Hyper-V Remote Management Configuration Utility (HVRemote)

HVRemote reduces the manual configuration steps needed for Hyper-V Remote Management down to a few simple commands, and can diagnose common configuration errors.

 
 
 
 
 
4.7 Star
(125)
Add to favorites
10/24/2016
E-mail Twitter del.icio.us Digg Facebook
  • Windows 7 manage Server2012 R2 Hyper-V
    2 Posts | Last post February 14, 2014
    • I get following event at the end, when i start hvremote [/mode:client] /show [/target:ServerComputerName]
      
      you are attempting to connect to a newer version of Hyper-V
      While some remote management *may* be possible, you should use a matching operating system version on the client for full managment capabilities
      
      What can i do?
    • I need to update the utility to be more accurate in the Windows 7 to Windows Server 2012 R2 case. While this was true prior to Windows Server 2012 R2 in that some remote management capabilities were possible with a downlevel client, this is not the case here. This is because Windows Server 2012 R2 only has support for the v2 virtualization WMI namespace which the Windows 7 client knows nothing about. The only solution is to migrate to a newer client - ideally in this case 8.1 as it has full capabilities and knowledge of the server capabilities.
  • Great Tool
    4 Posts | Last post February 04, 2014
    • Works a treat in providing user access to manage the Hyper V server remotely. However I need to allow the user to only view the VM's. Is this where I need to use the AZmon and scoping options from your blog?
    • It depends is the answer. AZMan support in Hyper-V is deprecated in Windows Server 2012 R2, SCVMM is the best way to provide that capability. For previous versions of Hyper-V, then yes, you can use AZMan.
    • What I meant to say is I only need to give a user access to a certain VM via VMconnect.exe. Is Azman and scoping the best way forward for this? I have setup a role definition that has access to read service configuration and reconfigure service. I was hoping this would at least allow the viewing of the VM's on the Hyper V server, which has not worked in my testing. I hope that makes some sort of sense.
    • Sorry John, just saw your post. Thanks for the answer. We only have 08 core at the moment.
      
      Anyway, good little tool and it's impressive to see the effort you make in providing this information.
  • Is Windows 8 Pro required?
    1 Posts | Last post October 30, 2013
    • I am trying to get this to work on Win 8.1 (standard), and before on 8. Installed the RSAT successfully, but I do not see the "Hyper-V Tools" option under "Turning on features". Everything else seems to be there. Was the same under Win 8. 
      All the MS documents seem to suggest that Win 8 is sufficient for managing Hyper-V Core, especially via GUI. Is Pro required to use this?
      
      This is what I keep getting:
      
      INFO: OS is 6.3.9600 64-bit Microsoft Windows 8.1
      INFO: Assuming /mode:client as the Hyper-V role is not installed
      
      ***** You need to enable a Windows feature to run the Hyper-V
      ***** Management tools:
      *****
      *****  - From the Start screen, type 'Settings and Features'
      *****  - Select 'Settings' under Search at the top right
      *****  - Click 'Settings and Features
      *****  - Click 'Turn Windows features on or off'
      *****  - Expand the tree to check 'Hyper-V Management Tools' under
      *****    Hyper-V
      *****  - Click OK to enable the feature.
      *****
      ***** Once the feature is enabled, Hyper-V Manager will be
      ***** located on the Start screen.
      
      
  • Error: Query for group with SID S-1-5-32-578 got 0 hits
    9 Posts | Last post October 25, 2013
    • Hi John,
      
      I'm trying to add a user using the /add:domain\user on the server running the hyper-v. However, I receive the following error and the script stops:
      DEBUG: Getting localized group name for Distributed COM Users
      DEBUG: GetGroupNameForSID: S-1-5-32-562
      DEBUG: GetGroupNameForSID: RC=0 GroupName=Distributed COM Users
      DEBUG: Distributed COM Users group name (localised) is 'Distributed COM Users'
      DEBUG: Getting localized group name for Hyper-V Administrators
      DEBUG: GetGroupNameForSID: S-1-5-32-578
      ***** Error: Query for group with SID S-1-5-32-578 got 0 hits
      DEBUG: GetGroupNameForSID: RC=-1 GroupName=
      DEBUG: Hyper-V Administrators group name (localised) is ''
      
      Any idea on how to solve this?
      Thanks
    • Robbie - What version of Hyper-V is this, and is it Windows Server or Hyper-V Server?
    • In fact, thinking some more, the SID should exist on any version of Windows 8 x64 or Windows Server 2012 (and Hyper-V Server 2012), regardless of whether the Hyper-V role has been added or not. Further, the code explicitly checks to only get the group name if the OS is Windows 8, not on down-level, so this is making no sense at all. Values of BuildLabEx and ProductName from HKLM\Software\Microsoft\Windows NT\CurrentVersion would be useful. As would the full output of HVRemote /show (with no debug at this point - too verbose).
    • Hi John,
      
      This is a Windows Server 2012 Standard with Hyper-V role.
      
      HKLM\Software\Microsoft\Windows NT\CurrentVersion\BuildLabEx: 9200.16551.amd64fre.win8_gdr.130306-1502
      The requested output is here: http://pastebin.com/S4WtYc5i
      
      Maybe the following might have caused the problem:
      We had originally another server (2008R2) with Hyper-V role install in the same domain.
      Next we added a new Server in the domain (2012) and next activated the Hyper-V role on this server. 
      Once this was up & running, we  removed the Hyper-V role from the first server.
      So there is now 1 server in the domain with the Hyper-V role.
    • The build is correct, but there is something very wrong on that machine as the group "Hyper-V Administrators" appears not to be present. This is part of Windows Setup, not Hyper-V itself which creates the well known group with the SID S-1-5-32-578.
      
      
      For example, in this bit of output from the ACL on one of the WMI namespaces, I can see that the SID has been added to the ACL, but it cannot be resolved to a name which is why line 75 below is showing just "\" - it would normally show domain\userorgroup
      
      
      75.\    (S-1-5-32-578)
      76.     Allow: EnabAct RemEnab (33)
      77.     Flags: InheritAce InheritedAce ValidInheritFlags  (18)
      
      This should have nothing to do with having another server in the domain or not - the group itself is a local group unique to each machine, not a domain based group.
      
      I'm going to ask some colleagues if they can think of any reason why the group would not exist on this machine. Unfortunately, if it doesn't exist, creating a group with the same name will have a different SID and the problem will still exist which may mean a re-install. In the meantime, can you check computer management (compmgmt.msc) under Local Users and Groups\Groups to see if Hyper-V Administrators even appears in that list? Also paste the output of the following from an elevated powershell prompt (all on one line)
      
      gwmi win32_group -filter "domain='.'" | fl status,name,caption,description,localaccount,sid,sidtype,path
      
      There should be among the output the following section:
      
      
      status       : OK
      name         : Hyper-V Administrators
      caption      : .\Hyper-V Administrators
      description  : Members of this group have complete and unrestricted access to all features of Hyper-V.
      localaccount : False
      sid          : S-1-5-32-578
      sidtype      : 4
      Path         : \\JHOWARD-990\root\cimv2:Win32_Group.Domain=".",Name="Hyper-V Administrators"
      
    • Robbie - as I thought, confirmed that the security account manager should create the group unconditionally on all server SKUs. Is it possible you can zip and get to me (for example there is a contact/email-me link on my blog) the contents of the system and setup event logs from the event viewer. And also everything under %windir%\panther could be useful. This is to take a look to see if there are any setup errors around the time of OS setup.
    • For others - this was taken offline. It looks like there was an OS setup issue where the group was not created, the reason why is still being investigated. Robbie does have a workaround for now.
    • Hello. The "Hyper-V Administrators" group isn't present on my Windows 2012 Server. It is a Domain Controller for a domain having also another Windows 2008R2 domain controller. May be this group is only present on member servers?
      Your scripts stops showing the error message "***** Error: Query for group with SID S-1-5-32-578 got 0 hits".
      Thank you for your support!
    • Great. Thanks for sharing
  • Server and client in different domain
    2 Posts | Last post September 23, 2013
    • Let consider this situation
      
      Server: a domain controller in domain A, Windows Server 2008 R2 Core
      Client: a domain controller in Domain B, Windows Server 2008 R2 Full Installion
      
      I want to use client to manage Hyper-V service in Server remotely. Is it possible?
      
      
    • That is a tricky one, and certainly one I cannot recommend. Ignoring the DC part for one second:
      
      If A & B are in the same forest and there is 2-way transitive trust, regular domain client to domain server config should work.
      
      If A&B are in different forests, no trust, then you would have to treat both machines as workgroup machines in the configuration. 
      
      However, remember domain controllers do not have local accounts so this is where it gets much harder and in territory I haven't tested are really against every recommendation we have on deployment. As this is 2008 R2, you don't have the Hyper-V Administrators group. However, you should be able to still run /add on DC-A to add a domain account from domain A. Then use cmdkey on DC-B to authenticate as A\User to  DC-A(this assumes no transitive trust/equivalent to workgroup).
      HTH
      John.
  • where is the download button??
    2 Posts | Last post September 02, 2013
    • where is the download button??
    • On the description tab, immediately below it where it says attachments. 
  • Failed to query registry
    3 Posts | Last post August 30, 2013
    • I had access working just fine between Win7 and 2008r2 Core, both in workgroups and after a recent update and reboot I am unable to connect, Access Denied in Hyper V Manager so might as well go through the process again I assumed. Yes I was in an elevated prompt.
      
      Second step fails however on the client (Win7)
      cscript hvremote.wsf /anondcom:grant
      
      Hyper-V Remote Management Configuration & Checkup Utility
      John Howard, Hyper-V Team, Microsoft Corporation.
      http://blogs.technet.com/jhoward
      Version 1.07 26th June 2013
      
      INFO: Computername is win7
      INFO: Computer is in workgroup WORKGROUP
      INFO: Current user is Win7\User
      INFO: OS is 6.1.7601 64-bit Microsoft Windows 7 Ultimate
      INFO: Assuming /mode:client as the Hyper-V role is not installed
      INFO: Remote Server Administration Tools are installed
      INFO: Hyper-V Tools Windows feature is enabled
      
      INFO: Obtaining current Machine Access Restriction...
      ***** GetMachineRestrictionSDFromRegistry failed: Failed to query registry
      ***** 0
      Giving up as unable to obtain machine access restriction security descriptor
      INFO: HVRemote complete
      
    • That's a new one. All it's trying to do is read a registry key.
      
      Can you open RegEdit and verify that a REG_BINARY key is populated under HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\MachineAccessRestriction. Don't need to know the value.
      
      Can you also edit the third line in this block of code. At line 3472 in version 1.07 
      
                  if (err.number) or (lReturn) Then 
                      Error "GetMachineRestrictionSDFromRegistry failed: Failed to query registry"
                      Error err.number & " " & err.description   <----- THIS ONE
                      lReturn = -1
                  end if
              end if
      
      To
      
                      Error err.number & " " & err.description  & " " & lReturn
      
      That might give me some pointers as to why the GetBinaryValue call is failing.
      
      Can you also let me know what updates have been applied? It will take me some time though to create a mirror setup to try to repro this.
      
    • Correction - line 3460
  • windows 8 pro as server supported?
    2 Posts | Last post July 22, 2013
    • I do not see w8 pro as a supported system for hosting hyper-v server in the list of 'supported server' OS-es.. any plans to add it in future...?
      
      many thanks!
    • Yes, this will work too.
      John.
  • Failover Cluster Compatibility
    2 Posts | Last post July 16, 2013
    • John, I am running a Microsoft Failover Cluster using W2K8R2 Datacenter Edition ("the servers"). I have installed RSAT on my W2K8R2 Std Ed. Domain Controller ("the client"). While implementing then Center for Internet Security (CIS) Security Configuration Benchmark for Microsoft Windows Server 2008, the settings for Windows Firewall induced much pain and suffering. VMs failed or went critical, nodes dropped from the cluster, iSCSI (VHDs are on a Cluster Shared Volume) etc. It also impacted my ability to remotely run the Hyper-V Manager and Failover Cluster Manager MMCs (.
      
      I would like to shut down all VMs, re-enable Windows Firewall per CIS specifications and then run HVRemote. What do you think? Does HVRemote currently address Failover Clusters and iSCSI storage?
    • Vint - HVRemote -only- deals with the direct configuration required for remote management of a server running Hyper-V from a client running Hyper-V Manager. It does not configure anything else. Unless overridden by group policy, or CIS has applied other lock-downs not related to the Hyper-V firewall settings, HVRemote should work for Hyper-V Manager MMC connecting remotely. 
  • Connect to root\cimv2 WMI namespace fail
    2 Posts | Last post July 02, 2013
    • Hi John,I followed the steps for the Domain client/Workgroup Server instructions on Windows 8/Server 2012 but HVRemote /show /target:servername on client fails. On the server the same command fails to ping my machine as it is behind a router and I have no idea of how to route the server call to my machine... Help...
      
      Carlo
    • Carlo - I really can't help with configuring your router... Just please tell me that the router isn't Internet facing and you have your Hyper-V machine directly Internet facing and that's what you're trying to connect to from another site. That is a particularly bad idea for so many reasons I've iterated multiple times in comments on my blog posts about remote management. 
      Thx
31 - 40 of 41 Items