Failure to connect with cryptic error message: “user account cannot access machine’s video”

hyper-v

I am a user researching for my admins. Since recently, I cannot connect to my Hyper-V VM with Virtual Machine Connection.

  1. On the first try I receive the error message "This user account cannot access the virtual machine's video."
  2. On the second try, the machine has vanished from the list of virtual machines and typing the name manually yields the error message "An error occured trying to find the virtual machine $vm on server $host. Cannot find virtual machine with the name $vm."
  3. The VM will reappear in the list ofter some time and things start again with (1.)

Other machines from the same master image fail to start with the error message "$vm failed to change state. You do not have the permission to perform the operation."

The responsible admin claims that no changes have been made to the permissions settings. It may be possible that other admins have tampered with the system though.

What unnerves me about this error is that there is only a single mentioning of this error message on the web without a viable solution.

Both servers and clients run Windows Server 2008 R2.

Best Answer

This almost certainly sounds like a change to delegated administration for Hyper-V. I'm presuming you're not an administrator on the servers involved? Well, the permissions for Hyper-V can be accessed by the admin by running the Microsoft Management Console (mmc.exe) and adding the snap-in for Authorization Manager, or an issue with the firewall, or DCOM, or WMI.

Fortunately, you or the admin don't have to know how to follow all of these steps. There is a tool, HVRemote, that takes care of everything for you: http://code.msdn.microsoft.com/windowsdesktop/Hyper-V-Remote-Management-26d127c6

It's just available as a Windows Script File, so you can look at its internals and see how it works. But the admin should just need to run hvremote /add:DOMAIN.EXAMPLE.COM\Username on the target server. There are some diagnostic tools built into it as well, to help you figure out why you're not able to access the target.

However, why are you using Virtual Machine Connection to access "your" VM? If your admins are not providing you with Remote Desktop access, they're almost certainly doing it wrong (or penny-pinching to avoid remote desktop licensing?) and this isn't ideal, and may be skirting the licensing rules for Windows or Windows Server. Just know that there are definitely better, more supported ways to access virtual machines securely than what you're doing. For example, one problem with using the VM connection as a substitute for remote desktop is that it isn't auditable if an admin connects to the console of the machine while you're logged in. There are other issues too. In general, Virtual Machine Connection is a bad way to connect to a machine.

Related Topic