This error occurs if the Credential Security Service Provider (CredSSP) policy on the Windows Server 2008 Hyper-V-based computer is not enabled to authenticate user credentials from a remote location.
You can configure CredSSP policy at the time of the Hyper-V role Setup to enable authentication of credentials from a remote user. However, if any of the registry entries that are described in the "Configure the registry" section are not present, the error that is described in the "Symptoms" section will occur. To configure remote user authentication, use one of the following methods.
Method 1: Configure the registry
To have us fix this problem for you, go to the "Fix it for me
" section. If you'd rather fix this problem yourself, go to the "Let me fix it myself
Fix it for me
To fix this problem automatically, click the Fix this problem
link. Then, click Run
in the File Download
dialog box and follow the steps in this wizard. Note
this wizard may be in English only; however, the automatic fix also works for other language versions of Windows.Note
If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD so that you can run it on the computer that has the problem.
Now go to the "Did this fix the problem?
Let me fix it myselfImportant
This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
How to back up and restore the registry in Windows
If the CredSSP policy is not set up correctly, you can manually create the policy. To do this, create the following registry entry under several registry subkeys:Name
: Hyper-VValue type
: String ValueValue data
:Microsoft Virtual Console Service/*
This registry entry must be created under the following registry subkeys:
The "How to create the registry entry" section describes how to create the registry entry under the first registry subkey in the list. You must repeat these steps for the remaining registry subkeys.
How to create the registry entry
Follow these steps, and then quit Registry Editor:
- Click Start, click Run, type regedit, and then click OK.
- Locate and then click the following key in the registry:
- On the Edit menu, point to New, and then click String Value.
- Type Hyper-V, and then press ENTER.
- On the Edit menu, click Modify.
- Type Microsoft Virtual Console Service/*, and then click OK.
Did this fix the problem?
Check whether the problem is fixed. If the problem is fixed, you are finished with this article. If the problem is not fixed, you can contact support
Method 2: Use Group Policy settings
To enable authentication of remote credentials, you can use the Gpedit tool to configure Group Policy settings on the Windows Server 2008 Hyper-V-based computer. To do this, follow these steps:
- Start Gpedit.msc.
- Expand Computer Configuration, and then expand Administrative Templates.
- Expand System, and then click Credentials Delegation.
- In the Details pane, double-click Allow Delegating Default Credentials.
Note If you are using NTLM authentication, use the Allow Default Credentials with NTLM-only Server Authentication entry.
- Click Enabled, and then click to select the Concatenate OS defaults with inputs above check box.
- Click Show, and then verify that the computer of the remote user is included in the list. If it is necessary, click Add, and then include the computer of the remote user. You can also use wildcard characters. For example, to select all computers, add the following wildcard character:
- Click OK two times.
- Close Group Policy.
Important This method differs from the method that is described in the "Configure the registry entry" section. The Group Policy configuration will use any Service Principal Name (SPN) from any computer to enable authentication of remote credentials. The method that is described in the "Configure the registry entry" section will enable only authentication of the Microsoft Virtual Console Service.