Windows 10 - Hyper-V Manager student account

[Theldron]

Hi all,

 

Hope you are well.

 

One of the schools I work at the students have hyper-v manager access in one of the rooms. Originally they only had access through one account, but I have just found out it was a limited staff account setup, but students are starting to abuse it now, as they will, so it has been disabled.

 

I spoke to the former head of IT and apparently they couldn't get Hyper-v manager working on a student account. Does anyone know of the permissions or a way in applocker to allow Hyper-v manager access for a student account?

 

Thanks.

[3s-gtech]

Windows doesn't distinguish staff or student accounts built-in - it's all Group Policy and Standard/Power User/Administrator group membership.

 

Are you accessing Hyper-V on the local machine? I think that will require system-wide changes if local, so won't fall under the scope of regular User accounts.

 

If it's to a remote server, I'm not sure.

[Theldron]

Hi @3s-gtech they use the local hyper-v manager to create VMs on a remote server, if that makes any sense?

[3s-gtech]

It does. That *should* be easier to make it work.

 

The application itself is %windir%\System32\mmc.exe "%windir%\System32\virtmgmt.msc"

 

You'll need to see if MMC itself is blocked, it usually is.

[Theldron]

It does. That *should* be easier to make it work.

 

The application itself is %windir%\System32\mmc.exe "%windir%\System32\virtmgmt.msc"

 

You'll need to see if MMC itself is blocked, it usually is.

 

Thanks found the setting to allow Hyper-V manager in User Configuration - Admin Templates - Windows Components - Microsoft Management Console - Restrict Users to the explicitly permitted list of snap-ins, setting this to Not Configured then going through the snap-ins and blocking the rest worked well.

 

I have managed to get the IT department to only have it in one room. Short of making 2 student groups - Hyper-Vuser and NonHyper-VUsers so that I can limit access, there is no way to block access to Hyper-V for any other users is there?

 

Nothing like item level targeting so that I can say only a student that is also a member of HyperVuser can access it?

 

Thanks

[3s-gtech]

I don't think so - that sort of targeting only works on GPPs. You may be able to use WMI to target the GPOs though.