Blog Post

ITOps Talk Blog
28 MIN READ

Windows Server 2025 Hyper-V Workgroup Cluster with Certificate-Based Authentication

OrinThomas's avatar
OrinThomas
Icon for Microsoft rankMicrosoft
Jul 01, 2025
In this guide, we will walk through creating a 2-node or 4-node Hyper-V failover cluster where the nodes are not domain-joined, using mutual certificate-based authentication instead of NTLM or shared...
Updated Jul 01, 2025
Version 2.0
Windows Server
OrinThomas's avatar
OrinThomas
Icon for Microsoft rankMicrosoft
Jul 09, 2025

Have you validated access to the Cloud Witness. You can do the following with the Az.Storage module

$ctx = New-AzStorageContext -StorageAccountName "<your-storage-account-name>" -StorageAccountKey "<your-key>"
Get-AzStorageBlob -Container "msft-cloud-witness" -Context $ctx

Also check if HTTPS traffic is blocked

Invoke-WebRequest -Uri "https://<your-storage-account-name>.blob.core.windows.net/" -UseBasicParsing

A 403 or 404 error is fine (it shows you're reaching the endpoint). A timeout or name resolution failure indicates networking issues.

RStieber's avatar
RStieber
Copper Contributor
Jul 09, 2025

I actually just tracked it down a few minutes ago; long story short I have a new lab setup and my ISP's modem/router combo cannot handle double NAT.  Going to work through the steps again with new machines since I did a ton of stuff to troubleshoot and I'm not sure they were "clean" anymore.