Microsoft Hyper-V
Thinfinity® Cloud Manager connects to Microsoft Hyper-V hosts using a Windows service account with remote management permissions, over WMI (Windows Management Instrumentation) via DCOM. This article documents the Cloud Manager credential form for Hyper-V, the prerequisites on the Hyper-V side, and common configuration errors.
All management calls from Cloud Manager originate from the Thinfinity® Workspace server. Ensure the Workspace server can reach the Hyper-V host on the DCOM ports — TCP 135 (RPC endpoint mapper) plus the dynamic high-port range. See Prerequisites for the full network requirements.
Prerequisites
Before adding Hyper-V credentials in Cloud Manager, the following must be in place on the Hyper-V side:
- The Hyper-V host runs Windows Server 2016 or later with the Hyper-V role installed.
- WMI and DCOM are enabled on the Hyper-V host (the Windows default). The Windows Management Instrumentation service must be running.
- A dedicated Windows service account exists for Cloud Manager (a domain account if the host is domain-joined, a local account otherwise), and that account is a member of the Hyper-V Administrators local group on the host.
- The Workspace server can reach the Hyper-V host on TCP 135 (RPC endpoint mapper) plus the DCOM dynamic port range (default 49152–65535 on Windows Server 2008+; configurable via the registry).
- Windows Firewall on the Hyper-V host allows the Windows Management Instrumentation (WMI-In) group, or equivalent inbound rules for TCP 135 and the dynamic range.
For how to configure WMI/DCOM permissions, manage the dynamic port range, and tune firewall rules, refer to the Microsoft WMI documentation.
The Hyper-V Administrators group grants management permission for all VMs on the host without requiring full local administrator rights. This is the recommended minimum for Cloud Manager.
Authentication Method
Cloud Manager connects to Hyper-V over WMI (Windows Management Instrumentation) via DCOM, using Windows authentication (Negotiate, which selects Kerberos when an Active Directory domain is reachable and falls back to NTLM otherwise). DCOM uses port 135 (RPC endpoint mapper) plus dynamic high ports; the connection is not over HTTP, and credentials never traverse the wire — only Kerberos tickets or NTLM tokens. This is why the credential form does not include a TLS verification option: there is no TLS layer to verify. DCOM provides packet-level encryption when the authentication level is set to Packet Privacy, which Cloud Manager requests by default.
Both AD-joined and standalone or workgroup Hyper-V hosts are supported: AD-joined hosts authenticate via Kerberos, while standalone hosts fall back to NTLM.
Add the Credentials in Cloud Manager
- In Cloud Manager, go to Credentials and click + New.
- Select Hyper-V as the provider.
- Fill in the fields below and click Save.
For the full Add / Edit / Delete procedure, see Managing Credentials.
Hyper-V Credential Fields
| Field | Description |
|---|---|
| Host | The FQDN or IP address of the Hyper-V server or cluster node (e.g., hyperv01.corp.local or 192.168.1.20). For Hyper-V clusters, enter the cluster name or the Cluster Management IP. |
| User | The Windows account that Cloud Manager uses to connect via WMI/DCOM. Use DOMAIN\username format for domain accounts (e.g., CORP\svc-thinfinity-cm) or hostname\username for local accounts. |
| Password | The password for the service account. |
Each Hyper-V credential set in Cloud Manager is scoped to a single host or cluster endpoint. To manage multiple independent Hyper-V hosts, create one credential set per host.
Verification
After saving, Cloud Manager validates the credentials by connecting to the Hyper-V host via WMI and querying the VM inventory. If validation succeeds, the credential status shows as Ok.
Common Errors
| Error | Likely Cause | Resolution |
|---|---|---|
Access is denied |
The service account lacks Hyper-V Administrators membership, or the password is incorrect. | Verify group membership on the Hyper-V host. |
The RPC server is unavailable |
TCP 135 is blocked between the Workspace server and the Hyper-V host, or the Remote Procedure Call (RPC) service is stopped on the host. | Open TCP 135 in the firewall and verify the RPC service is running. |
The remote procedure call failed |
A DCOM dynamic high port is blocked, or DCOM is misconfigured on the host. | Verify the dynamic port range (default 49152–65535) is reachable, or configure a fixed DCOM port via the registry and allow it in the firewall. |
The Windows Management Instrumentation service is not running |
The Winmgmt service is stopped on the Hyper-V host. |
Start the Windows Management Instrumentation service on the host. |
| Name resolution failure | The FQDN in the Host field cannot be resolved from the Workspace server. | Use the IP address instead, or verify DNS resolution from the Workspace server. |
Security Recommendations
- Use a dedicated service account with the minimum required permissions (Hyper-V Administrators group only). Avoid using a Domain Administrator account.
- Restrict DCOM access using Windows Firewall rules to allow inbound connections (TCP 135 and the dynamic high port range) only from the Thinfinity® Workspace server IP.
- Prefer Kerberos authentication over NTLM where the environment supports it. Kerberos provides mutual authentication (the client verifies the server’s identity, not just the reverse), which mitigates spoofing risks that NTLM does not address. Negotiate auto-selects Kerberos on AD-joined hosts.
See Also