTIN\Performance Log Users (S-1-5-32-559)

Allow: LocalLaunch RemoteLaunch LocalActivation RemoteActivation (31)

-------------------------------------------------------------------------------

Firewall Settings for Hyper-V

-------------------------------------------------------------------------------

Public Firewall Profile is active

Enabled: Hyper-V (SPL-TCP-In)

Enabled: Hyper-V (RPC)

Enabled: Hyper-V (RPC-EPMAP)

Enabled: Hyper-V - WMI (Async-In)

Enabled: Hyper-V - WMI (TCP-Out)

Enabled: Hyper-V - WMI (TCP-In)

Enabled: Hyper-V - WMI (DCOM-In)

-------------------------------------------------------------------------------

Firewall Settings for Windows Management Instrumentation (WMI)

-------------------------------------------------------------------------------

Public Firewall Profile is active

Enabled: Windows Management Instrumentation (ASync-In)

Enabled: Windows Management Instrumentation (WMI-Out)

Enabled: Windows Management Instrumentation (WMI-In)

Enabled: Windows Management Instrumentation (DCOM-In)

Note: Above firewall settings are not required for Hyper-V Remote Management

INFO: Are running the latest version

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Thu, 04 Dec 2008 04:39:49 GMT

Thomas

On the server, run hvremote /add:thomas

As you are in a workgroup, on the client, run hvremote /anondcom:grant

Reboot both boxes (to be sure - it may work, but just in case) and you should be good to go.

You've checked the passwords are the same, great. Only other thing you should check is pinging by name rather than IP does indeed hit the other box, in both directions. I guess you have done that already though as you mention about editing the hosts file.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

TMcLeod — Fri, 05 Dec 2008 18:14:14 GMT

John,

Thanks for the feedback.

Some of us do configuration manually where we can, so that we have an understanding of the process for future reference. That's why I was attempting to follow your manual instructions.

For all those who are doing the same and are unable to connect with Computer Mangement (step 13, above) to a remote Hyper-V Server 2008, you need to know that Remote Administration is blocked by the firewall on Hyper-V Server 2008 by default. To fix, execute the following on command line on the Hyper-V Server 2008:

Netsh advfirewall firewall set rule group=“remote administration” new enable=yes

For more info see:

http://blogs.technet.com/server_core/archive/2008/01/02/configuring-the-firewall-on-server-core-for-remote-management.aspx

Thomas

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 09 Dec 2008 03:46:12 GMT

Hi Thomas

My apologies. Was giving a "lazy" answer :)

BTW - I did cover this in http://blogs.technet.com/jhoward/archive/2008/03/29/how-to-add-the-hyper-v-role-to-a-windows-server-2008-server-core-machine.aspx and it was also mentioned right at the top of this article:

<< Before going any further, make sure you have followed the steps in my previous post to enable the Hyper-V role on server core and enable remote management. Remote management is important for this walkthrough - you'll need it to complete the steps. >>

Thanks,

John.

Outils pour Hyper-V

pascals.blog — Mon, 29 Dec 2008 12:50:47 GMT

Aujourd'hui deux outils pour Hyper-V. Pas tout neufs, mais extrêmement utiles. Le premier vous servira

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Eric — Tue, 13 Jan 2009 04:23:50 GMT

Client: Vista 64bit sp1

server: 2008 core - hyper-v

Followed your notes...after launching computer management I was not able to manage the 2008 core/hyper-v server. It looked like a problem with WMI..

This left me stuck at step 12/13

Looking around the -net I found instructions to disable all firewall functions on the 2008 core server. As soon as I did that I could run the 'computer management' and the hyper-v MMC functions.

After going through your notes numerous times..either I'm missing something obvious or it's a 64Bit issue?

Thoughts?

Many thanks for your instructions, notes and willingness to work to improve all of our lives!

later,

eric

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

eric — Tue, 13 Jan 2009 04:29:52 GMT

Sorry! I missed the post from December 5, 2008 about the extra blog.

amazing how we ask a question and then immediately find the answer...

Thanks,

eric

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Roger Lipscombe — Mon, 26 Jan 2009 22:37:14 GMT

On the "You may not browse the local file system when connecting to a remote Hyper-V server." error (although I get "browse the local file system when connecting to a remote Hyper-V server."):

I suspect that it's because the browser remembers which directory you last browsed to. I removed that directory, so it failed. But it couldn't figure out what actually happened, so it gave me this error. Twice.

If you type directly into the edit box, the autocomplete works fine, so it's definitely talking to the remote filesystem.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

David — Thu, 29 Jan 2009 00:37:39 GMT

Can you tell me how to proceed from Step 14 on a Hyper-V Server 2008 stand-alone box? How do I access the authorization manager? Also, I can remote into and even connect to computer in computer management from my Windows 2008 Enterprise Server box to my Hyper-V stand-alone box but when I ping the IP address from either side I never get a response and it always times out. Is that going to be a problem when I try to remote into Hyper-V standalone using Hyper-V Manager on my 2008 Enterprise box?

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Thu, 29 Jan 2009 06:16:51 GMT

David - stand alone being workgroup, not domain. Correct? If so, unless you really feel the need to follow the steps manually, I would very strongly recommend you use HVRemote to complete the configuration. Of course though, I'll assist if you want to go the long route (especially in workgroup).

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

dock-levy — Sat, 31 Jan 2009 23:18:51 GMT

hey john

first thank u for this article... helped me a lot!.

i have a lenovo 3000 with intel T7250 (has intel VT)

my bios for some reason does not have Enable VT option.

when i use vista and virtual pc it recognize the VT and use it... but Win2K8 Hyper V does not for some reason...

can i use the registry to enable??

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Wed, 04 Feb 2009 08:08:47 GMT

dock-levy - you would need to contact Lenovo/IBM to verify. I don't have one of those machines available. Have you checked you do have the latest BIOS on your machine? There is no registry setting - this is under control of the OEM. If VPC can recognize it, it will be turned on though - can't think of any reason why not. Anything in the Hypervisor or system event logs when you attempt to start a virtual machine under Hyper-V? What about DEP? Could that be the cause and it isn't correctly set in the BIOS?

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

William Powley — Thu, 12 Feb 2009 20:21:37 GMT

John,

Everything in the manual process worked great.

Vista x64 SP1 -> Windows 2008 Server Core

After 3 days of searching various sites, your's covered all the areas I needed to fill in.

Cheers!

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Peter Klavins — Sun, 15 Feb 2009 22:12:30 GMT

Can the "RPC problem" be related to netbios not knowing the hostname? I was setting up a 2008 Core server from a 2008 Full client, and since the 2008 Full client never resolved the server name to the IP address, I was always using the IP address whenever specifying the server in your instructions. I gave up yesterday with Hyper-V Manager on the client only once out of many attempts succeeding in connecting to the server, but then showing an RPC error in the "Virtual Machines" central panel. Today, I succumbed and entered the server/ip equivalence into etc/hosts, and, cross fingers, so far Hyper-V Manager is working. The reason I hadn't done this before is that both the client and the server are on a home DHCP network. Can your instructions include setting up the server turning on netbios broadcast (or whatever it's called :-)) so the client computer can resolve it? There is also something wrong with HVRemote.wsf if running on a 2008 Full client, it tells me I need to install KB952627 when in fact this is not available for 2008.

Despite these problems, thanks for your web pages and tool, without them I would be far worse off!

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Mon, 16 Feb 2009 06:31:28 GMT

Peter - Hyper-V manager and the server components use IP, not NetBIOS. DNS has to be right for it to work. Yes, there is a problem with 0.5 HVRemote if you run it on a 2K8 box which only has the management components. Take a look at the response to Patrick in the HVRemote thread: http://blogs.technet.com/jhoward/archive/2008/11/14/configure-hyper-v-remote-management-in-seconds.aspx. That will give you a workaround for now. Working on a fix (I have it ready, but not quite ready to publish).

Thanks,

JOhn.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

stu — Fri, 20 Feb 2009 04:52:39 GMT

hey john,

fantastic work on the core post - youre a life saver! i think youre covered it in a consequent blog post but i found that kb950050 is absolutely necessary on the hyper-v boxes in order to use remote management tools elsewhere.

just need to find a way to get the remote disk and device management tools up and running now :)

cheers,

-stu

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 20 Feb 2009 06:46:57 GMT

Stu - thanks. Yes, you're correct, RTM is required (I believe if memory serves correctly we fixed it in RC0, but beta - ie on the Windows Server 2008 RTM media - does not work). Unfortunately, I'm 99% certain that in Windows Server 2008, neither of those management tools work remotely. Devcon.exe and diskpart are your friends....

Cheers,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

stu — Wed, 25 Feb 2009 19:45:36 GMT

im working with the release by the way and still found the kb was required, even with the firewalls disabled.

i manged to get disk management working correctly. you need to modify a gpo to allow remote pnp connectivity. alas im working on machines in a workgroup for security reasons and so had to apply a hard registry hack:

reg add hklm\software\policies\microsoft\windows\deviceinstall\settings /v AllowRemoteRPC /t reg_dword /d 0x1 /f

same difference really. im having a hell of a time working out all of the different server and client side windows firewall changes that need to be applied just to allow snapin access. i guess i'll be knocking up some internal IP for that at some stage ... unless of course you happen to know whether MS have a handy reference guide? :)

-stu

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

stu — Wed, 25 Feb 2009 20:24:45 GMT

hi again,

working back through my build guide doc im getting stuck on step 13 unless i disable the firewall completely on the remote server. ive run through it a second time and its just not happening. fwiw the fw policy updates im applying server side are the following:

netsh advfirewall firewall set rule group="Remote Administration" new enable=yes

netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes

netsh advfirewall firewall set rule group="Remote Volume Management" new enable=yes

netsh advfirewall firewall set rule group="Windows Firewall Remote Management" new enable=yes

netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

netsh advfirewall firewall set rule group="Windows Remote Management" new enable=yes

client side the firewall is enabled but a i say the issue only occurs when the firewall is activated on the server. i noted some feedback you made above and so applied the following to the server also:

netsh firewall add allowedprogram program=%windir%\System32\wbem\unsecapp.exe name="WMI Control Component"

alas that hasnt helped and ive removed it.

obviously i can proceed with a couple of extra steps (disable fw .... run through step 13 ... enable fw) but that wont be possible with a production machine so it would be good to understand how to avoid this.

cheers,

-stu

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

stu — Thu, 26 Feb 2009 19:32:26 GMT

just an fyi - i checked the isos i was provided and sure enough it wasnt the final release of windows! guess that explains it!

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

stu — Thu, 12 Mar 2009 22:57:54 GMT

ok, ive rebuilt all over again with two clients - one with the firewall enabled (as defined in my earlier post) and one without.

with the firewall enabled i recieve rpc errors and can confirm that tcp/135 is definitely open (as per greg brails post) on both.

in addition when the server has its firewall enabled i cant connect at all from either server. its all very odd! every box is only in a workgroup and this issue occurs both for local admins and for local users accounts configrued in the steps youve defined.

is there any way of identifying the gap?

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Mon, 16 Mar 2009 19:37:23 GMT

Stu - hvremote reveals all. Honestly, it's the best way to understand what is and what isn't configured. Output of hvremote /show on both the client and the server, plus a ping attempt in each direction will give 99% of everything needed for diagnosis.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Paul Kayadoe — Fri, 10 Apr 2009 01:31:31 GMT

Hi john,

Thank you for you efford, it helped me a lot.

My problem was that the manager could not connect.

I tried all of the above, the one thing that helped was turn off the firewall on the core.

After I did all you sugested.

Ill figure out later what when wrong.

Does the manger run on Windows 7, cause it crashed ;)

Could be because of all the fiddeling.

10x man, keep it up, its blogs like this that make IT work. ;)

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 10 Apr 2009 02:54:12 GMT

Paul - you really do not need to turn off the firewall to make Hyper-V remote management work, and I strongly recommend you do not take that approach. The output from hvremote /show on both server and client would go a long way to diagnosing a problem.

For Win7, it depends which build of Win7 you are using. Sure, there are some bugs in build 7000 (beta), but it should work. If you can clarify which build you are running, what you are doing when it crashes and get that hvremote /show output, I could take a look.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Paul Kayadoe — Tue, 21 Apr 2009 16:34:07 GMT

Hi John,

I've been very busy on other projects, and could not respond sooner.

I’m running Windows 7 Build 7077, on virtual PC, on a local machine.

And 2008 Core (on a server platform).

I have solved most of my problems, reading up on you web site.

One of them, I could connect to the core via the manager but got "RPC server connection error", with the firewall off.

I could connect and do things but no VHD's showed up after I created them.

Then I read that WMI could not pass NAT, I thought, hmm I’m not using NAT right so...

When back to square 1 and rechecked everything.

Including the Virtual pc, and guess what it was running thru NAT on the network adapter, called myself a dumbass, changed it and like magic all works great.

So now I’m going to reinstall everything and do it all over again, this time the proper way.

With all firewalls in place.

Move it from the lab to the test environment and see what’s what.

About the manager crashing, I have not fully looked in to it yet, but is comes right after the RPC connection error, it’s there, don’t have it any more since I can connect properly now ;)

Could be because of the virtual environment but I'm not sure, MMC plugins are sometimes unloading slowly to but not crashing.

I do have Two question thou,

Question one: I’m running Core, HD SCSI optimizers/drivers and such on my current servers.

All ready tried a core optimizer, and it installed ok, no errors during boot and such.

Would it be advised to run this on the Core?

Question two: Do you have any information on running a DC on the core?

All ready found some stuff about high availability, but do you have any other "must" read info on this?

Well that’s it; I’ll be picking up this project again soon.

I like it :)

Thank you for taking the time and maintaining this site.

Best regards

Paul Kayadoe.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 21 Apr 2009 21:53:08 GMT

Paul - Glad you got it working.

For 1) I don't have a good answer - in a general sense, I would recommend you don't run anything but the Hyper-V role itself on the parent partition. However, not knowing what you're referring to about the HD SCSI optimizer, if it's a necessary OEM supplied driver for accessing the local DAS, then obviuosly you need it. But I suspect it's more than that - do you actually see a perf gain using it on other servers? Is it essentially doing a background defrag or something?

For question two - I assume you are referring to running a DC inside a virtual machine. For the same reason as for one, I would not recommend running any other workload on the parent partition except for Hyper-V itself. You should certainly read http://support.microsoft.com/kb/888794 for some guidance.

Thanks,

John.

Windows 7 Release Candidate gets new features

Windows 7 Release Candidate gets new features — Mon, 27 Apr 2009 04:38:55 GMT

Esta build (7100. 0. winmain_ win7rc. 090421- 1700) foi compilada na passada Terça- Feira e ao que parece já começou a ser distribuída a parceiros OEM.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Simone Meggiato — Fri, 10 Jul 2009 16:51:05 GMT

Hi John,

I have a WORKGROUP Hyper-V (English) server and a WORKGROUP Vista Client (Italian).

I followed your instruction but I cannot connect the Hyper-V console to the server (it says that it can not connect to the RPC service) except when I disable the firewall on the server side. Disabling the firewall on the server, the client connects fine.

Using /show with HVRemote confirms that all firewall rules for Hyper-V and WMI are enabled.

Any idea?

Thank you,

Simone

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Fri, 10 Jul 2009 18:25:38 GMT

Simone - can you post up the output of hvremote /show on both boxes, plus the output of a "ping -4 otherboxname" to try to diagnose.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Antony Jordan — Wed, 29 Jul 2009 07:04:41 GMT

I keep getting stuck at step 13, and cannot get any further.

When i right click on WMI Control/properties/security there is nothing in the box at all, not even root

In the general tab i get "Failed to connect to \\WT-HYPERV because "Win32 Access is denied."

I have no idea how to get arround this, I've been sitting here for 4 hours tying to get this thing to work.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 04 Aug 2009 00:31:54 GMT

Anthony - are you sure you followed step 2B in part 1, and noticed I updated the above post for 12B immediately before step 13.

That all said, I really strongly recommend that unless you have a need to perform the steps manually, the use of hvremote will save you a lot of pain.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Toby Groves — Sun, 16 Aug 2009 23:34:17 GMT

Hi,

Having a major problem getting this working and wonder if you can help. Basically I have a Hyper-V Server installed from a fresh ISO download taken yesterday and have allowed it to patch itself up via Windows Update.

Connecting to this is a Win7 RC (7100) box, logged in with a duplicate username/pass.

Have run all the script commands according to the 10-second guide and, whilst I can administer pretty much everything on the server, such as services, event logs, users, groups & disk management, trying to access Hyper-V blocks for 5-10 secs with "Connecting to Virtual Machine Management service...", then fails with the message "You might not have permission to perform this task".

Now I've noted that this message is subtly different to the usual "you do not have required permission to complete this task" so I'm not quite sure what's going on. What could prevent the Hyper-V manager from connecting to the VMM service when all other administrative functions are working fine?

The /show command with your script gives no issues at either end and I've tried completely disabling both firewalls (it's just a test setup anyway so no great problem with that) but to no avail.

I've even read through some of your old "pre-script" guides to check that elements such as the authorization manager are configured correctly and they appear to be.

At a total loss here, any advice appreciated :)

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 18 Aug 2009 20:31:26 GMT

Toby - HVRemote only deals with Hyper-V management, not other administrative capabilities such as the ones you list. The best way to diagnose is if you run the latest (0.7) version of hvremote with the /target:otherboxname parameter on both boxes (client and server) to diagnose.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Michael Price — Tue, 20 Oct 2009 11:28:46 GMT

Been through the script. still get make sure virtual management service is running. must have been the fine printI I missed.

can rdp and everything else except hyper v console on windws 7. all features enabled.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Felipe — Mon, 02 Nov 2009 05:38:00 GMT

John,

I wanted to thank you. Having used the other popular Hypervisor software for some time, I decided to see how things were in the Microsoft pond in regards to Hyper-V.

After reading up a good deal on configuring Server Core, I decided that I would give Hyper-V a shot running on Windows Core.

Knowing the task at hand would prove to be a learning experience I kept an open mind (and an open browser!).

After struggling with Server Manager and Disk management - still not resolved - I fired up the Hyper-V console and tried to connect to my Server. I was exasperated to see the "You are no authorized" message.

After a couple minutes of poking around I Bing'd the problem and found your site.

I read a little more and downloaded your script. Within minutes I was installing my first VM on Hyper-V.

Thank you so much for going above and beyond to help the Hyper-V community with your script.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 24 Nov 2009 16:24:04 GMT

Michael - can you post the full output of hvremote /show /target:othercomputername from both boxes. Also info of whether you have firewalls/routers between the client and server, or whether there is any 3rd party AV or firewall software installed on either box.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Ralph Hendriks — Thu, 26 Nov 2009 10:40:44 GMT

John,

Thanks for all your hard work! I thought I would share my issues along the way, maybe it'll help someone.

I used two boxes, one Vista SP2 (client) and one Hyper-V Server 2008. Both are configured as being in a workgroup.

After running your 10s I still had to do following:

- run updates 941314, 952627, 970203 on the client

- update the Hosts file on both sides

- enable my Onecare firewall on the client to allow inbound traffic on port 135. (Thanks to Greg, this was one of those 'd*mn, I knew that!' problems.)

As I'm configuring this network for home and small office, I'd appreciate your take on this: I'd like to run a domain controller VM that also does DHCP, DNS and perhaps some filesharing for my network. Obviously I would love to add all boxes to the domain, including the Hyper-V server. Is this wise? (I had previously thought - because my AD would be extremely empty - that I'd be able to run it on the Hyper-V Server itself, but saw you advise against this..) Thanks in advance.

Regards,

Ralph.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Mon, 30 Nov 2009 19:49:13 GMT

Ralph - Unless you have a seperate DC physically somewhere, you run into the chicken and egg problem. I would strongly recommend that you do not only run a single virtual DC on a Hyper-V machine and have the Hyper-V machine itself joined to that domain. While it technically can be done (with some caveats), it is not a supported scenario.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Wesley — Tue, 01 Dec 2009 15:29:10 GMT

Hey John, this is a great article but I am stuck. I have a dev Hyper-V box that was unplugged from the domain and shipped to me without being removed from the domain. Now it is in my Dev lab with no connectivity to the domain. When I try to add the account from my lab workgroup to the DCOM Users I get a "The trust relationship between this workstation and the primary domain failed."

How do I get around this?

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

jhoward — Tue, 01 Dec 2009 18:51:27 GMT

Wesley

You should be able to log on with a cached domain account, or a local administrator to remove the box from the domain. They you just treat it as a workgroup to workgroup scenario. Alternately, create a matching local account on the domain joined server to the account on the client, passwords matching. Then again it should still be WG to WG configuration without any need for the server to contact the domain.

Thanks,

John.

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

mogyi — Mon, 07 Dec 2009 16:20:48 GMT

I'm in the finish line, and the last step is driving me crazy.

I was trying to edit InitialStore.xml at the server (Win2008 R2) by invoking notepad in an administrator level command prompt.

When I'm trying to save the updated file it says : "Access denied!"

This message is the true symbolic meaning to Microsoft's virtualization strategy. "It's free but You can't use it."

I spent so much time to get this working, that I wont stop near the finish line. Using Win2008 R2 Hyper-V and Vista SP2.

Your script warns about "Cannot connect to root\cimv2 on server"

Thanks for hvremote.wsf !

Istvan

re: Part 3 - Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Steve — Tue, 08 Dec 2009 19:18:00 GMT

great work but why is it so difficult to remote manage a Hyper V server. The time I have spent messing around trying to get this working is a bit of a joke. Both Microsofts main rivals have a product that instals and is manageable without any fuss ? please please sort this out