Rob 的个人资料Virtually Aware日志列表 工具 帮助

日志


Hyper-V Constrained Delegation of Authority - Remote Mounting of ISO with Management Console

I have been working with Hyper-V for a while and have had this problem with mounting ISO files that sit on a common file share within our organization.  The problem was when I tried to mount them from my remote Hyper-V management console I would get the error below.  If I mounted it from the Hyper-V host Hyper-V management console everything worked as expected.

image

This stumped me for a while, but then I got to thinking.  Where had I seen this before....  Virtual Server 2005.  Constrained delegation of authority settings on the Virtual Host objects was necessary there in order to both mount remove ISO images and in order to manage the virtual hosts from a common management web page.  So I made similar modifications to my Hyper-V host objects and now all seems to be working correctly.  Below are the steps I took to make mounting ISO images with my remote Hyper-V management console, work like a charm

 

Open Active Directory Users and Computers, Right-Click the Hyper-V host server object and select properties.  Then click on the Delegation tab. 

image

Select "Trust this computer for delegation to specified services only" and "Use any authentication protocol."  Then click "Add"  to select the service necessary to pass credentials to the remote file server where your ISOs are located.

  image

Click on "Users or Computers"

image

Enter the name of the remote resource you need to pass credentials to through the Hyper-V Host and click OK. (i.e. File Server that houses your ISO images)

image

Select CIFS as the service type and click OK twice.

 

The refresh on this procedure can take a few minutes to propagate to the Hyper-V host object.  Once this is completed you will be able to successfully mount an ISO from your remote Hyper-V management console.  I suspect that this type of information will be in the final Hyper-V documentation, but as of yet, I have not seen any public documentation outlining this.  If I missed anything or you have any questions, feel free to comment or send an email along. 

评论 (3)

请稍候...
很抱歉,您输入的评论太长。请缩短您的评论。
您没有输入任何内容,请重试。
很抱歉,我们当前无法添加您的评论。请稍后重试。
若要添加评论,需要您的家长授予您相应权限。请求权限
您的家长禁用了评论功能。
很抱歉,我们当前无法删除您的评论。请稍后重试。
您已超过了一天之内允许提供的评论数上限。请在 24 小时后重试。
因为我们的系统表明您可能在向其他用户提供垃圾评论,您的帐户已禁用了评论功能。如果您认为我们错误地禁用了您的帐户,请联系 Windows Live 支持部门
完成下面的安全检查,您提供评论的过程才能完成。
您在安全检查中键入的字符必须与图片或音频中的字符一致。
McShinskyR​ob 在此页禁用了评论功能。
Hi! As we can see, this method is still not documented oficially yet. And worst of all it didn't work for me. I've tried it two completely separated environments — test and producion.
 
Did you test it with the final version of Hyper-V? Are there some expected requirements or additional procedures you didn't mention?
 
By the way, the error dialog now clearly suppose you provide access rights for Host computer account to the network share. Seems very confusing for me.
 
Thanks in advance
10 月 29 日
Actually, constrained delegation is required if you are administrating from a remote computer. If you have the full version of Windows Server 2008 installed as your Hyper-V Node this is unnecessary because you can run the Hyper-V management console directly from the node. If you are using Server Core however, there is no Hyper-V management console, so you need to allow your remote workstation permission to speak to the NAS on behalf of the Hyper-V Node. Of course, running with Server Core is always recommended ;)
10 月 10 日
匿名 的图片
Nick 发表:
?? - All you need to do is add the computer account of the Hyper-V server to the Share & NTFS permissions of where the ISO file is stored. There is no need for all the above changes.
 
When adding the Computer account to the share permissions, you need to enable the dialog to show computer accounts as well.
7 月 23 日