Foglight for Automation Action Packs 5.6.3.8 - Hyper-V ActionPack User Guide

Chat now with support

Create Differencing VHD Create Dynamic VHD Create Fixed Size VHD Create Snapshot Create VM Delete VM Edit Drive

Pause VM Reboot Hyper-V Server Remove All Network Adapters Remove All Snapshots Remove Drive Remove Network Adapter Remove Snapshot Rename Snapshot Resume VM Revert to Snapshot Save VM Set MAC Address

Pre-conditions:

Set Network Shutdown Hyper-V Server

Input Parameters

Shutdown VM Start VM Stop VM Wait VM State

Local Security Settings

All settings in this section are configured using the Local Security Policy console.

To launch the console:

Open the Windows Control Panel.

Go to Administrative Tools.

Start the Local Security Policy. The Local Security Settings window opens.

Sharing and security model for local accounts

Navigate to Security Settings > Local Policies > Security Options > Network access: Sharing and security model for local accounts. Change the setting to Classic.

This only applies to Windows computers that are not a part of a domain.

DCOM Restrictions Policy

Make sure that the user account used has permissions to access, launch, and activate COM/DCOM/Automation objects.

To grant these permissions:

•

Add the user to the predefined local group: Administrators for Windows XP; or Distributed COM Users for Windows Vista, Windows 2003, Windows 2008, and Windows 7.

If you cannot grant the group permission to the user, do the following:

Create a local user in the Users group.

Navigate to Control Panel > Administrative Tools > Local Security Policy > Security Settings > Local Policies > Security Options.

Double-click DCOM: Machine Access Restrictions policy. Click Edit Security. Add the user created above. Enable the Remote Access option.

Double-click DCOM: Machine Launch Restrictions policy. Click Edit Security. Add the user created above. Enable Local Launch, Remote Launch, Local Activation, and Remote Activation options.

Navigate to Control Panel > Administrative Tools > Component Services > Computers. Right-click My Computer, click Properties, and open the COM Security tab.

In the Access Permissions section, click Edit Default. Add the user created above. Enable the Remote Access option.

In the Launch and Activation Permissions section, click Edit Default. Add the user created above. Enable the Local Launch, Remote Launch, Local Activation, and Remote Activation options.


	NOTE: In the Component Services section you can navigate to a specific component and grant permission from there, instead of doing so from the My Computer menu.

User Account Control

For Windows machines that are not part of a domain:

Open Security Settings > Local Policies > Security Options.

Disable the User Account Control: Run all administrators in Admin Approval Mode option.

Firewall Settings

To configure the firewall:

Enable all incoming traffic to the default DLL surrogate (dllhost.exe).

•

Create a rule that allows all incoming traffic for %systemroot%\system32\dllhost.exe.

•

For 64-bit systems only: create a rule that allows all incoming traffic for %systemroot%\SysWOW64\dllhost.exe.

Enable COM network access.

•

For Windows XP only: create a rule that allows all incoming traffic for TCP Port 135 (DCE/RPC Locator service).

•

For Windows Vista, 2003, and 2008: enable COM+ Network Access (DCOM-In) rule for active profile.

Enable File and Printer sharing access.

•

For Windows XP: enable File and Printer sharing exception rule.

•

For Windows Vista, 2003, and 2008: enable all rules in the File and Printer sharing group for active profile.


	NOTE: Make sure that the scope defined for rules includes the host, which runs vFoglight.

Configuration Script

Use the script below to configure the firewall.

On the target machine create a file named firewall-config.ps1 with the script listed below.

Run the script with Administrator’s privileges using the following command:
powershell -File firewall-config.ps1

# PROPRIETARY/CONFIDENTIAL.

# This software is the confidential and proprietary information

# of Quest ("Confidential Information").

# You shall not disclose such Confidential Information and shall

# use it only in accordance with the terms of the license agreement

# you entered into with Quest.

$OS = Get-WmiObject Win32_OperatingSystem

$OSBuildNumber = $OS.BuildNumber

$OSCaption = $OS.Caption

$useAdvancedFirewall = $true

$COMNetworkAccessGroup = "COM+ Network Access (DCOM-In)"

if (($OSBuildNumber -eq 2600) -or ($OSBuildNumber -eq 3790)) {

$useAdvancedFirewall = $false

}

if ($OSBuildNumber -eq 7600) {

# Windows 7

$COMNetworkAccessGroup = "Windows Management Instrumentation (WMI)"

}

if ($useAdvancedFirewall) {

Echo "Configuring firewall for Windows Vista/2008/7"

netsh advfirewall firewall add rule name="DLL Host (32-Bits)" dir=in action=allow program="%systemroot%\system32\dllhost.exe"

netsh advfirewall firewall add rule name="DLL Host (64-Bits)" dir=in action=allow program="%systemroot%\SysWOW64\dllhost.exe"

netsh advfirewall firewall set rule group=$COMNetworkAccessGroup new enable=yes

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=yes

}

else {

Echo "Configuring firewall for Windows XP/2003"

netsh firewall add allowedprogram "%systemroot%\system32\dllhost.exe" "DLL Host (32-Bits)" ENABLE

netsh firewall add allowedprogram "%systemroot%\SysWOW64\dllhost.exe" "DLL Host (64-Bits)" ENABLE

netsh firewall add portopening TCP 135 "DCE/RPC Locator service" ENABLE

netsh firewall set service FileAndPrint ENABLE}

COM and Automation Objects

The COM and Automation objects are required to perform remote tasks on Windows machines that are not configured for remote activation. Therefore additional configuring of the DLL surrogate is required.

Registry Permissions

Make sure that the Administrator user has Full Control access to the following registry keys:

•

HKEY_LOCAL_MACHINE/Software/Classes/AppID

•

HKEY_LOCAL_MACHINE/Software/Classes/CLSID/{0D43FE01-F093-11CF-8940-00A0C9054228}

•

HKEY_LOCAL_MACHINE/Software/Classes/CLSID/{13709620-C279-11CE-A49E-444553540000}

•

HKEY_LOCAL_MACHINE/Software/Classes/CLSID/{72C24DD5-D70A-438B-8A42-98424B88AFB8}

•

HKEY_LOCAL_MACHINE/Software/Classes/CLSID/{76A64158-CB41-11D1-8B02-00600806D9B6}