Hyper-V Embedded broken with KB5124008

Hyper-V Embedded broken with KB5124008

avatar

resuming the conversation from:

the setup:
https://forum.devolutions.net/topics/30791/trying-to-configure-connection-to-local-hyperv-machines?message=218074#218074

the post where the problem discussion started:
https://forum.devolutions.net/topics/30791/trying-to-configure-connection-to-local-hyperv-machines?message=241627#241627

@rmarkiewicz,

Thank you kindly for your time.

Would you be willing to try one more test?

In my env, I run my primary user as excluded from the workstation administrators group. So its much more restricted.

Elevation takes place with a different user entirely. The only group it is added to is the Hyper-V group.

Would you be willing to try that?
Setup a user that is not a member of Administrators, but added to the windows Hyper-V group.
Login to desktop as this user.
Run RDM, but not elevated. Connect to localhost hyperv using this user, which is only granted by the Hyper-V group.

It may be my registry settings.

Would you be willing to export the registry settings you have?

Thanks again,
Bryan

These are mine:

AllowDefaultCredentials = Microsoft Virtual Console Service/*
AllowDefaultCredentialsDomain = Microsoft Virtual Console Service/*
AllowFreshCredentials = Microsoft Virtual Console Service/*
AllowFreshCredentialsDomain = Microsoft Virtual Console Service/*
AllowFreshCredentialsWhenNTLMOnly = Microsoft Virtual Console Service/*
AllowFreshCredentialsWhenNTLMOnlyDomain = Microsoft Virtual Console Service/*
AllowSavedCredentials = Microsoft Virtual Console Service/*
AllowSavedCredentialsDomain = Microsoft Virtual Console Service/*
AllowSavedCredentialsWhenNTLMOnly = Microsoft Virtual Console Service/*


$keys = "AllowDefaultCredentials","AllowDefaultCredentialsDomain","AllowFreshCredentials","AllowFreshCredentialsDomain","AllowFreshCredentialsWhenNTLMOnly","AllowFreshCredentialsWhenNTLMOnlyDomain","AllowSavedCredentials","AllowSavedCredentialsDomain","AllowSavedCredentialsWhenNTLMOnly"

foreach ($key in $keys) {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\$key"
    $value = (Get-ItemProperty -Path $path -Name "Hyper-V" -ErrorAction SilentlyContinue)."Hyper-V"

    if ($null -ne $value) {
        "$key = $value"
    } else {
        "$key = <not present>"
    }
}

All Comments (3)

avatar

Hello

I did try it: I logged in as my "TestUser" account directly, opened RDM, configured the entry as written and it still worked fine.

The TestUser is a only a member of: Users, Hyper-V Administrators and Remote Desktop Users (needed because my workstation is headless).

And this is a workgroup environment. I also checked my registry and every key is <not present>.

Hopefully this helps to narrow it down?

Kind regards,

Richard Markievicz

avatar

I will try removing the registry keys as soon as I can. Thank you for the quick feedback.

avatar

Hello

Let us know how you get on. From reading the original post, it seems that change is only required when HyperV is running on a remote host which doesn't seem to be your case. It's also 12 year old information which may or may not be relevant (who knows what Microsoft has changed...)

Best regards,

Richard Markievicz