Allowing non-Administrators to control Hyper-V

By default Hyper-V is configured such that only members of the administrators group can create and control virtual machines.  Today I am going to show you how to allow a non-administrative user to create and control virtual machines.

Hyper-V uses the new authorization management framework in Windows to allow you to configure what users can and cannot do with virtual machines.  This is very powerful and allows for some useful and interesting configuration options – but I will explore those on another day.  To set the stage I need to explain some terms from the authorization management framework world:

• Operation
  This is the basic building block of authorization manager – and represents some action that the user can perform.  Some operations that exist in our authorization store include op_Create_VM (the act of creating a new virtual machine) or op_Start_VM (the act of starting a virtual machine).
• Task
  A task is a grouping of operations.  We do not create any tasks by default – but you could create a task that was labeled ‘control_VM’ and then add the operations for starting, stopping, pausing and restarting a virtual machine to that task.
• Role
  A role defines a job / position / responsibility that is held by a user.  For instance, you might have a role called ‘Virtual_Network_Admin’.  This role would have all the tasks and operations that relate to virtual networks.  Users are then assigned to roles as needed.
• Scope
  A scope allows you to define which objects are owned by which roles.  If you had a system where you wanted to grant administrative access to a subset of the virtual machines to a specific user – you would create a scope for those virtual machines and apply your configuration change to only that scope.
• Default Scope
  The default scope is where virtual machines are stored by default.  It is the equivalent of having no scope defined.

Hyper-V can be configured to store it’s authorization configuration in Active Directory or in a local XML file.  After initial installation it will always be configured to use a local XML file located at \programdata\Microsoft\Windows\Hyper-V\InitialStore.xml on the system partition.  To edit this file you will need to:

1. Open the Run dialog (launch it from the Start menu or press Windows Key + R).
2. Start mmc.exe
3. Open the File menu and select Add/Remove Snap-in…
4. From the Available snap-ins list select Authorization Manager.
5. Click Add > and then click OK.
6. Click on the new Authorization Manager node in the left panel.
7. Open the Action menu and select Open Authorization Store…
8. Choose XML file for the Select the authorization store type: option and then use the Browse… to open \programdata\Microsoft\Windows\Hyper-V\InitialStore.xml on the system partition (programdata is a hidden directory so you will need to type it in first).
9. Click OK.
10. Expand InitialStore.xml then Microsoft Hyper-V services then Role Assignments and finally select Administrator.
11. Open the Action menu and select Assign Users and Groups then From Windows and Active Directory…
12. Enter the name of the user that you want to be able to control Hyper-V and click OK.
13. Close the MMC window (you can save or discard your changes to Console 1 – this does not affect the authorization manager changes that you just made).

And now you are done.  The user that you added will be able to completely control Hyper-V even if they are not an administrator on the physical computer.

Migrating Active Directory Domain Controller from Windows Server 2008 R2 to Windows Server 2012

Windows Server 2012 is the Microsoft latest Windows Server Operating System which is more powerful than previous versions of Windows Server. For examples, Hyper-V replication, DHCP failover, Dynamic Access Control, Improvements in Active Directory Recycle Bin, Virtual Domain Controller etc. So it’s better to migrate Windows Server 2008 R2 to Windows Server 2012 Domain Controller because of the new cool features of Windows Server 2012. There are two options for migrating Windows Server 2008 R2 to Windows Server 2012 Domain Controller.

1. Directly Upgrading to Windows Server 2012 on same physical machine, which is not recommended?
2. Migrating specific domain controller functionality to the new Windows Server 2012 Active Directory Domain environment using new hardware, which is the best option for migrating Active Directory Domain Controller from Windows Server 2008 R2 to Windows Server 2012 Domain Controller.

The prerequisites for migrating to Windows Server 2012 in a new hardware are as follows:

1. Windows Server 2008 R2 AD DS Domain and Forest functional level must be minimum Windows Server 2003 or higher recommended.
2. Check the Schema version of AD DS.
3. Forest and Domains must be prepared Using adprep. In Windows Server 2008 R2 Domain Controller, run adprep /forestprep and adprep /domainprep from the Windows Server 2012 installation DVD \support\adprep folder.

Step 1: Run adprep command to prepare the existing forest:

1.  Insert the Windows Server 2012 DVD into the DVD drive of the Windows Server 2008 R2 AD DS.

2.  Open command prompt, and type the following commands and press enter.

3.  Check the Schema version of AD DS.
Before Adprep

After Adprep

 Step 2: Promote a Windows Server 2012 Server to a domain controller, including DNS and Global Catalog:

1.  First Joining this server, KTM-DC01-2K12, as a member server in the existing Window Server 2008 R2 Domain before promoting to Domain Controller.

2. On the server KTM-DC01-2K12, in Server Manager, click Manage, and from the drop-down list box, click Add Roles and Features.

3. On the Before you begin page, click Next.

4. On the Select installation type page, confirm that Role-based or feature-based installation is selected, and then click Next.

5. On the Select destination server page, ensure that Select a server from the server pool is selected, and that KTM-DC02-2K12  is highlighted, and then click Next.

6. On the Select server roles page, click Active Directory Domain Services.

7.  On the Add features that are required for Active Directory Domain Services? Page, click Add Feaures.

8.  On the Select server roles page, click Next.

9. On the Select features page, click Next.

10. On the Active Directory Domain Services page, click Next.

11. On the Confirm installation selections page, click Install. (This may take a few minutes to complete.)

12. When the Active Directory Domain Services (AD DS) binaries have installed, click the bluePromote this server to a domain controller link.

13. In the Deployment Configuration window, click Add a domain controller to an existing domain.Specify the domain information for this operation Domain: msserverpro.com and then click Next.

14. In the Domain Controller Options windows, ensure that both the Domain Name System (DNS) server and Global Catalog (GC) check boxes are selected. Confirm that Site Name: is set to Default-First-Site-Name. Under Type the Directory Services Restore Mode (DSRM) password, type P@ssw0rd in both text boxes and then click Next.

15. On the DNS Options page, click Next.

16.  On the Additional Options page, select KTM-DC01-2K8.msserverpro.com in the Replicate from drop-down box.

17. On the Paths windows, click Next.

18. On the Review Options windows, click Next.

19. On the Prerequisites Check windows, confirm that there are no issues, and then click Install.

20. Installation Process begins.. and server will automatically reboot after Installation Finished.

Step 3: Verify the Domain Controller:

1. Open Active Directory Users and Computers, expand mserverpro.com and click Domain Controller OU .Verify KTM-DC01-2K12 Server is listed.

2. Open DNS Manager, right-click on msserverpro.com and select Properties and then click Name Servers Tab. Verify that KTM-DC01-2K12.msserverpro.com is listed in Name Servers: lists.

3. Open Active Directory Sites and Services; verify that KTM-DC01-2K12 is listed in Serversunder Default-First-Site-Name.

Step 4: Transfer FSMO roles to the Windows Server 2012 Domain Controller:

1. Log on KTM-DC01-2K12 new domain controller, Open the Command Prompt and type   netdom query fsmo.

2. Verify the FSMO Roles on Windows Server 2008 R2 Server(KTM-DC01-2K8)  before we transfers FSMO roles to new Windows Server 2012 Server( KTM-DC01-2K12).

3. In the command prompt, type ntdsutil and press enter.

4. Type roles and press Enter. The prompt will display “fsmo maintenance:”

5.  Type connections and press Enter. The prompt will display “server connections:”

6.  In the “server connections: “, type connect to server KTM-DC01-2K12.msserverpro.com andpress enter ( where KTM-DC01-2K12 is the name of the target Windows Server 2012)

7.  Type quit and press enter. The prompt will display “fsmo maintenance:”

8.  In the “fsmo maintenance:” type “?” for help

9. In the “fsmo maintenance: “ , type transfer schema master and Press enter and Click Yes On Role Transfer Confirmation Dialog box to confirm the Operations Master change.

10. Do the same process for: transfer naming master, transfer PDC, transfer RID master and transfer infrastructure master.

11. Type quit and press enter; the type quit and press enter again to exit the ntdsutil.

12. Verify the FSMO Roles on new Windows Server 2012 Domain Controller, KTM-DC01-2K12.

Step 5: Remove the legacy domain controller:

1. On KTM-DC01-2K8, Click Start, Click Run, type dcpromo and then click OK.

2.  On the Welcome to the Active Directory Installation Wizard page, Click Next.

3. On the Delete the Domain page, leave Delete the domain because this server is the last domain controller in the domain.

4. On the Administrator Password Page, type P@ssw0rd in both password textboxes and clickNext.

5. On the Summary page, click Next. Wait for the process to complete and then click Finish.

6. On the Completing the Active Directory Domain Services Installation Wizard, click Finish.

7. On the Active Directory Domain Services Installation Wizard page, click Restart Now to Restart the server.

8. After restart the server, KTM-DC01-2K8 computer account will automatically move from Domain Controller OU to Computers OU because now KTM-DC01-2K8 is only the member server.

9. Lastly disjoin Windows Server 2008 R2 (KTM-DC01-2K8) from the domain to a workgroup andremove any unnecessary record from Active Directory Sites and Services.

Summary:

Finally, we successfully Migrated Active Directory Domain Controller from Windows Server 2008 R2 to Windows Server 2012, which is an easy process. I hope this article will help you in the near future when you are Active Directory Domain Controller from Windows Server 2008 R2 to Windows Server 2012.