Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 16:14:14 Z

Greetings,

When I try to configre the guest OS settings to mount the CD/DVD drive to an ISO image I have setting on a file share, I consistently get an error. The only time I have been able to mount an ISO since upgrading to RC0 (I don't remember if I tested this in the BETA) is when the ISO is locally on the Windows 2008 Hyper-V server.

To be specific, I get the following error:

Virtual Machine Connection (title of the window)

Inserting the disk failed.

Failed to add device 'Microsoft Virtual CD/DVD disk'.

User account does not have sufficient privelage to open attachment '\\remoteserver\share\ISONAME.ISO'.

Error: 'General access denied error'

'NEWGUESTOSNAME' failed to add device 'Microsoft Virtual CD/DVD Disk'. (VMID 26C8B66F-5D3F-47F9-9D80-474D0F778522)

'NEWGUESTOSNAME': User Account does not have sufficient privelage to open attachement '\\remoteserver\share\ISONAME.ISO'.

Error: 'General access denied error' (0x80070005). (VMID 26C8B66F-5D3F-47F9-9D80-474D0F778522)

I am not sure what credentials it is using. It looks almost like it is using the new computer name as credentials or something like that. The account I am logged in as at the time is a Domain Admin and has access to every server and every share. I can browse to the ISO just fine through the Hyper-V Insert Disk function, it just won't take.

I have checked the Hyper-V server settings and the Guest OS settings and can't find where to specifcy what account to use to connect to remote ISOs. Anyone have any clue on what I am doing wrong?

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 16:20:45 Z

Are you running the management UI on the same computer as Hyper-V - or are you running it remotely?

Cheers,

Ben

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 16:29:52 Z

Excellent question - I forgot to mention the set up. My apologies.

The Hyper-V server is running on a Windows 2008 Enterprise Edition Core server. I am managing it from a different server running Windows 2008 Standard Edition (non-core). When I am trying to manage the Guest OS'es, I am RDP'ed into my Windows 2008 Standard Edition server and running the Hyper-V manager on it against the Windows 2008 Enterprise Edition Core server.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 20:06:11 Z

It has to do with user credentials.

You are initializing the control connection to Hyper-V. Hyper-V then has to initiate the connection to the remote share (using what credentials?).

in order to do what you suggest your user session would need to be simulated on the Hyper-V server (thus spoofing your identity on the network - a security no,no).

With a Server Core install you might want to consider having your ISOs on an iSCSI disk that you can mount to the host to build your VMs.

SCVMMv2 will of course have the Library (which can be a file share) that you can store items in.

Which will solve the puzzle.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 20:18:14 Z

I guess I don't understand something.

If I am not allowed to pull an ISO image over the network, then why would both the Hyper-V manager's settings on the Guest OS, and the Hyver-V Guest OS console both allow me to browse the network from the file finder? They should throw up an error saying something to the effect that only ISO images local to the Hyper-V server can use used.

And I am not sure I agree with you that my user session would need to be simulated either, and why doing it this way would be a no-no.

When I use VMWare's Infrastructure client (say running on another server against the VMWare server), I can mount the remote network share ISO through the client console using the credentials I am already logged in with. I.E. The client console is running under my credentials and "connects" the ISO image to the virtual CD drive to the VMWare Guest OS through the client. That's no different that Windows Explorer using my credentials to go and get the remote ISO, neither of which is a security no-no.

So perhaps this is a bug with the RC of Hyper-V, and they should either allow you to specify the credentials to use to connect to the remote ISO image, or use the credentials you are running the Hyper-V console as to connect the Guest OS to the ISO.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 21:13:11 Z

In the VMware case the VMware VI Client is performing that function - it is not happening at the ESX server (or Virtual Center server) itself.

In the Hyper-V case the ISO is being mounted by the Hyper-V server itself and your session does not exist there - your session is remote.

(the difference is in the way the client works - not the Host) And since we are talking remote clients here we are talking authentication tokens which cannot be spoofed, only user credentials.

Prior to the VI client allowing this we had to copy ISOs into the vmimages partition on the ESX server (no different than where Hyper-V is today).

Hyper-V is a v1 product and you are still working with an RC build. So things can still change.

VMware's product is many revisions farther along.

And, like I mentioned, SCVMM will change this as the ISO can exist in the "Library" from where it can be used by any of the Hyper-V Hosts.

I am just stating how they are and work, not arguing that one is better or deficient.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 10 Apr 2008 22:05:27 Z

Hi Hotfix,

SCVMM has the ability to do this and I think that if you do it the same way it will work...

Basically in order to it to work the computer account of the Host Server (in this case the Hyper-V machine) needs to have read access on both the share and ntfs level permissions. So if you add the permissions for that machine, then the computer will be able to authenticate instead of relying on user credentials.

-matt

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Fri, 11 Apr 2008 15:14:28 Z

I am dissapointed to hear that that th Hyper-V console doesn't provide you a way to tell the Guest OS VM on the Hyper-V server how to connect to the ISO share.

I don't think adding the machine account to the permissions will work, as I am trying to get these servers access to the install media - meaning they aren't even a Windows box yet let alone a member of AD.

I appreciate that SCVMM will hopeflly provide the same functionality as the Infrastructure Server/Client role in VMWare, it's just dissapointing that the Hyper-V console lets you specific the locaiton of a network based ISO using your credentials, and then tries to use other credentials to get to the ISO. That part just doesn't make sense to me.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Fri, 11 Apr 2008 15:39:13 Z

The hitch in your case is that you have a Server Core hyper-V box and the restrictions (flexability reduced) that it applies to accomplish tasks.

If it was a Server Full install I would tell you to just RDP to the Host and create your VM through the RDP session and then it would work as you would like it to. Then you would build the VM within the RDP session (becuase you could attach the ISO from within your RDP session).

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Fri, 11 Apr 2008 15:48:29 Z

The machine account that I am referring to is the machine account for the machine that is running hyper-v, not the guest os. That should give you the proper authentication in order for hyper-v to mount the network based iso...

-matt

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Fri, 11 Apr 2008 19:22:13 Z

Thanks for the various replies.

Understood it is an issue with the Hyper-V server computer account getting the files, and not the actual guest OS. At this point I think I will just copy some ISO's to the server. I did note the last time I used a "local" ISO that I had to manually type out the local path to the files on the server, as when I tried to browse to the local server drives through the console I got an error about connecting to the local server (which wasn't really local) through the network drives. I don't remember the exact error, but I know I couldn't get it to point to the ISO on the D:\ drive through the browse feature, but rather I just typed out the path and it was fine. That too seems like a bit of a buy/annoyance as I should be able to browse files local to the Hyper-V server, and not have to type out the path.

I guess I would ask MSFT to consider changing the behavior of the console just a little before RTM if it is being run remotely against the Hyper-V server, versus locally on it, if the permissions being used to get to the remote files are going to be different depending. I.E. It is not intuitive that the same exact action in the same exact console would behave any differently when the console is run on the Hyper-V server versus remotely against the Hyper-V server. I.E. Add in a pop-up when remotely connected to the Hyper-V server to let the user know that some permissions may not proxy through (or whatever verbiage you want to use).

This will pop-up more and more as people like me try to deploy Hyper-V on Core servers, and they used Hyper-V on a normal Windows 2008 server previously.

Thanks!

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Tue, 22 Apr 2008 18:05:26 Z

Hi there,

I'm getting similar error with a W2k8 Enterprise x64 (non-core).

When adding a DVD or CD ISO to my VMs using a network share, i'm getting this error even if I let "Everyone / Full Control" on both share and NTFS security of the share.

Setup :

Hyper-V RC0 (vers.6.0.6001) on Windows x64 2008 Enterprise.

ISOs shared from a Windows Server 2003.

No domain, both in Workgroup/Workgroup.

Same Administrator User/Pass on both servers.

Error :

Settings (Display title)

Error Appliying DVD Drive Changes

Adding the device 'Microsoft Virtual CD/DVD Disk' to 'servername' failed.

You do not have permission to perform the operation. Contact your administrator if you beleive you should have permission to perform this operation.

I wish BRyan was right about getting a RDP connection to my Windows 2008 in order to get HYper-V using my administrator credentials to connect the ISO to my VM but I think HotFix got the right point by saying it's HYPER-V itself that seems to get the file and being LOCAL SYSTEM won't authentificated on another server than the HYPER-V one.

Or maybe I've miss a thing and I'm forgeting something about security or Hyper-V, so if someone can help me, please do it !

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Tue, 22 Apr 2008 18:20:44 Z

You have to RDP into a WS08 Full install and run the console within the RDP session (this works).

I have even mapped drives to shares that contain my ISO's.

It is the Core installation (and the lack of the Windows Shell that enables all of this fancy authentication trickery) that creates the hitch.

I just copy my ISO's to \users\public\documents\Hyper-V (on the host I am building VMs on) and attach them from there (default, local, open to everyone)

Or build my VMs on a WS08 Full server and then export them and copy them to my WS08 Core server and import.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Tue, 22 Apr 2008 18:43:36 Z

I'm already RDPing directly my Win2k8 server (that is full with GUI not only shell) from a XP SP2 desktop. In this RDP session I mapped my w: to my ISO share on the win2k3 server that is set "EVERYONE FC" in the permissions and eveyrone full control in the NTFS security of the folder. My RDP session is done with an account that is Local Admin on my HYPER-V server. But when I try to add a iso to a Vms, I'm getting the error stated in my previous post.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Tue, 22 Apr 2008 19:29:32 Z

I've checked in all Event Viewers, and found this :

Under Application and Service Logs, Microsoft, Windows, Hyper-V-Worker

Source : Hyper-V-Worker

Event : 12280

Type : Error

MEssage :

'VMname': The Machine Account 'VMMS' does not have read access to file share '\\my iso share\dvd.iso'. Please add this Machine account to the file share security. Error : 'General access denied error' (0x80070005). (VMID B*&?*&?*&?*&?*)

....?

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Tue, 22 Apr 2008 19:55:00 Z

Hi TheCross,

If you look at my posts in the above thread the account that needs to have rights is the computer account (this is not to be confused with a user account) of the VM Host, this account needs to have read permissions on the file share and ntfs folder that the iso resides in.

This is because the authentication is actually taking place between the machines, and not between your user account.

-matt

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Wed, 23 Apr 2008 15:20:18 Z

I do believe they said that they gave the Everyone group Full Control. While I know that the Everyone group doesn't necessarily include anonymous (http://support.microsoft.com/kb/278259), I do believe it includes computer accounts. So aside from explicitly listing the VM server account as having permission, I am not sure what else he/she could do.

And if I am mistaken that the Everyone group does not include computer accounts, please correct me.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Wed, 23 Apr 2008 15:34:13 Z

Thx for all your post by now, It helps me great for testing.

I've tried to set Anonymous Full Control on the share permission and NTFS Security, but still got the same acces denied.

I'm not able to set security for another computer acount then the one I'm on. There must be something I can't figured out...

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Wed, 23 Apr 2008 17:13:03 Z

Hi TheCross,

When adding permissions by default you can only see users, groups, and built-in security principals.

You will need to check the box to allow you to search for computer accounts (this is under the object type button). Then try your search again.

Anonymous and Everyone does not include other computer machine accounts.

-matt

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Wed, 23 Apr 2008 17:42:39 Z

Thankx, I would love to set computer account rights to my security, but what's sotopping me is that I'm not in a Domain...Someone got a workaround ?

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Sun, 29 Jun 2008 20:12:27 Z

Details on how to use file shares with Hyper-V at:
http://blogs.technet.com/josebda/archive/2008/06/24/storing-windows-server-2008-hyper-v-files-on-an-cifs-smb-file-share.aspx

HTH,

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 14 Aug 2008 19:33:57 Z

You can use somthing like DAEMON tools light, this will let you map network ISO's to a Virtual CD/DVD on your physical host.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Tue, 28 Oct 2008 00:39:26 Z

I have the same issue, I have added the computer account to the folder securities (DOMAIN\MachineName$ FC) and it still has the same issue.

bizarrely it was working yesterday but not today. I am going to experiment with recreating the ISO image as that was a variable yesterday.

Duncan

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Mon, 29 Dec 2008 17:20:32 Z

I added hyper-v machine accounts to both NTFS and Share permissions on my file server. Was still having issues mounting an iso on the Hyper-V host.

I modified my file path from \\server\z$\isos\whatever.iso to an acutal share i created \\server\storage\isos\whatever.iso and it worked

Seems like it cant hit the administrative $ shares, but can hit an actual share.

just in case anyone else runs into the same problem.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Wed, 07 Jan 2009 16:39:30 Z

I've had the issue with sharing an ISO from the VMM 2008 library too. I followed the usual advice about delegated permissions and that failed. I opened a call with PSS and the answer was: It doesn't work. There's a complication with Hyper-V security.

For any MSFT people: case#SRX081210600013

- Aidan F.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Fri, 16 Jan 2009 18:31:34 Z

So am I correct to conclude (part of this from my own testing):

Case 1:

1. RDP into Server 2008 full install
2. Open Hyper-V Console
3. Try to mount an iso to a guest from a network share
If the computer account of the server you are RDP'd into has read permission at the share and security levels on the share, this works. (Worked for me in my environment)

Case 2:

1. Access the same server from a remote Hyper-V Manager snap-in (in my case a vista workstation)
2. Try to mount an iso to a guest from the same network share
This does not work becuase the session was initiated remotely? At least, that is the result I get from my environment.

I tried adding the machine account of the workstation running the Hyper-V Manager snap-in to the shared folder's permissions and that didn't work (didn't think it would either).

So this leaves me at:

I have 2 servers running Hyper-V. One is a Server 2008 full install, the other is a Hyper-V server (ie console) install.
For the full install, I can work around the issue by mounting iso's from an RDP session instead of Hyper-V manager snap-in
For the core install, I have to copy the iso to the local drive of that server to mount it in a guest (or run an iso reader in the guest, not helpful for installing an OS from an iso)

Sound about right? Or is there some other work around I have yet to hear of?

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 26 Mar 2009 14:27:48 Z

The above does not work for me see the attached

http://i85.servimg.com/u/f85/12/15/72/91/perms10.jpg

http://i85.servimg.com/u/f85/12/15/72/91/rdp10.jpg

The only way I have found is to copy the iso files locally, this is not really a workaround, anyone have any other ideas ??

Wilf

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Wed, 08 Jul 2009 23:21:21 Z

I get a similar error...it work for a local ISO but not for an ISO that is using a network mapping.

Error trying to mount the DVD to a network based ISO image in Windows 2008 Hyper-V RC0

Thu, 09 Jul 2009 00:50:19 Z

Make sure that the computer account has at least read permissions for both the file share and the NTFS file system. By default, the "Everyone" group does not include "Anonymous", nor for all I know, "Domain Computers". So the permission needs to be explicit.

Just for fun, I tried this again.

Note, I had installed the OS on the virtual machine this way, in the first place, but that was when the machine was on a different Hyper-V server. So I anticipated problems. The Hyper-V server is a member server. The file server is also a virtual machine on this server, using a mirrored pair of physical drives for the file shares.

Sure enough, I got the same kind of error. The error message referred to the account Domain\%ComputerName%$ as the one that needed permissions.

I went to the share permissions and enabled full control for the computer account. I then went to the NTFS permissions and did the same. When I clicked OK, it started crawling the entire folder, setting permissions on every file and folder.

After the permissions were set on that particular ISO, I went back to Hyper-V manager and mounted the image on the virtual machine's virtual DVD, with no problems.

Although my settings were far too liberal for a production environment, they showed me that it would work.

If the Hyper-V server is not a member of the domain, configuring this security would be more complicated.