Home

VMConnect with WAC doesn't work for non-local admin users

%3CLINGO-SUB%20id%3D%22lingo-sub-330775%22%20slang%3D%22en-US%22%3EVMConnect%20with%20WAC%20doesn't%20work%20for%20non-local%20admin%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-330775%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20guys%2C%3C%2FP%3E%3CP%3EI%20wanted%20to%20ask%20if%20any%20of%20you%20actually%20had%20similar%20problem%2C%20and%20found%20a%20way%20to%20make%20things%20work%20correctly.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20few%20Hyper-V%20hypervisors%20installed%20on%20Windows%20Server%202016%2C%20and%20we%20wanted%20to%20give%20our%20testers%2Fdevs%20permissions%20to%20manage%20VMs%20inside%20them%20BUT%20NOT%20the%20Hyper-V%20settings%20or%20the%20host%20itself.%20Role-based%20access%20control%20came%20to%20help%2C%20with%20WAC%20Hyper-V%20Administrators%20group.%26nbsp%3B%20Everything%20works%20fine%20except%20the%20%22Connect%22%20button%20in%20the%20Virtual%20Machines%20Inventory.%20Every%20time%20we%20get%20the%20same%20error%20-%20%3CSTRONG%3ERemote%20desktop%20connections%20are%20not%20allowed%20to%20this%20computer.%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3ETo%20give%20you%20a%20few%20more%20details%3A%3C%2FP%3E%3CP%3E-Hyper-V%20hosts%20allow%20remote%20desktop%20connections%20(tried%20with%20GPO%2C%20as%20well%20as%20manual%20setup)%3C%2FP%3E%3CP%3E-User%20cannot%20connect%20to%20the%20host%20through%20Hyper-V%20Manager%20console%20(access%20denied).%3C%2FP%3E%3CP%3E-User%20can%20use%20RDP%20directly%20to%20the%20host%20and%20virtual%20machine%20without%20any%20problems.%3C%2FP%3E%3CP%3E-User%20can%20download%20.RDP%20file%20through%20WAC%2C%20and%20he%20would%20connect%20to%20the%20virtual%20machine%20correctly.%3C%2FP%3E%3CP%3E-When%20granted%20local%20administrator%20privileges%20on%20the%20Hyper-V%20host%2C%20user%20can%20miraculously%20use%20%22Connect%22%20button%20without%20any%20problems.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EQuick%20edit%3A%20Tested%20with%20WAC%201809%2C%201809.5%20and%201812%20preview%20-%20result%20are%20always%20the%20same.%3C%2FP%3E%3CP%3EWe%20have%20tried%20a%20lot%20of%20different%20set%20of%20permissions%2C%20and%20built-in%20group%20membership%20with%20no%20success.%3C%2FP%3E%3CP%3EUser%20can%20be%20a%20member%20of%20Hyper-V%20Administrators%2C%20WAC%20Hyper-V%20Administrators%2C%20Remote%20Desktop%20Users%2C%20we%20can%20grant%20him%20access%20to%20virtual%20machine%20with%20Grant-VMConnectAccess%2C%20and%20he%20would%20still%20%3CSTRONG%3Enot%20be%20able%3C%2FSTRONG%3E%20to%20use%20VMConnect%20feature%20through%20WAC.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20would%20love%20to%20get%20some%20hints%20from%20you%20all%2C%20as%20I%20have%20no%20idea%20what%20else%20can%20I%20do%20in%20this%20situation.%3C%2FP%3E%3CP%3EFeel%20free%20to%20ask%20for%20any%20more%20details.%3C%2FP%3E%3CP%3EThank%20you%2C%3C%2FP%3E%3CP%3ESebastian%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-334199%22%20slang%3D%22en-US%22%3ERe%3A%20VMConnect%20with%20WAC%20doesn't%20work%20for%20non-local%20admin%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-334199%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20again%2C%20can%20anyone%20confirm%20that%20not%20only%20me%20have%20this%20kind%20of%20problem%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
sebastiank
New Contributor

Hello guys,

I wanted to ask if any of you actually had similar problem, and found a way to make things work correctly.

 

We have a few Hyper-V hypervisors installed on Windows Server 2016, and we wanted to give our testers/devs permissions to manage VMs inside them BUT NOT the Hyper-V settings or the host itself. Role-based access control came to help, with WAC Hyper-V Administrators group.  Everything works fine except the "Connect" button in the Virtual Machines Inventory. Every time we get the same error - Remote desktop connections are not allowed to this computer.

To give you a few more details:

-Hyper-V hosts allow remote desktop connections (tried with GPO, as well as manual setup)

-User cannot connect to the host through Hyper-V Manager console (access denied).

-User can use RDP directly to the host and virtual machine without any problems.

-User can download .RDP file through WAC, and he would connect to the virtual machine correctly.

-When granted local administrator privileges on the Hyper-V host, user can miraculously use "Connect" button without any problems.

 

Quick edit: Tested with WAC 1809, 1809.5 and 1812 preview - result are always the same.

We have tried a lot of different set of permissions, and built-in group membership with no success.

User can be a member of Hyper-V Administrators, WAC Hyper-V Administrators, Remote Desktop Users, we can grant him access to virtual machine with Grant-VMConnectAccess, and he would still not be able to use VMConnect feature through WAC.

 

I would love to get some hints from you all, as I have no idea what else can I do in this situation.

Feel free to ask for any more details.

Thank you,

Sebastian

1 Reply

Hi again, can anyone confirm that not only me have this kind of problem?