Security settings for creating a clustered virtual failover client on Hyper-V server 2008 R2

SUMMARY

Configure the security settings on a Hyper-V Server 2008 R2 to enable creation of a clustered virtual failover client for Windows instant recovery.

ISSUE

Purpose

To explain how to configure security settings on Hyper-V Server 2008 R2 to enable creation of a clustered virtual failover client for Windows instant recovery

Description

When a VM is added to a Hyper-V cluster version 2008 R2, cluster nodes must make WMI calls to communicate with each other. These calls are executed through DCOM. However, the Unitrends agent, which runs under the Local System account on a Hyper-V server, does not have sufficient permission to make these calls. As a result, attempts to create a clustered virtual failover client (VFC) on Hyper-V server 2008 R2 fail unless you enable DCOM and WMI virtualization access for all nodes in the cluster. You can use the procedures described below to enable this access. These procedures must be performed for all nodes in the cluster.  For more information about running a virtual failover client on a Hyper-V server, see Requirements and considerations for running a virtual failover client on a Hyper-V server in the Unitrends Recovery-Series and UEB Administrator's Guide.

To configure DCOM to enable remote access for nodes in a Hyper-V cluster version 2008 R2

1. Log in to a cluster node for which you need to configure DCOM to enable remote access for other nodes in the cluster.
2. Click Start, and in the search box, type DCOMCNFG. Press Enter. The Component Services box displays.
3. In the left pane, expand Component Services. Then expand Computers.
4. Right click My Computer. Then select Properties to display the My Computer Properties box.
5. Select the COM Security tab.
6. In the lower portion of this tab, you see the Launch and Activation Permissions section. Click Edit Limits in this section of the tab. The Launch and Activation Permission box displays.
7. Click Add. The Select Users or Groups box displays.
8. Click Object Types to display the Object Types box.
9. Check Computers, and click OK to display the Locations box.
10. Select your domain, and click OK.
11. Under Enter the object names to select, enter the name of every node in the cluster (except the node from which you are entering these settings). Click Check Names.
12. Click OK after the names are verified.
13. In the Launch and Activation Permission box, for each node you have added, check all the box under Allow and click OK.
14. Repeat these steps for all nodes in the cluster.

To grant WMI virtualization access for nodes in a Hyper-V cluster version 2008 R2

1. Log in to a cluster node for which you need to grant WMI virtualization access.
2. Click Start, and in the search box, type wmimgmt.msc. Press Enter. The Component Services box displays.
3. In the left pane, right click WMI Control (Local). Then click Properties. The WMI Control Properties box displays.
4. Select the Security tab. Then expand the Root folder.
5. Select the virtualization sub folder, and click the Security button in the lower corner of the box. The Security box displays.
6. Click the Add button to display the Select Users or Groups box.
7. Click Object Types, and select Computers. The Locations box displays.
8. Select your domain, and click OK.
9. Under Enter the object names to select, enter the name of every node in the cluster (except the node from you which are entering these settings). Click Check Names.
10. Click OK after the names are verified.
11. In the Security box, for each node you have added, check all the box under Allow and click OK.
12. Repeat these steps for all nodes in the cluster.