none
Auditing VM connections? RRS feed

  • Question

  • Is there a way to audit VM connections? I know there are event-log entries for manipulations like save, restore, etc., but I I haven´t seen anything in the direction of which user connected/disconnected to which VM without changing the configuration. Is this not possible at all? Or does it require additional configuration?
    I have also not seen any means to query this information via WMI/powershell which would allow me to collect this information on my own.

    Thanks for any hint.

    Joachim

    Sunday, July 16, 2017 1:30 PM

All replies

  • You may be able to get there via SCVMM

    https://technet.microsoft.com/en-us/library/gg610610(v=sc.12).aspx

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Sunday, July 16, 2017 1:53 PM
  • Hello Dave,

    thanks for the hint, but sorry, installing additional software that can be bypassed by a user (in particular a system administrator) is usually not filling an audit gap. And otherwise I am pretty happy with Hyper-V without SCVMM.

    Best Regards

    Joachim


    Sunday, July 16, 2017 3:47 PM
  • Sounds good then. Hyper-v in of itself doesn't do audit logging.

      

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.


    Sunday, July 16, 2017 3:49 PM
  • then this is imho a missing functionality. Any software that deals with potentially sensitive data needs to support authentication, authorization, and auditing. Windows does a pretty good job usually, only Hyper-V being an exception?
    Tuesday, July 18, 2017 7:09 PM
  • I think that's what SCVMM might be able to do. You can provide the feedback over here on uservoice.

    https://windowsserver.uservoice.com/forums/295050-virtualization

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Tuesday, July 18, 2017 7:51 PM
  • Hi Joachim,

    Yeah, Hyper-V itself doesn't provide the audit function of your requirements. SCVMM may achieve the goal, or maybe some third-party applications.

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, July 24, 2017 5:57 AM
    Moderator
  • Hi Joachim,

    Since it is by design, and if you do not have other related questions on this thread, could you help to mark useful information as answer to end this thread.

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, July 24, 2017 6:00 AM
    Moderator
  • Hi Anne,

    imho the question is not answered yet. A "may" is not really helpful, I am not going to buy or evaluate what is on the market without evidence it solves the problem, a specific URL with a feature description would probably qualify (I googled  myself without success). And then add-ons can usually be bypassed, i.e. one needs a guide to eliminate that guide as well.

    Also "by design" is a bad excuse for a product to miss legal requirements in some industries.

    In fact, Dave´s tip to voice my request is more helpful than your answer.

    Best Regards

    Joachim

    Monday, July 24, 2017 6:15 AM