3

I have a Windows 2012 Server with Hyper-V enabled and a few virtual machines.

My current configuration has a few account in the "Log on as a service" list in the domain policies, and sometimes this prevent my virtual machines from starting (I get this error: 'Error 0x80070569 ('VM_NAME' failed to start worker process: Logon Failure: The user has not been granted the requested logon type at this computer.')

As described in this KB I would like to add NT Virtual Machine\Virtual Machines to my "Log on as a service" list to resolve my problem.

My problem is that when I try to add that user to my domain policy I get an error message: "The following account could not be validated". My domain controller obviously doesn't know about that user since it's not an Hyper-V enabled server.

How can I add that account to my Domain Policies?

4
  • THis has nothing to do with separate machines but all with a bad configured domain? Or multiple domains without trust? I repeatedly manage multi dc / domain Hyper-V instances without any issues.
    – TomTom
    Oct 15, 2013 at 7:32
  • I have a single domain. It may be badly configured but afaik it is not. The DC is a VirtualMachine inside a Windows2012 server... How can the DC knows about "NT Virtual Machine" group? I don't have hyper-v installed on my DC... Oct 15, 2013 at 8:06
  • 1
    The KB is most likely describing editing the local security policy, and not a domain policy (although the kb is fairly badly written in that respect). By editing the local security policy, you should have access to the "NT Virtual Machine" group. However, any domain-based policies will override the local one, so make sure you don't have any conflicts there.
    – Trondh
    Oct 15, 2013 at 9:12
  • So basically the domain policy for logon as a service users is incompatible with Hyper-V? Oct 17, 2013 at 13:23

3 Answers 3

2

Looks like the quoted KB has been updated:

LINK: http://support.microsoft.com/kb/2779204/

Solution:

Perform the following steps on the Hyper-V host machine:

  1. Logon as a Domain Administrator

  2. Install the Group Policy Management feature from the Server Manager console

  3. After installation, open the GPMC MMC snap-in and browse to the policy that manages User Rights

  4. Open the Group Policy Management console and browse to the policy that manages User Rights

  5. Edit the policy to include NT Virtual Machine\Virtual Machines in the entries for Log on as a Service

  6. Close the policy editor and initiate a gpupdate /force on the Hyper-V host computer to refresh policy. (You may need to wait several minutes for Active Directory replication to occur).

This enabled me to add NT Virtual Machine\Virtual Machines to my domain policies regarding users allowed to log on as service.

3
  • This still does not work. Oct 4, 2016 at 18:25
  • I was able to make it work following the linked KB, which problems are you having? Oct 7, 2016 at 17:07
  • The trick is to "Perform the following steps on the HYPER-V HOST MACHINE". If you don't the "NT VIRTUAL MACHINE\Virtual Machines" entry will not be recognized and cannot be added. If you go back to a non-virtual machine, the SID will show up instead as "S-1-5-85-0".
    – Brain2000
    Mar 24, 2021 at 20:32
0

You need to add in S-1-5-83-0 instead of NT Virtual Machine\Virtual Machines. see https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/security-identifiers-in-windows By adding S-1-5-83-0 to the policy instead of the name you can get past your "could not be validated" error.

0
-2

I also had this problem with Windows 8.1 in an environment with 2008 R2 servers.

This site and this site helped me.

They explain how you can edit your domain GPO e.g. locally on your Hyper-V server to enable the special VM user to log on as a service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.