Part 4. Domain joined environment: Hyper-V Remote Management: You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Update 14th Nov 2008. I’ve just released a script which does all this configuration in one or two command lines: HVRemote 

Quick links to the all parts in the series: 1, 2, 3, 4 and 5 

So after even more feedback and questions, part 4 of this series provides the walkthrough steps necessary to perform Hyper-V remote administration in a domain joined environment.

For reference:

  • Part one is the server configuration for a full server installation in a workgroup environment
  • Part two is the client configuration for parts one and three
  • Part three is the server configuration for a server core installation in a workgroup environment
  • Part four, this post, contains the relevant bits from parts two and three as applicable to deploying remote management of Hyper-V in a domain environment
  • Setting up and the pre-requisites for Hyper-V on server core are in this post.
  • More information on server core commands is here

Follow the same steps for setting up the server core box itself as before, but remember to join the machine to the domain by using netdom join <computername> /domain:<domainname> /userd:<domain user> /passwordd:*. Don’t forget to enable remote administration.

Let’s first logon as domain administrator on the Vista machine and connect to the remote machine using Hyper-V Manager. As you can see, that works fine.


Obviously running as domain administrator isn’t a practical option in anything but a contrived lab environment. So I’ve created a standard user account in the domain called “domainuser” who is not an administrator either in the domain, the server core box with the Hyper-V role enabled, or on the Vista machine. Let’s see what happens when I start Hyper-V Manager on the Vista machine targeting the remote server core box. As you can in the screenshot below, it indicates that I am unauthorized. This is expected at this stage.


Step 1 Authorization Manager configuration

I need to authorize the domain user account for operations on the Hyper-V server, the same as I did in the workgroup environment. This is easier if I use an administrative account on the remote server core machine. For simplicity, I’m going to log back on to the Vista machine as domain administrator and run configure the Hyper-V authorization policy. (Note in the real world, you don’t need domain administrator – this is for simplicity in the walkthrough only).

Logon to the Vista machine as Domain Admin and click start/run AZMan.msc.


Now open InitialStore.xml from the %systemdrive%\programdata\microsoft\windows\Hyper-V directory on the remote server machine. Right click on Open Authorization Manager and select Open Authorization Store…


Select XML and enter the path to InitialStore.xml (or browse to it, noting that the programdata directory is hidden).


Expand the tree through Hyper-V services\Role Assignments\Administrator and select “Administrator”. Note that I’m making this walkthrough as simple as possible by making the domain user an administrator in the context of being able to perform all operations on the machine running the Hyper-V role. This does not however mean that the domain user becomes, or needs to be a local administrator on the Hyper-V machine (or on the Vista machine).


In the right-hand side of the window, right click and select Assign Users and Groups then From Windows and Active Directory….


Select the domain user account and click OK.



You can now close Authorization Manager

Step 2 DCOM Configuration

Again, this is similar to the configuration steps necessary in the workgroup environment. You need to grant the appropriate users access rights to remote DCOM on the server. Use the same steps as in the workgroup configuration and add those users to the Distributed COM Users group.

On the Vista machine logged on with an account with administrative rights on the server core machine, click start/control panel/administrative tools/computer management.


Remember in the server core configuration steps, I allowed remote management to enable this to work. If you get an error – go back to the server core configuration steps (links at top of this post). Right Click on the top of the tree on the “Computer Management (Local Computer)” node and click Connect to another computer…


Enter the name of the remote server (jhoward-hp2 in my walkthrough)


Expand the tree down through Computer Management/System Tools/Local Users and Groups/Groups and select Distributed COM Users on the right hand side.


Double click on "Distributed COM Users", click Add… and select the appropriate users (domainuser in my walkthrough), and click OK.


Step 3. Remote WMI

This step is the same as the configuration steps necessary in the workgroup environment. You need to allow the domain user account access to the Root\CIMV2 and Root\virtualization namespaces. While Computer Management is still open from Step 2, expand out Services and Applications and select WMI Control.


Right click on WMI Control and select properties. Then switch to the "Security" tab. Expand the tree and select the "Root\CIMV2" namespace node.


IMPORTANT: You need to set the security twice. Once for the Root\CIMV2 namespace, and then again for the Root\virtualization namespace.

Click the "Security" button. If the appropriate user or group does not already appear, use “Add…” as you did in Step 2 above to add them.


Now select the user and click the Advanced button below the “Permissions for <user>” area.


Again, make sure the user/group is selected and click Edit.


You need to make three changes here:

  • In the “Apply to:” drop-down, select “This namespace and subnamespaces”
  • In the Allow column, select Remote Enable
  • Check “Apply these permissions to objects and/or containers within this container only”

The screen should look like below. If so, click OK through the open dialogs.


Repeat for the Root\virtualization namespace


Click OK as appropriate to confirm all open dialogs and close Computer Management.

After completing this step, reboot your server for the changes you made in step 2 to take effect.

Step 4. Test it out

I logged back onto the Vista machine using the test domain user account. I started Hyper-V Manager and targeted jhoward-hp2, the remote server core machine. I then created a new virtual machine with all default settings, except selecting to add a virtual hard disk later. I started the virtual machine and connected to it. And as you can see in the screenshot below, the virtual machine is up and running (the boot failure message is expected as there’s no bootable media in the virtual machine).




Update 14th Nov 2008. I’ve just released a script which does all this configuration in one or two command lines: HVRemote

Comments (78)

  1. Anonymous says:

    Aujourd’hui deux outils pour Hyper-V. Pas tout neufs, mais extrêmement utiles. Le premier vous servira

  2. Anonymous says:

    Hyper-V Management Console on Vista x64

  3. Anonymous says:

    Hola Una herramienta imprescindible para configurar los servidores con Hyper-V para que se puedan administra

  4. Oleg – I have seen this when there are incompatible versions between the management client and the server. Remote management does not work in Beta from a Vista client – I suspect that you have not applied the RC0 update to your server (KB949219). That should resolve the problem.



  5. Eric – yes, absolutely correct. Remote management does not work on Hyper-V beta. This series is specific to our RC release.



  6. Geoff – Short answer is I’m not sure. You’re certainly asking about an area far outside my expertise and doesn’t look like anything specific to Hyper-V (please correct me if I’m wrong – if you’re seeing different behaviour between physical machines and virtual machines, that’s a different matter).

    My best suggestion would probably be to post a question on the Technet forums. The platform networking forum may be a good place to start:

    Thanks, and sorry I can’t provide more assistance.



  7. Ryan.  Hmmmm. This seems a little odd. So first off, I’d rule out pointing a Vista SP1 RC0 Hyper-V management box at a beta Hyper-V server. That is destined for failure as there are several WMI changes between Beta and RC0. The firewall disabling similarly I can probably rule out as this is WMI/DCOM permissions most likely. I could believe there could be discrepancy between Business and Enterprise Vista (I know of one issue, but that should have been resolved in RC0) – I was using Enterprise.

    There is one clear difference – my test domain is at 2K8 functional level, with only a single 2K8 DC in the picture.

    So you are saying that when you go into Start/COntrol Panel/Administrative Tools/Computer Management and target the remote Hyper-V RC0 box, you can, for example, add local users in System ToolsLocal Users and Groups, or view the event log, or stop/start services under Services and Applicationsservices just cannot get to enumerate the WMI namespaces under Services and ApplicationsWMI Control?

    It makes no sense that _just_ WMI Control would not be working remotely (at least no sense that I can make of it). Can you confirm you have access remotely to the other examples?

    Thanks for your patience!



  8. Mr. Mott – Follow part one of this series where I configure DCOM in a workgroup without using the Distributed COM Users Group, but add a domain user account instead of a workgroup account. It should work, but I haven’t tried it.

    But please note – our recommendation will *always* be to run the Hyper-V role without any other roles installed, ideally on server core as well. Just in case you weren’t aware.



  9. Matt – Hyper-V has reached RTM – I assume the pre-release builds have been pulled. See for RTM links. Please upgrade to RTM and let me know if you are still seeing the same issue.



  10. eisenpony – this should work (, I’ve not heard of it not working if the AZMan configuration has been done. Can you email me a screenshot of the AZMan configuration?



  11. Kyle – Can you verify a few things to start narrowing this down.

    – The "No Heartbeat" is because the Integration Services aren’t installed inside the virtual machine. However, if you can’t connect to the virtual machine to be able to do this, that explains that one, so it’s probably not relevant.

    – On the Domain Controller, did you installed KB949219 as well to get the RC0 version of the management tools installed as well?

    – Is it possible to verify if there is a firewall issue here by disabling the firewall on both the computer running the MMC and the server core installation of Hyper-V? (netsh firewall set opmode disable).



  12. Ryan/Hilton – can you both please confirm the details of the account you are running step 3 in. If you have the opportunity, can you confirm if you can expand the namespaces when logged on as "the" domain admin. If that is not possible, please confirm you are running this as a _domain_ user account which has local administrative rights on both the vista and remote server core machines, and not a local account.

    One other interesting thing would be to run wbemtest on the Vista machine and attempt to connect to \remoteserverrootcimv2 and \remoteserverrootvirtualization. Does that succeed, or do you get an access denied error?



  13. Geoffrey – can you try using HVRemote to verify things are configured correctly.

    In particular run HVRemote /show /target:otherboxname on both client and server and follow it’s diagnosis if errors are shown.

  14. Ryan – I’m running short of ideas to be honest short of me rebuilding my environment with the domain at Windows 2000 functional level…. Is there any chance you could run a network monitor trace on the vista box, or see if there’s anything obvious can be seen?



  15. Anonymous says:

    So far, I’ve covered the following Hyper-V Remote Management scenarios: Workgroup: Vista client to remote

  16. Joe – part 2 referred to a workgroup scenario. You should not need to enable Anonymous DCOM for a domain scenario.



  17. Naresh – I have absolutely no idea what you are referring to?????!



  18. Ryan – yes, these two specifically:

    netsh advfirewall firewall set rule group=”Windows Management Instrumentation (WMI)” new enable=yes


    netsh advfirewall firewall set rule group=”Remote Administration” new enable=yes

    It’s also possible that you’re getting domain policy being pushed down for the firewall. Of that though, I can’t comment on what’s present, but it is possible you are being blocked by it.



  19. Benjamin – if there is no trust between the two domains, you have two choices. Either treat these as workgroup computers where no trust is implicitly in place using local accounts rather than domain accounts and follow hvremote instructions for workgroup scenarios.

    An alternate is to bring up a management client in the DMZ physically and in the DMZ domain which you can remote to using mstsc. That may be a more secure solution as you only need to open RDP access through the firewall between the corp domain and the DMZ



  20. Hilton – so your environment is different to the walkthrough I’m describing. I have not validate this scenario, but you will probably need to enable anonymous callbacks to make this work in your setup. Using dcomcnfg you will need to allow remote access to "ANONYMOUS LOGON". See step 7 in part two. I’m still tracking down why WMI namespace enumeration is failing in the clean environment described above in Ryans case – as you have a mixmatch of domain and non-domain machines, it is possible you are hitting a different problem.

    I see a part 5 coming….



  21. Anonymous says:

    Announcing &quot;HVRemote&quot;…., a tool to &quot;automagically&quot; configure Hyper-V Remote Management

  22. Anonymous says:

    It has been a little quiet on the blog front, but sometimes, at least in this case, I hope I’ve come

  23. Ryan – you have enabled remote management on the server core box? I suspect that is the most likely cause.



  24. Don – you need to emulate the Hyper-V Management Client rules in the OneCare firewall. To be honest, I’ve never used OneCare so don’t know how you go about this. My best suggestion would be to ask the OneCare team themselves – they maintain a team blog at However, maybe over the Christmas holiday, I’ll have time to work it out and post up entry…. no promises though. The OneCare team would probably be quicker though.



  25. Shiva – what build of Windows 7 (R2) are you using – are they equivalent builds ie beta-beta or rc-rc, or an interim build between beta and rc. You will hit this issue in certain combinations of mismatched bits due to a bug which existed in the development cycle (fixed now, and rc-rc should not have this bug).



  26. Prabhat – yes. You need to uninstall the QFE update which is where it is listed rather than in the program list.



  27. Prabhat – by far the easiest was to diagnose this is to run hvremote /show on both the client and the server. If you can post that back, and also the output of a ping by name (not IP) from server to client and client to server, it will probably give me everything needed.



  28. lukasbeeler says:

    Many thanks for your whole series. Without it, i wouldn’t have been able to get Hyper-V remote management to work the way i want it.

    I hope you’ll write about AzMan and VM Scopes in the future – i’ve got it working (and wrote about it here: ), but i’m not entirely sure if i did everything correctly.

  29. Glenn – partly correct. Hyper-V remote management tools on Vista (KB952627) requires Business, Enterprise or Ultimate SKUs.



  30. Shiva

    I’m not sure WMI interfaces exist to DHCP – at least I couldn’t find any reference to them, but I’m not on the DHCP team to be able to provide an authoritative answer. Once a server generically is running in a VM, you should treat it from a management perspectivie as just another server on the network. There’s no form of "secure remote execute" of commands from the Hyper-V parent partition to one of the VMs running on it.

    Take a look at netsh – that may provide what you need.



  31. Shiva – if you’re and MS employee (which I assume you are from the reference to MSIT SUPPORTED VERSION), please follow up with me internally, or on the internal aliases.



  32. ryan says:

    Again, I can’t thank you enough for taking the time to find a solution for this problem. However, it is still not working for me. I got through steps one and two without any problems and then hit a snag at step three. When I go to the WMI Control Security Tab all I can see it the Root namespace, nothing below it, not even after I expand it. This shouldn’t really matter because my domain user is part of the Local Administrators group on my Server Core install and that group is given full control over all of WMI by default. I am really at a complete loss here, it should be working just fine. I haven’t been able to see if I can manage it from a full Server 08 install using its Hyper-V Manager so that is what I am going to have to try next.


    Ryan Lenkersdorfer

  33. ryan says:

    I am able to remotely manage everything else but Hyper-V. I have enabled all the firewall rules that exist for WMI and remote administration in general on both the client and the server, still nothing. Is there some specific command that you had in mind?



  34. ryan says:

    I ran both commands, I am pretty sure I have ran them in the past as well, but it said it updated a few rules. I also went though our Group Policies and removed all policies regarding the firewall config on the server. I then ran a gpupdate on the server and restarted it. I then ran gpresult to make sure it wasn’t applying anything else and tested it. Nothing. I am not sure what in the world could be wrong now. Clean install of Server 2008 Datacenter Server Core x64 with nothing else running on it. Clean install of Vista Business SP1 x64. Both on the same domain (Windows 2000 level domain if that matters), both have my domain user added to their Local Admin groups. I also get the same error if I point the Management Console at another server running Hyper-V Beta. Disabling the firewall on both client and server does nothing. It just doesn’t make any sense.



  35. ryan says:

    I have just verified that I can remotely manage anything but WMI security using Computer Management on my Hyper-V RC0 box. When I open the security tab in WMI Control I see Root with a plus sign next to it. When I click on the plus sign to expand root it waits a second and then the plus sign disappears, nothing else happens. I have left it open like this for a good 5 min now and still nothing. I also know that there is a command line tool available in server core to manage WMI. It is a very complex tool and I have been unable to find good documentation on it so far. I am going to try to find out how to make the WMI security changes using that tool so I can bypass this remote WMI control problem since it is not my primary problem right now.



  36. ryan says:

    I am sorry, I forgot to mention that the WMI command line tool is wmic.exe.



  37. HiltonT says:

    HI John,

    Although I don’t have a domain-joined Core+Hyper-V setup, I have the exact same issue – I can start and stop services via Computer Management on my Vista SP0 machine, yet I have no namespaces under Root in WMI Control.  (I also posted this, or similar, at the end of Part 3, but since Ryan’s issue above is almost identical to my issue, I thought it only sensible to tag along in here instead.  🙂

  38. HiltonT says:

    Hi John,

    OK.  To test this, since the Core+Hyper-V in my network is not and will never be domain-joined (no sense if one of the guests is the AD controller), I created a CoreAdmin account on a laptop running Vista SP1+RSAT+Hyper-V Management Tool which is a local admin, the same as on the Core box (CoreAdmin is a local admin).  This is the laptop I take with me to onsites and use for tech work.

    I can successfully connect via RDP to the Hyper-V machine and I can successfully connect to it using "net use \qrk01hyperdev", so I know the username and password are identical on both machines.

    When I try to connect to Computer Management via the laptop, I get "Error 5: Access is denied" if I try to look at the Hyper-V server’s services and in WMI Control it reports that it Failed to connect to \qrk01hyperdev because "Win32: Access is denied."’

    So, this is getting curioser and curioser – why can I *almost* connect using my desktop with Vista SP1 + RSAT + Hyper-V Management Tool but I cannot even get that close using my laptop with Vista SP1 + RSAT + Hyper-V Management Tool?

    This maketh absolutely no sense to me!

  39. HiltonT says:

    … and as to the wbemtest test, I can connect to both cimv2 and virtualization without errors, but past that, I’d not know what to do to know that these have actually connected properly.

    So, as for not getting errors saying access is denied, it seems that this works fine.

  40. ryan says:

    Okay, I have verified that I am running a true domain user and that the user has been added to the local administrators group on both the Vista machine and the remote server core machine. I do not have the ability to log in as ‘the’ domain admin but I have verified the above information.

    I also used wbemtest and was able to connect to both namespaces without issues.

    Thanks again for you help!


  41. ryan says:

    Here are the results of "net localgroup Administrators" ran on both machines:

    Remote Server Core Machine:

    C:Usersscs!admin>net localgroup Administrators

    Alias name     Administrators

    Comment        Administrators have complete and unrestricted access to the computer/domain



    ADDomain Admins



    The command completed successfully.

    Vista Workstation:

    C:Usersrdlenk>net localgroup Administrators

    Alias name     Administrators

    Comment        Administrators have complete and unrestricted access to the computer/domain



    ADDomain Admins



    The command completed successfully.

  42. ryan says:

    Our domain here is "AD" and both computers are joined to it. My domain username is ADrdlenk, so it is defiantly added to both admin groups and it is defiantly a domain account.



  43. ryan says:

    Very Interesting development here, I went ahead and removed Server Core and installed a full version of Server 2008 Datacenter with the Hyper-V RC0 update applied to it. I got it all configured and back on the domain with the exact same user permissions. I went through the above steps and applied them to the system, including the WMI Control. I am still not able to connect to the server through the Hyper-V Manager installed on my Vista SP1 box. I was able to use the Hyper-V Manager installed on the Server and was able to create and run a VM. When it booted I made sure that it said "Microsoft Hyper-V Release Candidate 0"

    Just on a side thing, I went ahead and tried to manage the WMI security remotely from my Vista SP1 box again. It had the same error as before.

    The next thing I am going to try is setting up a 2K8 domain and put both computers in there. I also found out that my previous information about my domain setup was incorrect, it is actually a native 2K3 domain. If I can get a hold of Vista Enterprise media with SP1 (I have a license for it, just not the media) then I am also going to try and see if that works.

    It really seems like it something on my end that is messed up. If none of the above tests fix this, I think I am just going to have to stick with Hyper-V beta until Hyper-V RTM. I again want to thank you for all your help, but I don’t want to waste any more of your time either. I will report back here with the results of my tests when I get them done, which might be a couple of days.


    Ryan Lenkersdorfer

  44. HiltonT says:

    Hi John,

    My scenario is more akin to Part 3 than Part 4, the only reason I moved into here was that I am seeing the exact same authentication/WMI Control issues as Ryan.

    So, I basically have a Core box not on the domain with a CoreAdmin local administrator account, a Vista SP1 laptop not on a domain with a CoreAdmin local administrative user and a domain-joined desktop PC with Vista SP1 with a CoreAdmin limited user account (on the domain).

    With all of the above, I see the same issues that Ryan sees.

    I say, bring along part 5!  🙂

  45. Tim says:


    Thanks for the help (so far).  I too have a mixed domain issue.  My case is typical for a classroom environment.  The HV host contains a unique 2k8 domain controller (Full 2008, not core).  Students will connect using laptops they provide and are clearly not in this domain.  I want to give them access to the Hyper-V manager from machines that are not in the domain.  It is looking like I will have to give them remote logon access from where they can start it from within the domain.  I have followed your instructions, but attempting to provide all permissions to ‘everyone’.  Still, ultimately, the wbemtest will fail to connect unless I provide a domain account.

    It is looking to me like the remote Hyper-V Manager needs to allow specification of alternate credentials so it can pass them along in the WMI calls, but there does not seem to be a way to do that.

    I thought I would pass this on and I am hoping you might find a "part 5" solution!

  46. ryan says:

    I have setup a VM running Vista Enterprise SP1 x86 and joined it to my existing domain. I was able to point it at my Hyper-V RC0 server and it was able to connect and manage Hyper-V with no additional configuration! Why I am still having problems on my Vista Business SP1 x64 box is a mystery to me. Perhaps it doesn’t like Business or maybe it doesn’t like 64-bit. If I can, I will try Vista Enterprise SP1 x64 and see what happens.

    Thanks again for all your help!


  47. Eric Liddon says:

    I was getting the same problem.  It appears that the new management client for 2008 Hyper-V on x64 cannot connect to the Hyper-V Beta.  I just installed this patch ";
    and it fixed it for me.  Hope this helps.

  48. Mr. Mott says:

    Any idea how to make this work when the hyper-v server is also a DC without a local dcom user group?  Client is Vista Ultimate x64.

  49. Oleg Krylov (Russia) says:

    Excuse me for my very poor English))) I’m install s2k8 Enterprise Full + Hyper-V. My Vista x86 box with SP1 have Hyper-V manager. I perform all steps from Part 4. I connect to my Hiper-V server, with no errors. But when i attempt create new machine, I recive message " Loading Wizard page failed. You might not have permission to perform this task". My domain user account is memmber of Administrators groups both in my Vista box and Hyper-V server. In Authetication manager for my domayn user account assigned Administrator role. Help me please to resolve my problem.

  50. Kyle says:

    I have hyper-v running on a core 2008 install in a 2k8 domain.  I used your walkthrough and was able to get everything working correctly, with one exception.  After I create a VM, I am unable to connect to it to install the OS.  I simply get an error stating "Cannot connect to the virtual machine. Try to connect again. If the problem persists, contact your system administrator."  Also at the bottom of the MMC, the heartbeat is reporting as no contact, if that helps.  Hyper-V is running RC0, and the MMC is running on a 2k8 DC (for testing purposes only).  Any help would be appreciated.  Thanks.

  51. Kyle says:

    John,  Thanks for the quick reply.  I have verified that KB949219 has been installed on the DC.  After I disabled the firewall on both servers, I was able to connect.  I double checked my firewall policy to ensure that I did have the inbound rule set to allow "Hyper-V Management Clients – WMI (Async-In, DCOM-In, and TCP-In)" on the DC.  Is there another rule that I have overlooked?  Thanks,


  52. John J. says:


    First if thanks for the guide.

    Second, I am experiencing a slightly different issue that I hope you may be able to help with. I am able to connect to my core server hyper-v installation (from a server running full 2k8 and hyper-v)  and manage VMs but when I attempt to set up the virtual network I receive the following error:

    "There was an error enumerating the machine’s network switches. make sure the Microsoft Hyper-V Network Service is installed and working properly

    You may not have permission to  perform this task"

    I followed the steps above, and I am able to remotely manage the server. I don’t see a service named "Microsoft Hyper-V Network" running on either server so I am not sure what exactly the error is referring to.

    I am currently using a Domain Admin account.

  53. Mike Brown says:


      I’ve upgraded my server to rc1 as well as my client management console. I was able to successfully connect and control the VMs from the vista client before the upgrade. After, not so much. I get the following message in the Virtual Machines Pane:

    “Access denied. Unable to establish connection between ‘Server’ and ‘Client’.”

    I’m able to control other aspects of the server, like creating and deleting virtual networks. But can’t manage the VMs.

    Also the VM creation wizard (run from a host local manager of course) fails for me if I try to create a VM without a network connection.

  54. Tom Beauchamp says:

    Very helpful article!  For users trying to connect to a domain controller, add your user to the BuiltinDistributed COM group in your AD instead of in local groups.

  55. Matt says:

    Can anyone tell me where to download KB949219? When I go to download that KB from here

    It says the page is gone. I am really struggling with getting Core to work with a remote management client (x86) vista sp1. Both machines are in the same domain. I have done all the steps above but still get the same problem as John May 22nd and Kyle from May 7th…ERRRR!!! Seems that MS would have it, you know, just work.

  56. cCollier says:

    I’ve upgraded to RTM and I continue to get an error when I try to connect to the console of the Virtual machine. I right click a machine in hyper V and get "cannot connect to the virtual machine. Try to connect again, If the problem persists, contact your system administrator" (Dont you hate it when you’re the guy youre asked to contact? heh)

    Anyway, its 64bit 08. Ive tried turning off the firewall on the host and everything else in this string of comments and cannot connect to my VM. I have a bad habit of asking for help as a last resort only, but I would really like to see this work. Any insight anyone can offer would be greatly appreciated.


  57. swtmike says:

    It seems there can be issues relating to DNS as discussed at

    I re-read this blog numerous times to try to get Hyper-V Manager to connect to our Core installation but it was only when I came across the posts above that I was able to get it to work.



  58. xd says:

    Kyle –

    To solve the "Cannot Connect to the virtual machine. Try to connect again. If the problem persists, contact your system administrator." error, you need to enable inbound port TCP port 2179 see: for more info.

  59. Rory Donnelly says:

    If you get "Group cannot be specified along with other identification conditions" when trying to do either of the "netsh advfirewall firewall set rule group=" rules, try TYPING them out in full and don’t cut and paste.

    It worked for me!

  60. ane says:

    Hi, I’m facing the exact same problem described in this article right now but I’m not even able to connect using the domain administrator account.  I set up the domain just for the purpose of testing hyper-v. The firewall is disabled on all member machines and I did my best to verify that all COM / WMI rights are properly set.

    On top of that everything works just fine if I’m logged on to the hyper-v core installation while trying to connect from a remote machine. Once I "logoff", the connection from the management machine fails again.

    Has anyone seen similar behaviour before?

  61. eisenpony says:

    Everything seems to run fine when my domain user is a local administrator on the server box, but when I try to use a domain user that is a standard user on the Hyper-V server, I get the You do not have the required permission to complete the task error.

    If I use computer management remotely to put my domain user in the servers Administrators group, it will instantly start working properly. I’ve got the user in InitialStore, DCOM Users, and WMI root/cimv2 and root/virtualization.

    Could the problem be the user can’t access program files on the server unless it is an administrator? What am I overlooking?

  62. Joe says:


    In a domain environment, is it possible to remotely manage Hyper-V from a Vista machine without enabling remote access for Anonymous Logon in DCOM as you outlined in part 2?  

    I was logged into a Vista machine as a domain admin connecting to a Hyper-V machine in the same domain and received "Access denied. Unable to establish communication between ‘SERVER’ and ‘CLIENT’" error messages in the Hyper-V Management console until I enabled this setting in dcomcnfg.

  63. Naresh Verma says:

    Kindly correct the "

    when you run the abobe command

  64. Don Hiatt says:

    Hi John,

    I’ve been plagued with the Unable to connect to the server because of the RPC issue. I’m using a Workgroup configuration and have isolated the issue to conflicts with my "two" firewalls. I followed the instrucitons and installed the exception rules. However, my second firewall is OneCare. If I login and OneCare is running then I cannot connect. If I shut down the OneCare firewall and turn on (or off) the Windows Firewall then I can connect in less than a second. After connecting "during my Windows login session" I can turn either or both firewalls on and happily connect through the Hyper-V manager in a workgroup Vista configuration.

  65. glenn adams says:


    I installed KB952627 on a Vista Home Basic SP1 (x86), but the Hyper V manager does not appear when I try to add it to the mmc.  Does it require Vista Ultimate ?  


  66. Prabhat says:

    Hi John, Thanks for the great article.

    Unfortunately I have problem connecting the Hyper-V server (on Windows Server 2008 Ent. X64 FULL Install) from my VISTA Ultimate SP1 and Hyper-V Manager installed.

    Now getting error: “The operation on computer <servername>> failed.


    – Both the server and my PC are in Same Domain.

    – I am able to remote manage the server from my VISTA.

    – I am able to TS into the server.

    – My domain user account, that I used to login in my PC, is a member of the Administrator group of the Hyper-V Server box.

    – I have followed all the steps described here.

    – Even I have tried disabling firewall in both boxes.

    – I can ping both way (from server to my pc and vice-versa).

    Can you please help me in this?


  67. Prabhat says:

    Hello Another Question:

    Can I uninstall Hyper-v MMC from my VISTA Client PC?

    If YES, How – As I dont see this in Manage Programs in Controlpanel.



  68. Geoff says:

    My input may be totally irrelevant but having been dogged by the connectivity issues between domain and non-domain machines for weeks my discovery might give you guys another lead to work with.

    In my case even though I am able to browse all stations on the network and they are all correctly registered with DHCP and DNS when I try to connect to a non windows or non-domain windows PC from a domain member vista,win7 or 2008 machine I get the "access denied" message.

    XP machines had no problem.

    I then realised that by connecting using the IP address (\192.168.x.x) they connect!

    So, it transpires that when a connection is made from a Domain PC to a Non Domain device using NetBios names, Keberos Authentication using AES is enforced, but when using IP addresses it automatically falls back to NTLM!

    As the practises desribed in this blog describe the same mix of domain and non-domain machines trying to communicate in a similar manner it suddenly hit me, is this the same issue?

  69. Dan L says:

    I’m running up against a slightly different issue… I appear to be able to connect remotely the my server via the Hyper V Manager from my Vista Box, however I get a "The Virtual Machine Management service is not available." under Virtual Machines.  I am able to click Start Service on the right but nothing happens.   I’m not sure if this has something to do with the .xml file edits I did as I can’t get the file to display via IE properly, it errors out with the following error message: "Only one top level element is allowed in an XML document. Error processing resource ‘file:///Z:/ProgramData/Microsoft/Windo…"

    I haven’t changed domain names on my server and I’m not running AD, my vista box is in a different workgroup as well.

    Any thoughts?

    So far, this walk through has been an excellent source to learning this technology.


  70. Dan L says:

    belay my request for information! I just realized that I hadn’t applied the KB950050 update on the server.  I just completed that and I can now make remotely manage VMs.  I’m off and running.   Big kudos again to taking the time to help us little folks along the way!!


  71. shiva says:

    Hi John,

     In Hyper-V, Is there anyway to configure a DHCP which is part of a Virtual Network through WMI? i.e.. The DHCP is enabled in a Win 2K8 VM. I wish to configure the DHCP via WMI running from the Host Server.

    Thanks again for the article, I have taken key scripts from HVRemote utility. It helped a LOT!!



  72. Rich says:

    When do we get our host key, and web interface back, so that we can be done with all this remote management garbage?

  73. shiva says:

    In some machines when we make a VMConnect, I am getting a certificate error. It goes as follows

    "Your remote desktop connection failed because the remote computer cannot be authenticated.

    The remote computer could not be authenticated due to problem with the security certificate. It may be unsafe to proceed."

    I ran the HVRemote utility for the users by which I am going to authenticate with the host servers. In one windows 7 machine I got this error. Any thoughts on the same?

  74. shiva says:

    Hi John,

    Thanks for the reply. The Windows 7 version is 7100 RC MSIT SUPPORTED VERSION. Can we expect the certificate message "Your remote desktop connection failed because the remote computer cannot be authenticated." in this version. Also from which version the fix is available? Please let me know.



  75. alan says:

    Hi John

    Thanks for all your work on this.  I have been using HVRemote to configure W2K8 R2 Hyper-V for remote access from my Vista PC.  If I give myself admin rights on the server then everything works a treat.  If I remove admin rights though, after running HVRemote then everything works apart from the media drives.  When I click on the Media item in the Virtual Machine Console I get a message saying "Drives not loaded".  This seems to tie in with the following event log message on the server

    Log Name:      Security

    Source:        Microsoft-Windows-Security-Auditing

    Date:          07/10/2009 16:53:25

    Event ID:      4656

    Task Category: Other Object Access Events

    Level:         Information

    Keywords:      Audit Failure

    User:          N/A



    A handle to an object was requested.


    Security ID: mydomainmyaccount

    Account Name: myaccount

    Account Domain: mydomain

    Logon ID: 0x2db3b20


    Object Server: PlugPlayManager

    Object Type: Security

    Object Name: PlugPlaySecurityObject

    Handle ID: 0x0

    Process Information:

    Process ID: 0x38c

    Process Name: C:WindowsSystem32svchost.exe

    Access Request Information:

    Transaction ID: {00000000-0000-0000-0000-000000000000}

    Accesses: Unknown specific access (bit 0)

    Access Reasons: –

    Access Mask: 0x1

    Privileges Used for Access Check: –

    Restricted SID Count: 0

    Any thoughts on how to resolve this?



  76. Eli Ripoll says:

    Hi John thanks for your work on this, Im hoping you can help me i have been struggling for weeks on this i can get past the step where we need to use server management to get to the WMI control properties (CIMv2) i cant remote manage the Hyper V server and it doesnt have a local gui so it has to be remote. i beleive i did all the steps and im not sure if the problem is on the client end or the server end. but i am unable to use server management remotely: the error i get is:

    WinRm cannot process the request. the following error occured while using kerberos authentication: the network path was not found.

    I have gone over the individual PART’s looking for anything i missed as well as the HVREMOTE documentation. not sure what to do next it would be easier if i can see the event log but i can since i cant connect. Any help would be very appreciated. thanks again.

  77. benjamin says:

    I have a question.

    I am having a Windows 7 Hyper-v Manager in domain 1

    and i am having Hyper-V Core installation in a DMZ domain ( seperated domain)

    How can i connect from my windows 7 manager to my dmz server while they are both in a diffrent domain?



  78. eightbitzme says:

    Hello John, thank you so much for this article.
    I've some problems with my user, trying to connect and to manage my hyperV server.
    If I add a user as local admin on the hyperV server, this user can do everything (remote connection, remote management…)
    I creat a new user, without any admin right and I follow your article, this user can now remote manage the server but he can't remote connect to it and the remote management is very limited : I can't see VM, I can't creat VM… I can only "start services" whereas in admin, I can see VM, start and creat VM…

    Can you help me ? (I used a HyperV server 2012, an AD on Windows Server 2012 and a client on Windows 8)
    Sorry for my english, I'm french and I hope you could understand my problem.

    Thank you very much