Cannot configure Lab Management in TFS2010

Question

Hi! I keep getting this erros:

TF260078: Team Foundation Server could not connect to the System Center Virtual Machine Manager Server: servername. More information for administrator: You cannot contact the Virtual Machine Manager server. The credentials provided have insufficient privileges on servername.

Ensure that your account has access to the Virtual Machine Manager server on servername, and then try the operation again.

I've searched the Web furiously and found a thousand solutions, but none worked for me. I tried adding the TFSLAB which I am using while testing the connection to the Windows Authorization Access Group, I've also added the TFSLAB service account to the Pre-Windows 2000 Compatible Access built-in group, I've also changed the SQL Server names instance used by SCVVM to run under the TFSLAB service account, I've restarted the server several times and I just cannot get passed this error.

What should I do?

Answer 1

I'm also experiencing exactly the same issue. I've tried re-installing from scratch and am getting exactly the same issue again. Very frustrating!

Answer 2

As far as I can tell from the documentation regarding install of SCVMM for Lab Management, SCVMM should be running under the default of "Local System". The documentation makes no mention of changing the service account to be "TFSLAB", so I didn't change it. I'd also managed to find the two suggestions of adding the service account to the "Windows Authorization Access" and "Pre-Windows 2000 Compatible Access" groups. I was about to try them, but apparently changing the service account for SCVMM requires a re-install. It's also disappointing to hear you've already tried both suggestions and neither worked. Any help greatly appreciated!

Answer 3

Anyone?

Answer 4

One small piece of information that may be useful. I find that if my SCVMM service account is added to the "Windows Authorization Access" group, the error that I get when trying to configure lab management changes from "The credentials provided have insufficient privileges" to "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS). (Error ID: 2607)"

This would imply that adding the SCVMM service account to that group fixes the intial error, but there's still another error that needs fixing. Just in the process of looking into that now. I'd be interested to know if you get the same behaviour.

I should probably also mention that I've followed this article with no luck. Everything was already as it should be - http://blogs.technet.com/b/scvmm/archive/2009/06/15/solution-opening-the-scvmm-2008-admin-console-may-fail-with-permissions-related-error.aspx

Answer 5

Right, I've managed to get mine working after reading a couple of other related threads on here, plus some trial and error.

For mine to work, I needed to:

a) Have the SCVMM service running under a domain account, and add that account to the "Windows Authorization Access" group. This fixes the initial error, "You cannot contact the Virtual Machine Manager server. The credentials provided have insufficient privileges"

b) Have the SQL Server service running under a domain account, and add that account to the "Pre-Windows 2000 Authorisation" group "Pre-Windows 2000 Compatible Access" group. This fixed the "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS)" error.

At present I don't understand _why_ this fixes the issue, whether it's a particularly ideal solution, or whether it has any other implications, security or otherwise. Please don't assume this the THE answer, it's just AN answer, as I don't really understand what I've done yet. I hope it helps you however!

Answer 6

dnewt, I mentioned in the first post about adding TFSLAB to those build-in groups and running the services under TFSLAB instead of Local System or Network System.

However, when running VMM Agent under that account, I can no longer start the VMM Agent service, because of an error that has to do with Component Services. I tried to change the component causing the error (Virtual Disk Service Loader), but I am unable, not even with an elevated domain admin account because Windows Server 2008 R2 has some sort of improved security feature and thus the owner of the registry key for the specific component is TrustedInstaller and, moreover, Administrators only have read control. I tried solving this error too, but I didn't have any luck yet.

What I did though was to add the domain TFSLAB account to the machine's local admin account (however, I don't like this way of dealing with errors, so I'll try to solve that Component Services thing later).

I also drafted the work I did on a blog post here: http://wp.me/p17Srp-Z

I hope this helps anyone else having this problem!

Answer 7

I hadn't quite read your initial post correctly the first time. For some reason I hadn't registered that you had also included SQL Server in the same group with those two built-in groups added. Perhaps because you're using the 'TFSLAB' account, I had associated it with just TFS. Either way, I'm glad to hear you've managed to get somewhere.