Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am a user researching for my admins. Since recently, I cannot connect to my Hyper-V VM with Virtual Machine Connection.

  1. On the first try I receive the error message "This user account cannot access the virtual machine's video."
  2. On the second try, the machine has vanished from the list of virtual machines and typing the name manually yields the error message "An error occured trying to find the virtual machine $vm on server $host. Cannot find virtual machine with the name $vm."
  3. The VM will reappear in the list ofter some time and things start again with (1.)

Other machines from the same master image fail to start with the error message "$vm failed to change state. You do not have the permission to perform the operation."

The responsible admin claims that no changes have been made to the permissions settings. It may be possible that other admins have tampered with the system though.

What unnerves me about this error is that there is only a single mentioning of this error message on the web without a viable solution.

Both servers and clients run Windows Server 2008 R2.

share|improve this question
    
You need to have appropriate rights to the VM to access it's video. Can you RDP into the VM with the same user? –  user142401 Oct 23 '12 at 19:15

2 Answers 2

up vote 0 down vote accepted

This almost certainly sounds like a change to delegated administration for Hyper-V. I'm presuming you're not an administrator on the servers involved? Well, the permissions for Hyper-V can be accessed by the admin by running the Microsoft Management Console (mmc.exe) and adding the snap-in for Authorization Manager, or an issue with the firewall, or DCOM, or WMI.

Fortunately, you or the admin don't have to know how to follow all of these steps. There is a tool, HVRemote, that takes care of everything for you: http://code.msdn.microsoft.com/windowsdesktop/Hyper-V-Remote-Management-26d127c6

It's just available as a Windows Script File, so you can look at its internals and see how it works. But the admin should just need to run hvremote /add:DOMAIN.EXAMPLE.COM\Username on the target server. There are some diagnostic tools built into it as well, to help you figure out why you're not able to access the target.

However, why are you using Virtual Machine Connection to access "your" VM? If your admins are not providing you with Remote Desktop access, they're almost certainly doing it wrong (or penny-pinching to avoid remote desktop licensing?) and this isn't ideal, and may be skirting the licensing rules for Windows or Windows Server. Just know that there are definitely better, more supported ways to access virtual machines securely than what you're doing. For example, one problem with using the VM connection as a substitute for remote desktop is that it isn't auditable if an admin connects to the console of the machine while you're logged in. There are other issues too. In general, Virtual Machine Connection is a bad way to connect to a machine.

share|improve this answer
    
Thanks a lot for the extensive reply. Since I don't think there will be a better answer to this, I'm accepting it. Btw, we don't have that problem any more. Also: access by remote desktop is possible, I simply didn't think of it back then. The machines are for testing purposes only and run locally. They are configured with an internal network as to not disrupt operations. –  Jonny Best Jul 11 '13 at 21:36

I ran into this problem today on Server 2008 R2, and the HVRemote tool, and other recommendations above didn't fix it.

We have a pair of Hyper-V hosts that are not clustered or domain joined, hosting several windows VMs. The hosts had been running for almost a month, and there had been no changes made via authorization manager.

We started getting the “user account cannot access machine's video” on one host in the morning, and then started getting it later that same day on the other host. Both of these hosts had been built at roughly the same time.

There were 3 things we did to resolve it:

  1. Manually add the appropriate user to the role assignment in AzMan. Even though the user's group (in our case "administrators") was already a member, adding the user directly to the role solved it on one host. And removing that user from the manual role assignment left it working.
  2. Disable and re-enable the "allow saved credentials", this fixed it on the other host.
  3. These fixes were attempted independently on each server, in each case with the user the logging off and on again, both servers had long running sessions that may have also contributed to the problem.

Before trying the above, we also tried creating a new user account in the administrators group, with the appropriate role assignment via their local group (not directly in the role assignment), with no success.

I have a suspicion that the problem is caused by the role assignments possibly being corrupted or "expiring" after some time, as both servers encountered this problem as similar times, and both are not domain joined, and have their authorization stores stored locally.

share|improve this answer
1  
Welcome to Server Fault! If you have another question, please ask it by clicking the Ask Question button. –  HBruijn Jun 16 at 6:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.