-
Enable the firewall rules for Windows Management Instrumentation. From an elevated command prompt, type:
netsh advfirewall firewall set rule group=“Windows Management Instrumentation (WMI)” new enable=yes
The command has succeeded when it returns the following message: “Updated 4 rules(s). Ok.”
.gif) Note |
|
To verify that the command succeeded, you can view the results in Windows Firewall with Advanced Security. Click Start, click Control Panel, switch to Classic View if you are not using that view, click Administrative Tools, and then click Windows Firewall with Advanced Security. Select inbound rules or outbound rules and then sort by the Group column. There should be three inbound rules and one outbound rule enabled for Windows Management Instrumentation. |
-
The next steps configure the authorization policy for the server running the Hyper-V role. If the user who requires remote access to the server running Hyper-V belongs to the Administrators group on both computers, then it is not necessary to configure the authorization policy.
|
Note |
|
The instructions for configuring the authorization policy assume that the default authorization policy has not been modified, including the default location, and that the account you are configuring for remote access requires full administrative access to the Hyper-V role. |
-
Click Start, click Start Search and type azman.msc. If you are prompted to confirm the action, click Continue. The Authorization Manager MMC snap-in opens.
-
In the navigation pane, right-click Authorization Manager and click Open Authorization Store. Make sure that XML file is selected. Browse to the %system drive%\ProgramData\Microsoft\Windows\Hyper-V folder, select InitialStore.xml, click Open and then click OK.
|
Note |
|
The Program Data folder is a hidden folder by default. If the folder is not visible, type: <system_drive>\ProgramData\Microsoft\Windows\Hyper-V\initialstore.xml |
-
In the navigation pane, click Hyper-V services, and then click Role Assignments. Right-click Administrator, point to Assign Users and Groups, and then point to From Windows and Active Directory. In the Select Users, Computers, or Groups dialog box, type the domain name and user name of the user account, and then click OK.
-
Close Authorization Manager.
-
Next, you add the remote user to the Distributed COM Users group to provide access to the remote user. Click Start, point to Administrative tools, and click Computer Management. If User Account Control is enabled, click Continue. Component Services opens.
-
Expand Local Users and Groups, and then click Groups. Right-click Distributed COM Users and click Add to Group.
-
In the Distributed COM Users Properties dialog box, click Add.
-
In the Select Users, Computers, or Groups dialog box, type the name of the user and click OK.
-
Click OK again to close the Distributed COM Users Properties dialog box. Close Component Services.
-
The remaining steps grant the required WMI permissions to the remote user for two namespaces: the CIMV2 namespace and the virtualization namespace. Click Start, click Administrative Tools, and then click Computer Management.
-
In the navigation pane, click Services and Applications, right-click WMI Control, and then click Properties.
-
Click the Security tab, click Root, and then click CIMV2. Below the namespace list, click Security.
-
In the Security for ROOT\CIMV2 dialog box, check to see if the appropriate user is listed. If not, click Add. In the Select Users, Computers, or Groups dialog box, type the name of the user and click OK.
-
On the Security tab, select the name of the user. Under Permissions for <user or group name>, click Advanced. On the Permissions tab, verify that the user you want is selected and then click Edit. In the Permission Entry for CIMV2 dialog box, modify three settings as follows:
-
For Apply to, select This namespace and subnamespaces.
-
In the Permissions list, in the Allow column, select the Remote Enable check box.
-
Below the Permissions list, select the Apply these permissions to objects and/or containers within this container only check box.
-
Click OK in each dialog box until you return to the WMI Control Properties dialog box.
-
Next, you repeat the process for the virtualization namespace. Scroll down if necessary until you can see the virtualization namespace. Click virtualization. Below the namespace list, click Security.
-
In the Security for ROOT\virtualization dialog box, check to see if the appropriate user is listed. If not, click Add. In the Select Users, Computers, or Groups dialog box, type the name of the user and click OK.
-
On the Security tab, select the name of the user. Under Permissions for <user or group name>, click Advanced. On the Permissions tab, verify that the user you want is selected and then click Edit. In the Permission Entry for virtualization dialog box, modify three settings as follows:
-
For Apply to, select This namespace and subnamespaces.
-
In the Permissions list, in the Allow column, select the Remote Enable check box.
-
Below the Permissions list, select the Apply these permissions to objects and/or containers within this container only check box.
-
Click OK in each dialog box and then close Computer Management.
-
Restart the server to apply the changes to the authorization policy.