Windows Forum·65,807 discussions

Windows Authorization Manager for Hyper-V

Tags: Microsoft, Operating Systems, Windows

I’m trying to set up a Hyper-V server for a course in a College Lab and allow the students to create and modify VMs. However, those permissions require becoming a server admin, which we want to restrict from the students.

We want to utilize “Authorization Manager” and have hit a roadblock. Most sources on this subject begin with editing the InitialStore.xml file.

Problem:

1. We have looked for this file and cannot locate it on any Hyper-V server (regardless of server version) and have come up empty when searching through Install.wim

2. We have tried creating an InitialStore.xml file but cannot select/create any Role Definitions, Task Definitions, or Operation Definitions.

Can anyone help with this problem?

Topic

The last time that was asked.

In reply to Windows Authorization Manager for Hyper-V

“allow the students to create and modify VMs. However, those permissions require becoming a server admin, which we want to restrict from the students.”

That’s a dead end unless some tool is created to submit requests to someone with such permissions.

That is, to create and modify VMs require such permission. This is by design so not broken at all.

reply to rproffitt

In reply to Windows Authorization Manager for Hyper-V

You’re not correct. Checked these links out. Authorization Manager can be used

https://www.slideshare.net/slideshow/understanding-azman-in-hyperv/8260606
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754064(v=ws.10)

Hyper-V Security and Authorization Manager, Keys to a Successful Config

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc726036(v=ws.10)
https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authorization/

Authorization Manager can be used to restrict from becoming a server admin while being able to work with VMs

2012?

In reply to reply to rproffitt

So many patches since them. Most are to tighten up security and will lay waste to anyone that dares refer to documentation that is so old.

But let’s say you followed those articles and it doesn’t work.

Do you know who you gonna call?

Hint: Not the Ghostbusters.

To rproffitt

In reply to Windows Authorization Manager for Hyper-V

Are there any online sources to support what you just said?

I’m willing to study any Microsoft article that says Authorization Manager for Hyper-V will not work with Server 2019, 2022, or 2025

Sorry no.

In reply to To rproffitt

I am a volunteer. I recall this question from about a decade ago where admin railed against the permissions needed to create a VM.

They paid for a call to Microsoft and the answer came back that permission must be granted to do that work.

It’s years later and as far as I know the same answer would come from Microsoft.

But hey, you have documentation that tells you it may be possible so this is now a matter between you and Microsoft to fix it so it works per the documents.

Part 2.

In reply to Sorry no.

It may work but also you may find you can’t get the results you want.
But it did work!

[birdmantd]

Reply To: Windows Authorization Manager for Hyper-V

In reply to Part 2.

I agree with my fellow moderator, rproffitt. He, like our fellow moderators, is a volunteer. In many cases, our suggestions are based on our own experiences and any advice offered is free. You can either take it or leave it, but please don’t complain about it. If you find an alternative method, please share with the community on this forum.

• This reply was modified 1 month, 2 weeks ago by birdmantd.

To rproffitt

In reply to Windows Authorization Manager for Hyper-V

You said: “It may work but also you may find you can’t get the results you want.
But it did work!”

Can you provide online articles, documents, or forum responses where it did work? Or perhaps the “question from about a decade ago where admin railed against the permissions needed to create a VM?”

I’m looking for any documentation where someone made it work, or where someone proves that it’s not possible.

I’m not interested in opinions of what people may think. I’m looking for proof of one way or the other. Can you back up what you are saying?

Reply To: Windows Authorization Manager for Hyper-V

In reply to To rproffitt

What I’m thinking, although you’re probably not interested in what I think:
(a) it used to work; the (old) links you show prove that
(b) you can’t get it working now

So the thing to do: contact Microsoft support and ask what’s going on. Either confirm it can’t be done now, or they tell you how to do it.

If no solution comes, I’d suggest to set up a test server on which you give the students the right to do it. With severe sanctions if they blow up that test server doing other things with their authorisation than getting the VM up and running.

To birdmantd

In reply to Windows Authorization Manager for Hyper-V

I’m not complaining. If you think that, then you are mistaken.

Have you or rproffit used Authorization Manger to work with Hyper-V? From the discussion thus far, I would say that neither of you have used it in this manner. Therefore, offering opinions based on your experience isn’t valid.

I’m looking for documentation for or against my request.

If someone has experience using Authorization Manager with Hyper-V, whether they failed or succeeded, I’m willing to listen.

Offering suggestions based on lack of experience and without documentation is only an opinion.

Re: Reply to birdmantd

In reply to To birdmantd

Although I don’t have the experience you ask for, I found this https://www.serverwatch.com/guides/configuring-hyper-v-security-using-authorization-manager/ .

I noted it’s about Windows Server 2008. You didn’t tell what version Windows Server your students should practice on, but I doubt if it’s the 2008 version. What did you read about managing security in Hyper-V and VM’s in Windows Server 2022 and 2025?
Remember that most you read on the web about Windows XP and Vista doesn’t litterally apply to Windows 11.

And “It does not explain how to create and configure virtual machines on Hyper-V”. So I wonder if the Authorisation Manager manages the security of creating a VM. Which seems to be part of your course, since you talk about the students learning to “create and modify VMs.”

It’s been a decade since I used this.

In reply to Re: Reply to birdmantd

Today I would have to pull a machine from the storeroom and go through the paces but it doesn’t matter since your complaint is not that Auth Manager runs or not but you don’t want to give the authorities needed to create and destroy VMs.

I’ve heard that complaint a few times over the past decade and the OP and you will wail and reply that “you’re not fixing my problem.”

If you feel that Microsoft mislead you, tell them. I can’t change the OS or their apps.

[Author]

Replies