Hyper-V Constrained Delegation of Authority – Remote Mounting of ISO with Management Console
I have been working with Hyper-V for a while and have had this problem with mounting ISO files that sit on a common file share within our organization. The problem was when I tried to mount them from my remote Hyper-V management console I would get the error below. If I mounted it from the Hyper-V host Hyper-V management console everything worked as expected.
This stumped me for a while, but then I got to thinking. Where had I seen this before…. Virtual Server 2005. Constrained delegation of authority settings on the Virtual Host objects was necessary there in order to both mount remove ISO images and in order to manage the virtual hosts from a common management web page. So I made similar modifications to my Hyper-V host objects and now all seems to be working correctly. Below are the steps I took to make mounting ISO images with my remote Hyper-V management console, work like a charm
Open Active Directory Users and Computers, Right-Click the Hyper-V host server object and select properties. Then click on the Delegation tab.
Select "Trust this computer for delegation to specified services only" and "Use any authentication protocol." Then click "Add" to select the service necessary to pass credentials to the remote file server where your ISOs are located.
Click on "Users or Computers"
Enter the name of the remote resource you need to pass credentials to through the Hyper-V Host and click OK. (i.e. File Server that houses your ISO images)
Select CIFS as the service type and click OK twice.
The refresh on this procedure can take a few minutes to propagate to the Hyper-V host object. Once this is completed you will be able to successfully mount an ISO from your remote Hyper-V management console. I suspect that this type of information will be in the final Hyper-V documentation, but as of yet, I have not seen any public documentation outlining this. If I missed anything or you have any questions, feel free to comment or send an email along.