Problems with Kerberos Athentication while connecting Hyper V (4319317)

Kerberos for logging on to Hyper-V can only be used in a Windows Domain context, it cannot be used for a local logon.

The next fallback in the list of authentication protocols would be NTLM, which may be undesirable.

In a scenario where local logon to Hyper-V is required, like in a Disaster-Recovery scenario where no functioning Domain Controllers are available Administrators should consider configuring Hyper-V to accept the "CredSSP" authentication protocol, which is an option during installation. 

To configure Hyper-V for CredSSP access, follow the below procedure:

1. On the Hyper-V host to be managed, open a Windows PowerShell session as Administrator.

2. Create the necessary firewall rules for private network zones:

   Enable-PSRemoting
   

3. To allow remote access on public zones, enable firewall rules for CredSSP and WinRM:

   Enable-WSManCredSSP -Role server
   

   For details, see Enable-PSRemoting and Enable-WSManCredSSP.

Next, configure the computer you'll use to manage the Hyper-V host.

1. Open a Windows PowerShell session as Administrator.

2. Run these commands:

    

   Set-Item WSMan:\localhost\Client\TrustedHosts -Value "fqdn-of-hyper-v-host"
   

    

   Enable-WSManCredSSP -Role client -DelegateComputer "fqdn-of-hyper-v-host"
   

3. You might also need to configure the following group policy:

   • Computer Configuration > Administrative Templates > System > Credentials Delegation > Allow delegating fresh credentials with NTLM-only server authentication
   • Click Enable and add wsman/fqdn-of-hyper-v-host.

4. Open Hyper-V Manager.

5. In the left pane, right-click Hyper-V Manager.

6. Click Connect to Server.