Manage SCVMM in restrictive Active Directory environment

Manage SCVMM in restrictive Active Directory environment

So you want to manage your VMM infrastructure while keeping an eye on your Hyper-V hosts security. Looks like everyone wants to do that. So have you thought before about using Restricted Groups group policy to limit membership for your local admins group?

Let’s have a look at when to use a domain account for the VMM Service. In a restrictive Active Directory environment in which Restricted Groups group policy is in effect, we must use a domain account instead of Local System for the VMM service account. The Restricted Groups policy does not allow machine accounts to be a member of the local Administrators group. Under a Restricted Groups group policy, the VMM machine account will be removed from the computer, leaving VMM unable to communicate with the host. In that situation, VMM places the host in a Needs Attention state and places the VMM agents on hosts and library servers in Not Responding status in VMM.

For our “Restricted Groups group policy” issue, we have two methods to fix it.

Method one


Add the VMM Server machine account to the Administrators “Restricted Groups” group policy setting. But if a Restricted Groups policy is defined and Group Policy is refreshed, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators.

Note To add the VMM Server machine account to the restricted group setting, use the following syntax:


Method two


Create a new organizational unit in the domain, move the Virtual Server and Hyper-V Server computer objects to the new OU and then configure the new organizational unit to block policy inheritance.

There are some articles which indicate the restricted group:

Updates to Restricted Groups (“Member of”) behavior of user-defined local groups

Restricted Groups

Restricted Groups Policy Settings

Leave a Comment
  • Please add 7 and 3 and type the answer here:
  • Post
Wiki - Revision Comment List(Revision Comment)
Sort by: Published Date | Most Recent | Most Useful
Page 1 of 1 (2 items)
Wikis - Comment List
Sort by: Published Date | Most Recent | Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
  • T.Wooley MSFT edited Original. Comment: Minor updates

  • Maheshkumar S Tiwari edited Revision 1. Comment: Added tags

Page 1 of 1 (2 items)