I just spent about an hour debugging an issue that I thought I would throw out here, in case anyone else runs into a similar situation. Using 2012 R2 Windows Server and System Center. I recap at the bottom, but if you don't want to read all the way through this long post, here is a synopsis.
1. Configure constrained delegation on any system that runs the VMM console, not just the VMM servers.
2. I think Microsoft has some bugs in some of the scripts that are generated. (But you will never run into them if you do #1)
I use constrained delegation all the time with VMM and had not had an issue in the past, but this one was a little different. I have two VMM servers set up for HA, so the SCVMM library is on a highly available file share (Windows Server cluster). I have the VMM servers set up for constrained delegation for cifs on the VMM library. When using the console on either of the VMM hosts, everything works just fine.
But, I want to use a management workstation so I don't have to log into the actual VMM servers. I have the management workstation set up to do all sorts of management across my Hyper-V/System Center environment. I forgot to set up constrained delegation on the management workstation for cifs on the VMM library. Actually, I was thinking it was not needed because I was thinking the actual work was being done on the VMM servers and their constrained delegation was working just fine.
But, rather that get a nice clear message that it wasn't working, this is what I ended up with.
Within the VMM console on my management workstation, I create a VM. Within the creation wizard, I alter the hardware configuration to use an ISO I have stored in the VMM library and mark it to be shared. When I submit the job, it completes with info. Here is the info.
Warning (1280) Virtual Machine Manager cannot link ISO \\vmm-library.vspex.com\PrimaryLibrary\Software\Nexus-1000V.5.2.1.SM1.5.2a.iso to virtual machine N1KV02 on host FT4-Infra02.VSPEX.COM. The file is not accessible from this host Recommended Action Manually grant permissions of the host account to the ISO file, or detach the ISO from the VM and then try the operation again.
Yes, the warning does sound like the lack of constrained delegation, but instead of starting there, I take the recommended option. From the VMM console on the management workstation, I pull up the properties of the newly created VM, point to the same ISO file in the VMM library, click the shared box, and save it. Start up the VM and VM builds just fine from the shared ISO. No errors or warnings, and the ISO was not copied, just like things are supposed to work. So, I thought constrained delegation was working properly.
But I wasn't happy with that extra step. So, what I did was the exact same thing, except I did not check the box to share the ISO during the creation wizard. After VMM created the VM with no errors or warnings, I went into the properties of the VM and checked the box to share the ISO. Clicked OK and thought it was ready to go. But, I did not notice a job get created like always happens when you change the properties of a VM. Sure enough, I went back into the properties and the check box was NOT updated. Strange.
The next thing to look at was the View Script (love that for debugging) for the job that I thought would be created but wasn't. I manually executed the first two instructions, and things worked as expected. When I executed the third instruction, PowerShell kicked out an error saying the ISO file was found in the library. Okay, so it appears the VMM actually did create some sort of job, though it did not get put into the job queue, because the job entry was supposed to be created on this third instruction. But, since it errored out, it was not put into the queue. Making matters worse, because it errored out before it was put into the job queue, it could not report the fact there was an error.
But, I now figured out there was something wrong. I went back into the properties of the VM, and even though the ISO was listed as assigned to the DVD drive, I browsed the library again, reselected the ISO, clicked the shared box, and had a successful job updating the properties. The VM built properly, too.
Finally, I figured it out that I really did have to set constrained delegation on my VMM console workstation. I did that, and everything worked as it was supposed to.
Two points to this long post. First, any system from which you plan to run the VMM console should be configured for constrained delegation, not just the VMM hosts themselves.
Secondly, I think Microsoft has a couple of things to fix. The fact that it 'successfully' created the VM with the non-shared ISO was one, leaving the 'invalid' ISO as a valid ISO. (I will admit that I most likely would have received the error when I tried to start the VM, but it seems like it should have told me something at this point). The second is the script that is created when I tried to update the shared box has a problem because it is combining the check for a valid library entry on the same line as the creation of the job. As a result, there is no indication of any sort of an error if the ISO file is invalid.
.:|:.:|:. tim