PingBack from http://blogs.technet.com/jhoward/archive/2008/03/28/part-1-hyper-v-remote-management-you-do-not-have-the-requested-permission-to-complete-this-task-contact-the-administrator-of-the-authorization-policy-for-the-computer-computername.aspx

Josh,

Great tool.  

I've been playing around with Hyper-V Server 2008 in a workgroup configuration for over a week now, and I can not figure out, for the life of me, how to configure 'Local Security Policies', including User Rights!!!   When I launch a Group Policy Object Editor MMC remotely, it provides access to the Administrative Templates, etc, but not no local policies.

Now, the reason I need access to local policies in the first place is that I'm trying to figure out how to configure Hyper-V to run under a different user-account (...other than local system).  The reason being is that I have several NAS devices on my network setup with SMB shares, hosting all of the necessary ISOs for use with Hyper-V.  Rather than having to copy them all locally over to the Hyper-V Server, I want to be able to mount ISOs from the SMB shares on the NAS devices from all of my VMs.  I figure by creating an identical user account on the NAS devices to the one which the Hyper-V service(s) run as, this should provide an nice solution to my problem.

As of now, I've created a user called 'HyperVService', and added the user to the Administrators, and Remote Com Users security groups; however, when I attempt to start Hyper-V Machine Management service using this account, it errors out, claiming that the account lacks privileges.  ha.... Unfortunately, I can't being assigning rights to the account using security policy until I can somehow gain access to it.   As a side note, I've already granted the 'HyperVService' user all authorization rights / privileges in Authorization Manager (as specified in your article).

I apologize for the extent of this comment, but if you can help in any way, it would be much appreciated.

Josh,

Great tool.  

I've been playing around with Hyper-V Server 2008 in a workgroup configuration for over a week now, and I can not figure out, for the life of me, how to configure 'Local Security Policies', including User Rights!!!   When I launch a Group Policy Object Editor MMC remotely, it provides access to the Administrative Templates, etc, but not no local policies.

Now, the reason I need access to local policies in the first place is that I'm trying to figure out how to configure Hyper-V to run under a different user-account (...other than local system).  The reason being is that I have several NAS devices on my network setup with SMB shares, hosting all of the necessary ISOs for use with Hyper-V.  Rather than having to copy them all locally over to the Hyper-V Server, I want to be able to mount ISOs from the SMB shares on the NAS devices from all of my VMs.  I figure by creating an identical user account on the NAS devices to the one which the Hyper-V service(s) run as, this should provide an nice solution to my problem.

As of now, I've created a user called 'HyperVService', and added the user to the Administrators, and Remote Com Users security groups; however, when I attempt to start Hyper-V Machine Management service using this account, it errors out, claiming that the account lacks privileges.  ha.... Unfortunately, I can't being assigning rights to the account using security policy until I can somehow gain access to it.   As a side note, I've already granted the 'HyperVService' user all authorization rights / privileges in Authorization Manager (as specified in your article).

I apologize for the extent of this comment, but if you can help in any way, it would be much appreciated.

Hyper-V How to: Configure Hyper-V Remote Management in seconds John's blog post describes his HVRemote

I appreciate such a quick response.   I searched TechNet forums, and someone was able to get it to work... ...unfortunately they did not leave enough detail in the post.  Also, their installation was a full-install of 2K8, not Core, so they had direct access to local security policy for assigning account rights.  Either way, until Microsoft officially addresses this issue in a supported manner, I'm not going to attempt an unsupported work-around in any sort of production environment, so I guess there is no point looking into this further.

On that note, what about local user rights... ...as in editing local policy on Server Core or Hyper-V Server in a workgroup environment?  Does Microsoft provide a supported method for editing these policies?  

Thanks again.

Hi John,

You mentioned that your tool should not be used if Virtual Machine Manager 2008 is used for managing Hyper-V hosts. It does not explain why. Can you elaborate on that?

Thankx,

Hans Vredevoort

Thanks John,

That's the explanation I was looking for. As a VMM2008 user, I would appreciate a check on this as azman stores might get mixed up. I appreciate your work as I have tried all the steps in your blog and know how easy it was to forget one step, make a spelling error or some other mistake. So now you have a nice and clean solution for remote Hyper-V management from Vista an Windows Server 2008 computers.

Hey John,

I had already seen both of those links.  Unfortunately, neither work.  Enabling PnP interface is great for enabling Remote Disk Management, but I'm not sure what it has to do with being able to edit local policy.  I think another user points that out on the response to the post.

As for secedit, it doesn't work... ...at least not for me.  Another user on the forum had the same experience as I did... ...secedit command seems to function as expected, but no real result / policy change.   Plus, this is so inconvenient, especially when you need to enable / disable a policy one at a time while testing something until you get it to work.  Using this method, I would have to export / import a policy again and again if attempting to troubleshoot some form of security issue or rights management issue.  True, I could set up another machine using a full version of Windows 2008, but editing local policy shouldn't be as complicated as requiring multiple 2K8 servers.  What about small businesses, or other users that either cannot afford a second license, or do not have a second server / machine available to install Win2K8 Full?   lol... Does Microsoft even think of these things when releasing their products?  

Anyway, as always, I sincerely appreciated the quick responses, feedback, and solutions.

I know this is a little bit off topic, but I wanted to address one other issue that no TechNet forum and / or deployment guide has seemed to address... ...best practices for storage on the host hypervisor server.   I currently have set my host server to store VHD files of the VMs on separate physical RAID arrays, snapshots on another dedicated physical RAID array (snapshots for all machines stored on a single dedicated array), and VM configuration files on the system / OS array.  However, I've noticed that the system / OS array gets hammered, and impacts the VM system performance.  Originally, I was under the assumption that once the XML files were loaded into memory, the configuration file was no longer needed / used by the system.  Obviously, my assumption was ignorant and now I'm paying for it.   Basically, my question is:  Where should VM configuration files / data be stored in relation to VHD files?  Should they be stored together?  Should I create a separate dedicated RAID10 array for configuration files (for all machines), or does each VM require a dedicated disk per VM configuration file?  There doesn't seem to be any "best practices" guide that addresses any of these questions (other than the recommendation to stored VHDs on separate disks).

Thanks in advance.

Hi John,

Execellent post, tool, etc.  your orginal post helped me a great deal connecting to a server core install I'd setup earlier in the year from a WS2008 laptop... remote mgmt worked a treat until I rebuilt the server with Hyper-V Server (same name, same IP) and now for the love of christ I can't connect... 'You do not have permission....'  same network, same creds, same name.. (different SID & GUID's of course..), slowely loosing the will to live and went on a VMware seminar only last week... Vi3 looks good ;-)

Note for anyone experiencing the 'RPC server unavailable' error. If you've disabled the Windows Firewall service, this will give this error!

Not sure why, but enabling it, startng, and running the script to add the firewall rule fixed the problem.