Hyper-V 3.0 and the permissions

Recently I installed the first server with Windows Server 2012 and Hyper-V.

After creating the first virtual machine and a little testing, I continued with the setup. Domain join, Antivirus, the usual…

Later on I created another VM and…:
Hyper-V Virtual Machine Management service Account does not have permissions to open attachment. New Virtual Machine “ABC”: failed to add device ‘Virtual Hard Disk (Virtual Machine ID xyz)’ 
General access denied error (0x800700005).

I searched for this in the internet, but found nothing. What could have caused a permission change on the service account?

Yes, Group Policies. Our standard group policies are overwriting the following settings used by Hyper-V:
Computer Configuration => Policies => Windows Settings => Security Settings => Local Policies => User Rights Assignment:

  • Act as a part of the operating system
  • Log on as a service
  • Perform volume maintenance tasks

The solution for the problem:
Add NT AUTHORITY\SYSTEM, NT AUTHORITY\SERVICE and NT AUTHORITY\NETWORK to each of the Policies 😉

By the way: This is applicable to Windows 8 as well.

Advertisements
About

I'm a Systems Engineer working for an IT-Service Provider in Frankfurt am Main, Germany. I am specialized in Virtualization, High Availability, Storage- and Server Administration. In my free time, I like spend time with my lovely wife, to do sports like jogging and biking. I enjoy movies and a good bottle of fermented grape juice.

Tagged with: , ,
Posted in Virtualization, Windows 8, Windows Server 2012
4 comments on “Hyper-V 3.0 and the permissions
  1. I i am impressed by the products information about this website. There are a great deal of good methods

  2. Ed Baichtal says:

    Worked with gpupdate /force and no reboot, was searching for hours for solutions. Thank you!!!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: