Hyper-V Remote Management Configuration Utility

I have a question I have been trying to use your guides to setup a hyper-v server but I keep facing an issue where I receive this message. "The Security Database on the server does not have a computer account for this workstation" It appears to join our domain fine I reboot and receive this error. It does appear in our AD structure. I can log in as local admin and then add a domain group to the admin group fine. I then try to login with a domain account again and receive the same thing. I found something similar to this for Vista but nothing that definitively helped me correct this. Thanks

Sounds like http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3117915&SiteID=17
Thanks, John.

Great tool. Resolved my problem in connecting from Vista SP1 to Hyper-V running on a core installation. Too bad I didn't know about it when I began my current project.

John, I have used this on my client, and no matter what I can not connect from my Vista machine to the HyperV server. I keep getting RPC Server Unavailable. Unable to Establish Communication between "HyperVServerName" and "MyComputersName". Any ideas? I have added Anonymous DCOM access and the firewall exception is in place.

This has been a nightmare. Basic remote management from a Windows 2008 server fails. How about just a simple auth prompt to allow access. This is a metaphor for how convoluted Microsoft technology can be. I have given up on my project with HyperV and will now revert to VMware ESXi for my project. Come on this basic functionality we are talking about. DCOM remote object permissions? The fact you had to right a program to get simple connectivity and remote management to work speaks volumes. I am disappointed.

Got to say I am disappointed too. Can you get the tech writer to add your tool to the release note for the free Hyper-V download? All the documents there make it look like you install it, install the remote management tool and connect. Nothing at all about firewall stuff!!

Great tool John, worked good for me. Much thanks for all your effort behind it.

Too complicated for dummies like I am. I have a fresh hyper-v server installation (stand alone) and spent half a day serching for clear instructions on how to enable remote connections. Why don't you guys add option to allow remote connections to the hvconfig.cmd? This would ease life of tens of thousands admins.
As for your guide, a few words how to get to the elevated prompt would be helpfull.
Anyway thanks for listening and have a great holidays!

@LE2Strat - This will almost certainly be DNS related. Take a look at the troubleshooting section of the PDF documentation.
Thanks,
John.

To second Vitaly-K's question; How do you open an elevated command prompt in Server Core??? The usual Vista/Server 2008 options are not available. I tried various runas tricks but they didn't seem to work. I keep getting Access Denied errors when I try to run hvremote on the server. Can't find anything in the KnowledgeBase or on Google either or in my MS Server Core book.....

P.S. - I have installed a generic Hyper-V Server install right off of the DVD and then I logged in as administrator. Curiously when I do a "runas /showtrustlevels" I get

C:\Users\administrator>runas /showtrustlevels
The following trust levels are available on your system:
0x20000 (Basic User)
C:\Users\administrator>

Looks like something is missing in the base install....?!?!??

This thing's great. Saved me a ton of time. Thanks!

This is a great script! Saved me an as* full of time in trying to figure out how to get HyperV to do what I need! Thanks John!

@jhoward

I can perform NSlookups from both sides and the names resolve perfectly, both fowward and reserve.
Adding my clients name to the host file on the server, and adding the servers name to my clients host file didn't help at all. I still get the same error. (Also, we will have serveral people wanting to remote manage our HyperV servers...we don't want ot keep track of editing host files, it should just work!) Any other ideas?

@LEStrat

Can you email me through my blog (blogs.technet.com/jhoward) the results of ipconfig /all on server and client, the ping results in each direction, and the output of hvremote /show on both client and server. Any additional information about third party firewalls or "unusual" network configuration would be useful if there is anything to report.
Thx
John.

I'm not sure what I'm doing wrong, but I'm trying to remotely manage Hyper-V Server 2008. Both the server and my workstation on on a workgroup. I've followed the instructions, but when I run hvremote /show it tells me, "1: Found an account with an expired password"

If I scroll up, the error is in the "Contents of Group Distributed COM Users" it shows: "****WARN: This account has an expired password"

I created the account using this command: "net user lance * /expires:never" I can even log in fine as lance, but when I log back in as admin and run the program, I still get the error.

I appreciate all your hard work on blogging and building this tool, John, but I have been pretty disappointed with remote management of Hyper-V. It should be much easier than this to get it working.

@Lance - yes, I found this bug on Friday and am working on getting a 0.5 out there any day. My bad, sorry. Ignore that message. The script was *supposed* to check for expired passwords, but actually doesn't. What that message means is that the password is set to expire at some point in the future and you can safely ignored.
Thanks,
John.

Great tool, but I have 1 problem with it...

On a newly installed Hyper-V 2008 machine (only Hyper-V on Server Core), I get this message:

When joined a domain:
***** GetTrustee Failed: DOMAINNAME\USERNAME not found
***** If DOMAINNAME is a domain, you need to be connected to the domain for this to work

When joined a workgroup:
***** GetTrustee Failed: SERVERNAME\USERNAME not found
***** If SERVERNAME is a domain, you need to be connected to the domain for this to work

Can anyone please help me?

@Caveman85 - I've not seen this before. It would imply that connectivity to the domain is not available (in the domain case), but that wouldn't explain the workgroup case. Has there been anything which would indicate a problem joining the domain? (And I assume you did have connectivity to the domain - net view works for example). Have you double and triple checked that the username does in fact exist in the domain (or locally in the workgroup case).
Feel free to email me direct through the email option on my blog at blogs.technet.com/jhoward. Would be helpful if you added output of hvremote /show and any other info you can think of.
Thanks,
John.

@jhoward - Hello John, I've send you an email with the settings applied to the server. I hope you can give me some advice. Thanks in advance

Great tool but I am having an issue or running into a limitation...
I am also having the above mentioned:
***** GetTrustee Failed: DOMAINNAME\USERNAME not found
***** If DOMAINNAME is a domain, you need to be connected to the domain for this to work
error. In my case it works for the domain that the Hyper-V Server belongs to but when I try to add an account from another domain (trust is established) then I get the error.
Thanks in advance for any help

Just an update on my above mentioned problem. In one of my domains the two domain controllers (both with DNS) were not pointed at each other. After fixing this I was able to add users from the trusted domain...not sure why this happened because the trust itself was working fine. After fixing this I ran into the 'Cannot connect to the RPC service on computer' problem when trying to administer the Hyper-V server from a workstation in the other trusted domain using the Hyper-V Manager. It seems that the Hyper-V Manager is not using the FQDN since after adding the workstationX in domain X to the DNS zone of domain Y they were able to find each other. I should add that this is traversing a Linux firewall using Shorewall from the local network to a lab environment. One more tip for those using the Core Server in domain it is easy enough to add the Computer Management snap in for remote server and manage the users in the Management Console using MMC.

Jasbo - sorry for not replying sooner. I don't tend to check comments added here very often - through my blog goes straight to my inbox (although also filtered as it's not my full time job.... :) ). There is a good chance that Shorewall does the same as most firewalls - they are unable to pass WMI traffic as a general rule (at least that is the case for ISA, and although I'm no ISA expert, that's my general understanding at least) unless they are completely open and able to pass RPC traffic across, effectively acting as a router.... which somewhat defeats the point of having a firewall in the first place. Are you able to confirm that without the FW in between, you do not get any error?

I have everything running now... On Shorewall I opened up ports 135, 2179, and 49152:65535. This is a lab environment and is not open to the internet so it is not a problem for us. The lab has it's own zone separate from our local network for testing purposes. When we need access from outside of the firewall we use VPN. I have another problem now with some VM's rebooting but I think that is a problem for a different forum :) Thanks

I agree with those who find this totally confusing especially for those trying virtualisation for the first time. I have just spent a most frustrating Saturday trying to connect my Vista laptop to my Hyper-V server. I am now so confused I am not sure what questions to ask! This seems to me to be a simple job made unnecessarily difficult by code freaks who revel in convoluted commands and processes.

All I want to do is connect my Vista laptop to my Hyper-V server and get some work done!

Rant over!!

As far as I can tell I have implemented the two updates 950050 and 952627 but cannot get a sensible response out of HVRemote. I have been trying to do the stuff shown on page 9 of the document “Hyper-V Remote Management Configuration Script” but cannot get a sensible response; is there a command line buried in the screen dumps somewhere?

Running hvremote /firewallwmimgmt:enable and hvremote /firewallhpervmgmt:enable just produces error messages.

Trying to connect using Hyper-V Manager from the Vista laptop produces nothing.

Can anyone help, preferably using words of one syllable?

Tagglet - It would be far more beneficial if you could post the exact error than saying "just produces error messages". It's impossible to even hazard a guess as to what you're running into. You then say "...from the Vista laptop produces nothing.". I've never seen "nothing" - does it hang, does it give an error? To be honest, the best way forward would be for you to **THROUGH MY BLOG** at http://blogs.technet.com/jhoward use the email option at the top to post back the following five items which will allow diagnosis.

hvremote /show (on the server)
hvremote /show (on the client)
ping server-name -4 (from the client)
ping client-name -4 (from the server)
The message you get in Hyper-V Manager when you attempt to connect to the server.

I am having some trouble connecting my Windows 7 Machine to the hyper-v server. I get a RPC service unavailable error. I have run your script on the server and my client. I am in the MSHOME workgroup on both computers. The username and password are the same on both machines. i installed only one update for the hyper-v tools for windows 7. any ideas please??

Killervette - RPC errors (regardless of Win7 or VistaSP1 against R2 or 2008) are almost always DNS related (or secondary that you have a firewall inbetween the client and server). You have to be able to ping *BY NAME* in both directions - from client to server and server to client. Run ipconfig /all on each box, note the IP v4 address. Then try to ping on each box the other box by name (ping <otherbox> -4) and verify it's hitting the right IPv4 address. If not, either edit the hosts file, or fix DNS. More information in the docs for HVRemote (troubleshooting section).

Caveman85- to follow up, I think I now know the problem and have a fix in 0.6, but it's not ready for general consumption. Turns out to be a bug in Windows exposed by HVRemote. Drop me an email through my blog and I'll send you an early version of HVRemote 0.6 which works around the problem, if you need it. Thanks.

Hi John, thanks for the tool. I am in the process of using it to get my test system working.

I have to echo the comments above though, it is truly ridiculous that you had to create this at all! Why does the documentation not show all the extra steps we have to take to make this work? Why is this not in the config menu system already? Come ON microsoft guys, get a grip will you and either update the documents with a step by step guide or make it so we can connect in an easy simple way to configure the server!

John, thanks for your response. I am new to Windows Server 2008, Windows Vista and to Virtualisation in any form and so I am on an almost vertical learning curve but I do perceive expertise in these areas as fundamental to my future livelihood. There again I always was a glutton for punishment. I tell you this so you have some idea why I may be asking stupid questions or doing stupid things.

I have completely reinstalled the server using the Microsoft Hyper-V Server 2008 download. At a considerable expense to the environment I have printed off your blogs Parts 1-5 (double sided!) and the “How to add the Hyper-V role to Windows Server 2008 Server core machine” and worked through it bit by bit (or byte by byte!). I hope to notice that I am trying desperately to retain a sense of humour in a, to me, very stressed situation.

The environment comprises the server, running Hyper-V Server 2008 fully patched and client running Windows Vista fully patched. Both are in a workgroup called workgroup and are the only machines in that workgroup. Both are on a physically independent network connected to the Internet through a WatchGuard firewall, router, and ADSL modem and both can connect to the Internet. The username Tegglet has been added to the server with the same password as the Vista client. Tegglet already existed on the Client. Tegglet has administrative rights on both machines.

I did not use the hvremote.wsi script as sometimes you learn more doing it the hard way!

As far as I can tell I have done everything to the letter except that at step 12
net localgroup “Distributed COM users” /add TVN-HV01\Tegglet
did not work, I had to type
net localgroup “Distributed COM users” /add Tegglet.
I presume because I am in a workgroup rather than a domain.

When I run “hvremote show” everything corresponds with your screen dumps except the last one on page 9 which is three lines starting “ADMINISTRATOR1\user (S-1-5-21-1233540721 …

This I cannot identify nor can I work out what command is required to do whatever has to be done to create this entry. It appears to relate to permissions so is probably relevant.

When I run Hyper-V Manager on the Vista Client and try to connect to the server I cannot find it using the browse button but I do get some form of connection by typing the name of the server in the box. The server name is displayed in the left hand pane and the message “You might not have permission to perform this task” is displayed in the central pane. If I shut down the server the icon in the LH pane changes to indicate the connection has been lost.

I cannot ping the machines from each other but can ping the workstation from the server if I turn off the windows firewall.

I can find no trace of the “Virtual Machine Management Service” anywhere. I have changed the locale to UK which some say can affect this service although it did run in the first attempt to get all this working.

Sorry this is so long but I have tried to include all relevant information.

I look forward to you response.

John - I have just realised had not finished! I am finding the instructions a bit of a jigsaw puzzle; having jumped back from Part 3 Step 12B to Part 2 Steps 5,6, and 7 I forgot to jump forward again!

Implementing step 13 results in the error message “Failed to connect to \\TVN-HV01 because “Win32: the RPC Server is unavailable”. I can connect remotely to \\TVN-HV01 services alright and can see that the RPC service is running on the server. On the client machine the RPC service was also running but the RPC Locator service was not running. I started the Locator service to see if this helped; it did not.

John - Rebooting the server then the client seems to have got me a bit further but when I get to the security tab and select Root\CIMV2 the error message “The program cannot open the required dialog box because it cannot determine whether the computer named “TVN-HV01” is joined to a domain. Close this message and try again.” Closing the message gets another dialog box displaying the message “Unable to display the user selection dialog. The RPC Server is unavailable”

The server claims that the RPC service is running.

Tegglet - to the best of my knowledge, they key in why this is not working is almost certainly your statement that the client and the server are on physically independent networks. WMI and DCOM are not suitable for use through this type of configuration unless you effectively have no firewall and router in between them which would be a very bad security practice for a public facing network. My recommendation in this configuration would be publish the server on the Internet through a TS gateway for access to RDP, or publishing VMConnect and Hyper-V Manager of a TSWeb front end.

John - We have a misunderstanding here. Both machines are on the same network (192.168.250.11 and 192.168.250.51) that is physically independant of any other network in the office.

Tegglet - fair enough. However, by far the easiest way to allow diagnosis would be for you run run hvremote /show and the ping commands I mentioned earlier and post them to me in an email by using the email option on my blog (rather than this site which truncates long output). These will tell me what I need to know, whether you choose to do manual configuration or configuration through HVRemote.wsf.

John - I have finally beaten it into submission!!! Being a newbie I found the need to pick ‘n’ mix from the articles a bit confusing and I suspect I have been missing a vital element each time I tried. This time I made up some batch files to run the commands so once included a step was not forgotten the next time.

The worst bit is doing what azman.mmc should do although I thought this was done by running the command:
net localgroup administrators Tegglet /add
from the server.
Did I do it twice or is this something else?

Anyway the virtual machine is now installing and with luck will run to completion.

One more comment from VERY VERY VERY frustrated user. This is not my first aproach (see my previous post earlier in this list) to master Hyper-V server (standalone in workgroup environment). I got lost in multiple branching of your blog posts, it is completely unrealistic to go through all of them! I couldn't get elevated prompt on the server as well as many other points.
Is it really that hard to embed another menu point in the Hyper-V configuration on the server to simply enable remote hyper-v console connections???
Sory John, your script is useles for me.

Vitaly_K - To be up front, it frustrates me more than anyone (and believe me, I feel your pain) that the steps to configure this are difficult. However, it is what it is, and nothing is changing in Windows Server 2008 or R2 (applies equally to Hyper-V server). This is exactly why I've spent literally several hundred near-thankless hours trying to put something together which makes this so much easier without needing to follow those guide. (Those hours don't even include another few hundred working on a seriously revamped version which I haven't yet released to make the entry point to access as close to zero as I can make it. That's for another day though).

My best suggestion would be to persevere - with HVRemote, it really is straight forward and I will provide whatever help anyone asks. Forget the detailed posts - you really don't need to know what HVRemote is doing or how to do it manually unless you want to go through the steps manually.

If you log on with an account which is local administrator on a server core box, you will get an elevated command prompt. It's that simple. I'm guessing you are in a workgroup. Once you log on with a local administrator account, cscript hvremote /add:username will be the first thing you need to do assuming username has already been created as an account on the machine.

I can't help more unless you provide more info on where else you are getting stuck.

Vitaly_K - I understand your frustration and have gone through the same process. I wanted to do a manual configuration so I had a better idea of what was involved and found it easier to create batch files containing the commands. This ensured that the same process was used for each attempt and nothing was forgotton. Hyper-V Server 2008 as downloaded from the Microsoft site is so quick and easy to install that I just reinstalled and started again after making whatever corrections or additions to the batch files that were required. One thing I did find was that for a Workgtoup environment an entry in the Host file is required! How's that for a rave from the grave! To me this was not clear from the articles but as soon as I added the entry everything lept into life.
Hope this helps.

Yesterday received my new test server after one frustrating day I searched and found John's hvremote script and exelent documentation, tanx. HyperV server and Vista remote management client works fine in a workgroup on my new test server. I had also like Tegglet to add the server name in the hosts file on the client and on the HyperV server command prompt I added a user name (net user "name" *) (password must include 1 capital and 1 digit?) that is the same on the client and server. Tip : Don't make any mistakes and don't forget to reboot the client and server after the changes, this took me 2 hours extra time.

Great Tool!! I am able to RDP Connect to a VM hosted on a Hyper-V Server with a user other than Administrator

Tegglet
Would you be willing to share your batch files?

John, I just want to say thank you for this tool... I just wished I had founded sooner... but, I tried it and it worked just fine...The only issue I ran was modifying the host file.. in Vista or Win08 you can't modified the hosts file. one has to first edit the file and save it somewhere else then copy the file to the correct path (%systemroot%\system32\drivers\etc).. So, I automated the process a bit more. How can I post my script so that others can use it? I automate the client and Server process...

Thanks

John, I just created a new post http://code.msdn.microsoft.com/Hvautomated for those that want to take a look at the script I created.

thanks
LBueno

For those still having problems, here's one more thing for you to try: Make sure you can ping the unqualified name of the server; the fully-qualified name wasn't good enough, at least not in my case.

I was trying to connect to vmserver.otherdomain.com from a computer on mydomain.com, and kept getting RPC errors. Eventually, I ended up adding an A record to mydomain.com's DNS server for "vmserver" (i.e., vmserver.mydomain.com would now resolve to the same IP as vmserver.otherdomain.com). This allowed me to successfully ping "vmserver" using the unqualified server name. Once I did that, I was able to connect using the unqualified server name in the management tool.

And thanks for the excellent tool John! It was definitely helpful.

I have a bit of a problem, since I just installed the free version of Hyper-V, and, I could not find any UI options for installing my first virtual machine. I am also planning to install Virtual Server 2005 R2 and load some existing virtual machines, although I'm aware that the performance may not be optimal for these machines.

So how do I get that screen where I can install virtual machines? Remotely? Locally?

I mainly use WinXP but I also have a Vista machine around, although I tried to install KB952627 unsuccessfully because Vista rejected it.

jon80 - the remote management tools are only available for Vista SP1 (you have the right KB) or a full install of Windows Server 2008. For the rejection case on Vista, which SKU of Vista are you running, and are you sure you are attempting to install the update for the correct architecture and have SP1 installed?
Thanks,
John.

Great tool, thanks!

I've logged into my server core 2008 server both as the domain administrator and as the local administrator. When I try the script, I still get the "Must run from an elevated command prompt for all sever operations" message. My understanding is that all command prompts in server core are already elevated. I have no idea how to get an elevated command prompt from a nonelevated one.

I just wanted to say that I figured out my problem mention (just above). There is at least one time you don't have elevated command prompts in server core. If the server has UAC turned on, then the prompts are no longer elevated. This was happening to me because I joined the server core installation to a windows domain that had a group policy enabling UAC on all devices. Hope this saves someone some trouble - it sure caused me a great deal...

Script works fine for me now. I appreciate all the work that was put into it. I just wish it wasn't necessary...

dlsteelejr - that's good to know, thanks. I was asking around here, and was still trying to find out why that would have been the case. Certainly something I should include in the documentation some time (or enhance the error message).
Cheers,
John.