Allowing non-Administrators to control Hyper-V

re: Allowing non-Administrators to control Hyper-V

Aitor Ibarra — Fri, 18 Jan 2008 15:36:15 GMT

Ben,

Thanks for this great post! It was great to find that in AzMan you can also edit / define roles; e.g. I edited the "user" role so that users could pause VMs very easily. And I like that changes in AzMan seem to be reflected immediately in Hyper-V admin, so it must be checking permissions before every operation.

I don't suppose you could show us how to restrict control of specific VMs to specific users/groups?

cheers,

Aitor

re: Allowing non-Administrators to control Hyper-V

Aitor Ibarra — Fri, 18 Jan 2008 20:44:32 GMT

follow up on restricting users to particular VMs: I can see how to create new scopes, and give users rights in the scope, but not how to associate VMs with particular scopes. Is this what the Authorization Rules are for? If so, as they are scripts, looks like it could be very flexible (e.g. it might be possible to write a rule that allowed users in a particular role access to all VMs with names containing "Sales"). But to be honest, I think most users would find it easier if, having defined the scope in AzMan, scope membership of a VM could be set as part of the VM settings in the Hyper-V manager.

re: Allowing non-Administrators to control Hyper-V

Wesley — Fri, 18 Jan 2008 22:49:32 GMT

Ben, I hope that you are writing all of this in a way that leads to future publication. How about sections on using legacy software in Hyper-V with sections on optimizing DOS networks, evaluating physical video adapters for use with VMs, etc. I was at my doctors office last week and he had a portable PC with a VM and some old database he continues to use that his var can not port.

re: Allowing non-Administrators to control Hyper-V

Marko Jagodic — Thu, 14 Feb 2008 16:40:08 GMT

If users use full version of win 2008 to manage VMs located on server 2008 core, what rights (permissions) they need to have on core system?

Just adding their domain account in InitalStore does'n work. They still cannot manage VMs due to authorization issues...

If we are using WMI, what permission must be granted in order to execute script?