I'm just setting up a new 2012 R2 Hyper-V Cluster in a lab environment. Everything seems to be functioning properly. I'm able to create VMs locally in Hyper-V Manager and I can migrate between the two nodes in the cluster. However, my first attempt to deploy a machine within VMM is failing.

The error is:

Error (12700)
VMM cannot complete the host operation on the HyperVHostA.devKPlab.com server because of the error: The operation failed.

The Hyper-V Virtual Machine Management service encountered an unexpected error: Logon failure: the user has not been granted the requested logon type at this computer. (0x80070569).
Unknown error (0x8000)

Recommended Action
Resolve the host issue and then try the operation again.

After doing some research, I'm finding a lot of resources that are mentioning that I need to add 'NT Virtual Machine\Virtual Machines' hidden group to 'log on as a service' local policy (or GPO). However, on the local HyperV boxes I'm not able to get that account to resolve when I try and add it. I wouldn't expect 2012 R2 to be any different than 2012, but I'm at a loss here.

When your hosts are taken under control by SCVMM all permissions should be taken care of for you - you should never have to manually touch permissions or ACLs outside of restoring some item from backup.

Also, when you perform actions through the SCVMM console - it is the SCVMM Server service that performs the actions on the Hyper-V Servers / Cluster.

If the SCVMM Service runs under the computer account of the SCVMM Server computer then this account needs access on the Hyper-V Servers in the cluster.  If SCVMM is running under a domain user account, then this account should be granted the proper permissions.

Also, I am assuming that when you placed the cluster under management by SCVMM after the cluster was created.  Not individual Hyper-V Servers - as this changes a number of things.

If it was me, I would first try removing the cluster from management by SCVMM and then adding it back again.  Giving SCVMM a chance to reset the permissions.

Also, if you are using an SMB share for your VM target - permissions must be correct there as well.

Thank you for the response.

Yes, the cluster was validated, created and then added to SCVMM. I also have created a domain account to run the service. As a test (for lab purposes), that account has been added to the local administrators group on both nodes and also GPO was updated to allow that account to log on as a service. Both nodes have been rebooted and gpupdate has been run and verified.

I'm using CSV for the VM target - not sure that requires any additional permissions if the service account has been granted admin access. 

Are there any other policy needs for the SCVMM service account?

Guidelines here: https://technet.microsoft.com/en-us/library/gg697600.aspx?f=255&MSPPError=-2147217396

But if you search a bit, you will see that many folks have issues with domain accounts.

But, if you only have problems with VM deployment, the issue might be rooted at your cluster.  And at that level is a combination of computer account and domain service account.

Did you try removing the cluster from management and then adding it back again?

 

I rebooted each machine, removed from SCVMM and readded the cluster and machines can now be deployed. Thanks for the suggestion. Now my only issue is the case sensitivity of the hosts are different :|