Let\u2019s talk security for a moment, to figure out why Kerberos Constrained Delegation is required. Say you are only going to do LM inside a cluster. You do not have to enable LM in the host settings. If you do want LM between hosts that are not in a common cluster, then you need to enable LM. Then you see there are 2 authentication types.<\/p>\n
If you want quick and dirty, you pick CredSSP authentication when you enable LM. It allows you to push a VM from the host you are logged into. It\u2019s find for demo, but useless in the real world, e.g. running Hyper-V Manager from your PC or using a centralized management system. You will get security issues if trying to LM a VM and you are not logged into the host if you use CredSSP.<\/p>\n
The alternative is Kerberos authentication. This allows an authorized Hyper-V administrator to run LM from any domain member machine, therefore not requiring you to log into a host to push a VM. You might remember that mounting an ISO over a file share requires CIFS delegation. We have to do something similar to that for LM to work with Kerberos authentication.<\/p>\n
The process of enabling Kerberos Constrained Delegation via GUI is:<\/p>\n
- \n
- Enable the advanced view in ADUC<\/li>\n
- Edit the properties of the host\u2019s computer account<\/li>\n
- Edit the Delegation tab<\/li>\n
- Add the required computer accounts<\/li>\n
- Add the required service types to delegate<\/li>\n
- And the bit no one in MSFT talks\/blogs about: reboot the host that you just modified the computer object of, e.g. reboot Host2 if you edited the Host2 computer account<\/li>\n<\/ol>\n
So what computer accounts and service types you add, and where? There are 2 scenarios that I\u2019ll talk about:<\/p>\n
1) Shared SMB 3.0 Storage and Non-Clustered Hosts<\/u><\/strong><\/p>\n
You need to edit each host that can be involved in LM:<\/p>\n
- \n
- Delegate Microsoft Virtual System Migration Service for every other possible LM host<\/li>\n
- Delegate CIFS for every possible file share that LM VMs will be stored on. Use the computer account of the Scale-Out File Server (SOFS) if using SOFS, and not the node members.<\/li>\n<\/ul>\n
![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2012\/11\/image_thumb.png\" "\\"image\\"")
<\/a><\/p>\n2) Shared-Nothing Live Migration<\/u><\/strong><\/p>\n
This one requires more work. For every host that can be involved in LM, you need to delegate:<\/p>\n
- \n
- Microsoft Virtual Machine Migration Service for every other possible LM host<\/li>\n
- CIFS for every other possible LM host<\/li>\n<\/ul>\n
![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2012\/11\/image_thumb1.png\" "\\"image\\"")
<\/a><\/p>\nThere\u2019s a lot of clicking involved in all that. This is why PowerShell is so \u2026 powerful. Save some time. Reduce the mistakes. Script it:<\/p>\n
$HostName = "host1"
$HostFQDN = "$HostName.demo.internal"
Get-ADComputer host2| Set-ADObject -Add @{"msDS-AllowedToDelegateTo"="Microsoft Virtual System Migration Service\/$HostFQDN", "Microsoft Virtual System Migration Service\/$HostName", "cifs\/$HostFQDN", "cifs\/$HostName"}<\/p>\nThat Set-ADObject cmdlet took me a while to figure out. I actually set the settings I required in the GUI, ran Get-ADObject and copied\/pasted the value of msDS-AllowedToDelegateTo
![\"Smile\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2012\/11\/wlEmoticon-smile.png\")
<\/p>\nYou could go create a function for the last line of the script, and just pass the name of the Host you\u2019re editing and the name of the host you want to delegate to. I\u2019m not going to do everything for you \u2026 I\u2019ve got to hold something back for the book.<\/p>\n
Speaking of which \u2026 this is just a teeny tiny snippet of Windows Server 2012 Hyper-V Installation and Configuration Guide<\/a> (available on pre-order on Amazon<\/a>). I just submitted my VM management chapter to the editors. It was 78 pages of text<\/em>. And I\u2019ve since realised that I need to add more stuff to that chapter!<\/p>\n
![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2012\/09\/image_thumb19.png\" "\\"image\\"")
<\/a> <\/p>\nTechnorati Tags: Windows Server 2012<\/a>,Hyper-V<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"In the past 3 weeks I\u2019ve delivered my 75 minutes long Live Migration session at 2 events in Barcelona (Spain) and Hamburg (Germany). The big topic in WS2012 Live Migration is being able to do Live Migration in new ways: Inside a cluster with traditional storage Inside a cluster with shared SMB 3.0 storage Between … Continue reading “Live Migration Security Failures, Kerberos Live Migration Authentication & Constrained Delegation”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[20],"tags":[181,118],"class_list":["post-13711","post","type-post","status-publish","format-standard","hentry","category-hyper-v","tag-hyper-v","tag-windows-server-2012"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2012\/11\/image.png\" "\\"image\\"")
<\/a><\/p>\n