Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I have a domain controller that is a virtual machine, last week a user logged on to it and shut it down accidentally. I need to prevent this from happening so I would like to hide this VM in Hyper-V so that users can not see it there. I have already restricted RDP connections to it, but they can still connect locally in Hyper-V.

We have a script that we use to do this called SetScope.VBS that we found online and it usually works well, I used it for a different VM DC on a different physical server and it worked perfect, that VM no longer shows up for anyone but admins.

On this particular server and VM though, it gives me a 4096 error (in case anyone is familiar with this script: http://projectdream.org/wordpress/2008/07/03/delegating-hyper-v-virtual-machines/ )

There's really no help for this error online so I think I'm out of luck trying to use this script for this VM.

Any other ideas how I can prevent certain users from logging on locally to a Virtual Machine in Hyper-V?

share|improve this question
You have a method for getting this done, and are getting an error. Posting details about the error might help people to solve your issue without reinventing the wheel, a quick google indicates it's a fairly common error that can be caused by many things, and more detail would help you get this answered. – smithian Oct 18 '12 at 16:55
I'm sorry but unfortunately I don't really have much more detail, all I get is a 4096 error running this script and that's it. I'm not sure what else I can say. I googled this too before posting here and only found one concrete idea to try which was no help. If you are finding a lot of resources on google, please pass me the links and I'd be happy to research them on my own. If there are specific questions I can answer for you or anyone else to help I am happy to as well. I'll also add that the error itself is not helpful - it simply says "4096" - which the website says indicates a failure – Mike Oct 18 '12 at 17:25

2 Answers

up vote 1 down vote accepted

I gathered from the comments to MDMarra's answer that some users need (need or want?) to be able to start and stop VMs. If users do have a valid case for having direct control over a server, such as when they are used for dev work, consider placing those VM's on the users' workstations. Use whatever virtualisation product you like for the job, such as Virtualbox, VMWare Player, Virtual PC, etc.

Your situation screams two fundamental problems:

  1. The rule of least privileges should always be applied.
  2. Never allow users to access or do anything for which you might be held accountable. It's easy enough to make mistakes. You don't need users making them for you.
share|improve this answer
up vote 20 down vote

Why on earth are your regular users allowed to log into a Hyper-V host that is running production VMs? What you need to do is not let regular users administer Hyper-V hosts. That's just crazy. They have to either belong to a group like Domain Admins or be a local admin on the host to be able to do this. You should take these privileges away immediately.

share|improve this answer
5  
I can't +1 this enough times. – ceejayoz Oct 18 '12 at 15:40
4  
@Mike That's no better. Why can they access the Hyper-V manager? – ceejayoz Oct 18 '12 at 15:41
2  
@Mike Right, that's what I was asking. Why on earth do normal users have this ability? That's not a standard design. What business case would there be for a regular (non-IT) user to be able to power up and down servers? They shouldn't even have physical access! – MDMarra Oct 18 '12 at 15:44
2  
@Mike What you're describing is not normal at all. Typically, if a user needs access to a remote workstation, it's done via Remote Desktop, not Hyper-V Manager, precisely because of what you're seeing. If your regular users need centralized resources, you should be using Remote Desktop Services (formerly Terminal Services) and they should be using Remote Desktop for access. It's rare (to the point that I've never ever seen it) for users to have console access to a server hosting VMs, whether it be Hyper-V, ESXi, etc. – MDMarra Oct 18 '12 at 15:47
4  
In short: While your problem can likely be fixed via technical means, you do not have a technical problem, you have a fundamental design problem. You should be working to fix that instead. – MDMarra Oct 18 '12 at 15:48
show 9 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.