Answered by:
SCVMM SP1 Beta and Server 2012 error 2910

Question
-
Been trying to figure this out for awhile. Our 2012 Hyper-V hosts cannot refresh due to the following errors. We have tried everything we can think of but still nothing works. We can add the hosts, refresh them a couple times before we start getting the error messages.
Error (2910)
VMM does not have appropriate permissions to access the resource on the server.
Access is denied (0x80070005)
Recommended Action
Ensure that Virtual Machine Manager has the appropriate rights to perform this action.
Error (2910)
VMM does not have appropriate permissions to access the resource C:\Windows\system32\qmgr.dll on the server.
Access is denied (0x80070005)Error (2910)
VMM does not have appropriate permissions to access the resource C:\ on the server.
Access is denied (0x80070005)
Recommended Action
Ensure that Virtual Machine Manager has the appropriate rights to perform this action.
Recommended Action
Ensure that Virtual Machine Manager has the appropriate rights to perform this action.
We have tried the following
add host with local admin account
add host with domain admin account
made sure scvmm computer account was a member of the host admin group
winrm quickconfig was successful, no errors
no errors with wbemtest
disabled firewall
checked DCOM security
changed UAC to never warn (slid the bar all the way down)
- Edited by Wolfraider Tuesday, September 18, 2012 9:26 PM
Tuesday, September 18, 2012 9:25 PM
Answers
-
Try the following:
====================================================
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
winrm set winrm/config/service/auth @{CredSSP="True"}
winrm set winrm/config/winrs @{AllowRemoteShellAccess="True"}
winrm set winrm/config/winrs @{MaxMemoryPerShellMB="2048"}
winrm set winrm/config/client @{TrustedHosts="*"}
winrm set winrm/config/client/auth @{CredSSP="True"}
====================================================
If WinRM is turned on and enabled via GPO, some of the other parameters that VMM appears to need do not get set. When you run WinRM /QC it only checks two values, and says 'hey, everything is enabled' without checking these other params.
This resolved the same issue for me in our environment.
- Edited by Wes Kroesbergen Wednesday, September 19, 2012 2:34 PM Added note that this worked in our environment.
- Marked as answer by Wolfraider Wednesday, September 19, 2012 2:51 PM
Wednesday, September 19, 2012 2:32 PM
All replies
-
Forgot to add, Windows Server 2012 Datacenter RTM
wbemtest from a remote machine works, tested with the run as account
C:\Windows>winrm get winrm/config -r:dt024158
Config
MaxEnvelopeSizekb = 1600
MaxTimeoutms = 600000
MaxBatchItems = 20
MaxProviderRequests = 4294967295
Client
NetworkDelayms = 5000
URLPrefix = wsman
AllowUnencrypted = false
Auth
Basic = true
Digest = true
Kerberos = true
Negotiate = true
Certificate = true
CredSSP = true
DefaultPorts
HTTP = 5985
HTTPS = 5986
TrustedHosts = *
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;G
XGW;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 400
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = false
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = * [Source="GPO"]
IPv6Filter = * [Source="GPO"]
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true [Source="GPO"]
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 10
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 25
MaxMemoryPerShellMB = 1024
MaxShellsPerUser = 30
C:\Windows>winrm get wmicimv2/Win32_Service?Name=WinRM -r:dt024158
Win32_Service
AcceptPause = false
AcceptStop = true
Caption = Windows Remote Management (WS-Management)
CheckPoint = 0
CreationClassName = Win32_ServiceDescription = Windows Remote Management (WinRM) service implements the WS-Ma
nagement protocol for remote management. WS-Management is a standard web service
s protocol used for remote software and hardware management. The WinRM service l
istens on the network for WS-Management requests and processes them. The WinRM S
ervice needs to be configured with a listener using winrm.cmd command line tool
or through Group Policy in order for it to listen over the network. The WinRM se
rvice provides access to WMI data and enables event collection. Event collection
and subscription to events require that the service is running. WinRM messages
use HTTP and HTTPS as transports. The WinRM service does not depend on IIS but i
s preconfigured to share a port with IIS on the same machine. The WinRM service
reserves the /wsman URL prefix. To prevent conflicts with IIS, administrators s
hould ensure that any websites hosted on IIS do not use the /wsman URL prefix.
DesktopInteract = false
DisplayName = Windows Remote Management (WS-Management)
ErrorControl = Normal
ExitCode = 0
InstallDate = null
Name = WinRM
PathName = C:\Windows\System32\svchost.exe -k NetworkService
ProcessId = 964
ServiceSpecificExitCode = 0
ServiceType = Share Process
Started = true
StartMode = Auto
StartName = NT AUTHORITY\NetworkService
State = Running
Status = OK
SystemCreationClassName = Win32_ComputerSystem
SystemName = DT024158
TagId = 0
WaitHint = 0
Wednesday, September 19, 2012 12:20 PM -
Try the following:
====================================================
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
winrm set winrm/config/service/auth @{CredSSP="True"}
winrm set winrm/config/winrs @{AllowRemoteShellAccess="True"}
winrm set winrm/config/winrs @{MaxMemoryPerShellMB="2048"}
winrm set winrm/config/client @{TrustedHosts="*"}
winrm set winrm/config/client/auth @{CredSSP="True"}
====================================================
If WinRM is turned on and enabled via GPO, some of the other parameters that VMM appears to need do not get set. When you run WinRM /QC it only checks two values, and says 'hey, everything is enabled' without checking these other params.
This resolved the same issue for me in our environment.
- Edited by Wes Kroesbergen Wednesday, September 19, 2012 2:34 PM Added note that this worked in our environment.
- Marked as answer by Wolfraider Wednesday, September 19, 2012 2:51 PM
Wednesday, September 19, 2012 2:32 PM -
That fixed it, thanks for the help
Also had to add the SCVMM server as a member of the Distributed COM users group
- Edited by Wolfraider Wednesday, September 19, 2012 3:04 PM
Wednesday, September 19, 2012 2:51 PM -
Hi All,
I have faced the same in SCVMM 2012 in HA mode.
So, removed 2 hot fixes from SCVMM Server and LIB Servers.
we have applied mentioned hot fixes on VMGA,VMGB,LIBA and LIBB, which creates issue in VM Provisioning, So we removed those Hot fixes and VM Provisiong is working fine now.
Windows8-RT-KB2878224-x64.msu
Windows8-RT-KB2838669-x64.msu
Hotfix suggestion is provided in mentioned Article.
Kirpal Singh
- Proposed as answer by Mr. Kirpal Singh Friday, December 13, 2013 2:18 PM
Friday, December 13, 2013 2:18 PM