Pages

Saturday, January 21, 2017

Kerberos Constrained Delegation with Hyper-V and Scale-Out File Server


When installing Hyper-V with a SMB 3 file share like a SOFS cluster, you will need to enable KDC to allow remote VM management without SCVMM.
Image the following scenario, you have a 2 nodes SOFS cluster, which hosts a high available share with a CAP called SOFS01. You have a 3 node Hyper-v cluster, running VM, hosted by your SOFS cluster. You installed a SCVMM VM for remote management:
image
If you want to import a VM in the Hyper-V manager you will notice the following error in the SMBClient Security log:
image
Pre-Server 2012 R2 you would have needed to allow the CIFS protocol for delegation in the Active Directory:
image
Since Server 2012 R2 you can easily configure this with Powershell. You have to have the AD Powershell tools on a server and you can configure KDC for CIFS with Powershell. After configuren SMB Delegation you can also use Get-SMBDelegation to confirm if the command was executed succesfully. It will give a list with all the server which are allow to use delegation for this SMB server:
image

No comments:

Post a Comment