Skip to main content

Live Migration between domains

For those of you like me who aren't experts at all things Active Directory (AD) and Hyper-V Live Migration (LM) permissions, it can be enough of a pain to LM a Virtual Machine (VM) between domains that you simply decide to take the VMs offline to affect the move. See, I only tolerate AD because it's required for LM'ing VMs; there isn't a choice. (It's also required for Windows Clusters, but that's a different topic.) But I figured it out.

My back-story is that we setup a cluster using Windows 2012 r1 as the AD Domain Controller (DC) and Hyper-V Server 2012 r1 for the VM hosts. Then we decided we wanted to use r2 for the AD DC and Hyper-V hosts. Upgrading Hyper-V was easy. But I found that there's some unresolved Microsoft bug with Windows Clustering when upgrading the AD DC from Windows 2012 r1 to Windows 2012 r2---clustering simply doesn't work correctly anymore. So we gave up and created a from-scratch Windows 2012 r2 AD DC then made a new cluster. At this point, I still had a bunch of VMs on hosts still joined to the old domain and I needed to get those hosts into the new domain. Of course, that requires 2 reboots, so the VMs on those hosts need to be LM'd onto hosts in the new domain.

You'll find that when you search on the topic of LM'ing VMs between domains that people simply say that all you need to do is establish a trust relationship between the two domains (like here). That's a lie. Technet has more about permissions, but I found the information incomplete at best.

For example, I could never get the Kerberos Constrained Delegation (KCD) stuff setup correctly, so I gave up on attempting to use the Hyper-V Manager GUI to do the LM. (And AD's error messages are pretty much worthless; they might as well say "Oh, Crap! Something went wrong. It sucks to be you!".) Additionally, you cannot simply add the administrator account from one domain to the "Domain Admins" group in the other domain; it cannot be done.

So here's what I did:
  1. Setup the trust (a two-way, transitive trust like in this silent YouTube video) between the 2 domains. 
  2. Determine the AD user account you'll use on the source host to perform the LM.
  3. Add that AD user account to the "Hyper-V Administrators" group on the destination host. (Yes, you do not need to change any permissions on the source host.)
  4. Login to the source host with that account and start PowerShell.
  5. Run "Move-VM".
    1. For example, assume the VM is named "TheVM", you're moving it to a machine named "DestHost" in the domain "sample.local", and you want the VM to live, on disk (on "DestHost") at "c:\VMs\TheVM". Here's the command (technically it's all case-insensitive):
    2. Move-VM TheVM -DestinationHost DestHost.sample.local -DestinationStoragePath "c:\VMs\TheVM"
    3. That will create the "TheVM" subdirectory if it doesn't exist. (I did not check if it creates all parent directories). It will automatically create the "Virtual Hard Disks", "Virtual Machines", "Snapshots", etc. subdirectories; all of  the .vhdx files will go in "Virtual Hard Disks" (which is different then what happens when you do it via the GUI).
    4. Note that you'll likely get permissions errors if you pre-create those directories (e.g. "TheVM" and its subdirectories), so be aware of that.

Comments

Post a Comment

Popular posts from this blog

SqlBulkCopy and the "colid" error

I thought there was a page explaining this somewhere out there on the Internet, but I can't find it anymore. So here's what I re-discovered. When you try to insert the rows from a DataTable and the data in one of the columns of one of the rows is too big to fit into the destination column in the database, you get a SqlException with this error message: "Received an invalid column length from the bcp client for colid N." (Where "N" is a number.) It doesn't tell you which row, and it's a pain to figure out what column to look at. To determine what column it is referring to, you first need to get a listing of all columns in the table, listed in the order as they have been defined in the database. Next, you remove any columns in the list that are not represented in SqlBulkCopy.ColumnMappings (the order of the column mappings is irrelevant). The list that remains is what "colid" is referring to, with the first column corresponding to colid ...
Post a Comment
Read more

Outlook 2007/2010 Search Folders using email address domain

As of May 2010, the Beta of Outlook 2010 still hasn’t overcome this problem. I’m surprised this glaring omission has been left unfixed. Maybe Outlook is maintained by contractors? I have what I consider to be a simple need. I want a “Search Folder” that shows me all the email related to a particular client. What works well for me is a query that finds any email with the client name in the subject, or any email that involves an email address (from/to/cc) from the client's email domain. Back in Thunderbird, it was simple to setup a rule for this. Outlook can't do it. (I'd go back to Thunderbird, but I have to get calendaring working first.) What doesn't work When you edit the criteria for a Search Folder, on the “Messages” tab, the fields you want appear to be represented, but the way things work is wrong. All the criteria specified must be true, not any; they went with “AND” where I need “OR”. The other problem is that the “From…” and “Sent To…” fields use a “starts-with...
1 comment
Read more