none
VMM does not have appropriate permissions to access the resource on the xxx server

    Question

  • Hello,

     

    we did a clean SCVMM installation. When we mount a iso - image to a virtual machine (via BITS copy) then it works fine.

     

    When we try to mount a iso - image via UNC path, then we get the error message:

     

    Error (2910)

    Detailed Error (Access is denied (0x80070005))

    VMM does not have appropriate permissions to access the resource on the xxx server.

    Recommended Action

    Ensure that Virtual Machine Manager has the appropriate rights to perform this action.

     

    Any suggestions?

     

    Kind regards

    Wednesday, January 16, 2008 3:14 PM

Answers

  • Evan's original answer was actually the correct procedure.  Constrained delegation is not the most appropriate solution for this case, regardless of if it works in the end...

    If you have your VMs access iso images directly on the library servers (as opposed to having VMM copy it onto the Virtual Host Server as well as the VHD) then the Virtual Host Server computer account must have the permissions to read from the lirary server.  Here is how I did it.

    I have a large number of Virtual Host Servers (8 Production hosting 140+ VMs and 6 Maintenance) because of that to simplify the ACLs on my libraries where the iso images are stored, I have created a AD group called VSHosts.  This group has the computer account of each virtual host server as a member.  This group is then assigned read permissions (NTFS and Share) on the libraries that host iso images (2 in my case).  You could of course do this manually without the creation of the group.  However you will have to have an ACE for every VS Host you have so in large environments it makes sense to create a group.

    Please repost if you still have problems.  
    Saturday, March 01, 2008 5:56 PM

All replies

  • I'm experiencing the exact same problem when attempting to mount an ISO directly from the library.

     

    No other errors or events can be found anywhere to assist in troubleshooting.

     

    Any ideas?

    Wednesday, February 06, 2008 8:11 PM
  • You will need to give read access to the host machine account for the library share on which the ISO resides (both share level permissions and NTFS file level permissions).  This error shows up because Virtual Server (running as a service on the host machine) does not have permission to access the ISO. 

     

    Thanks,

    Evan

     


    This posting is provided "AS IS" with no warranties, and confers no rights.

     

    Friday, February 08, 2008 12:16 AM
  • Evan, thanks for your response.

     

    We had tried your suggestion, but it still did not allow us to mount an ISO.

     

    What did work was to grant constrained delegation of the Library machine to the VM Host machines for the cifs service.

     

    Here are the steps we took:

     

    1) Open Active Directory Users & Computers.

    2) Right click on the Virtual Server Host machine and click Properties.

    3) On the Delegation tab, click Trust this computer for delegation to specified services only.

    4) Click Use Kerberos only.

    5) Click Add, then click Users and Computers.

    6) Type the name of the servers storing the ISO files (our VMM server) and click OK.

    7) From the list of available services, select cifs, and click OK.

    Friday, February 08, 2008 1:57 PM
  • Hi,

    I am having the issue that migrating a machine between 2 virtual servers over scvmm does give me the error 2910, and 0x80070005.

    It copied the disk (using bits) but changing the properties of the virtual machine fails.

    It has to do with the .iso which is mapped into the vm.

    \\server1\MSSCVMMLibrary\ISO\XPPro.iso

    I have tried the solution with active users and computers and trust cifs. but it did not help. I can access the resource from server 2 with windows explorer using the above mentioned path.

    What can I do to solve this?
    Friday, February 29, 2008 10:47 PM
  • Evan's original answer was actually the correct procedure.  Constrained delegation is not the most appropriate solution for this case, regardless of if it works in the end...

    If you have your VMs access iso images directly on the library servers (as opposed to having VMM copy it onto the Virtual Host Server as well as the VHD) then the Virtual Host Server computer account must have the permissions to read from the lirary server.  Here is how I did it.

    I have a large number of Virtual Host Servers (8 Production hosting 140+ VMs and 6 Maintenance) because of that to simplify the ACLs on my libraries where the iso images are stored, I have created a AD group called VSHosts.  This group has the computer account of each virtual host server as a member.  This group is then assigned read permissions (NTFS and Share) on the libraries that host iso images (2 in my case).  You could of course do this manually without the creation of the group.  However you will have to have an ACE for every VS Host you have so in large environments it makes sense to create a group.

    Please repost if you still have problems.  
    Saturday, March 01, 2008 5:56 PM
  •  Matthew Mattoon wrote:
    Evan's original answer was actually the correct procedure.  Constrained delegation is not the most appropriate solution for this case, regardless of if it works in the end...

    If you have your VMs access iso images directly on the library servers (as opposed to having VMM copy it onto the Virtual Host Server as well as the VHD) then the Virtual Host Server computer account must have the permissions to read from the lirary server.  Here is how I did it.

    I have a large number of Virtual Host Servers (8 Production hosting 140+ VMs and 6 Maintenance) because of that to simplify the ACLs on my libraries where the iso images are stored, I have created a AD group called VSHosts.  This group has the computer account of each virtual host server as a member.  This group is then assigned read permissions (NTFS and Share) on the libraries that host iso images (2 in my case).  You could of course do this manually without the creation of the group.  However you will have to have an ACE for every VS Host you have so in large environments it makes sense to create a group.

    Please repost if you still have problems.  

     

    I would agree that constrained delegation is may not be the most appropriate solution. I have to disagree that Evan's original answer is the correct one because, well... it didn't work.

    In my research to solve this issue, I was able to find other discussions on the interweb of the same problem and those folks also had to resort to constrained delegation.

    Monday, March 03, 2008 12:24 PM
  •  JoshO wrote:

    I would agree that constrained delegation is may not be the most appropriate solution. I have to disagree that Evan's original answer is the correct one because, well... it didn't work.

    In my research to solve this issue, I was able to find other discussions on the interweb of the same problem and those folks also had to resort to constrained delegation.

     

    Hmm.  Just worked for me.  I opted for creating a group as well due to the amount of servers I have in my environment.  Something worth noting though and assuming you use a group, you have to reboot the host server so that the group membership is reflected properly.

    Thursday, March 06, 2008 4:19 PM
  •  

    Followup below KB from Microsoft

    http://support.microsoft.com/kb/969965

     

    Regards

    DHAVAL BAROT

    Saturday, September 03, 2011 10:04 AM
  • give permission to EVERONE in wmi

    http://support.microsoft.com/kb/969965

    • Proposed as answer by DV BAROT Sunday, September 04, 2011 9:32 AM
    Sunday, September 04, 2011 9:32 AM