1

Hi all,

I know this has probably been asked a million times but I can’t quite find the answer I’m looking for…

We have a single server running Hyper V Core 2019, this is running a Server Essentials 2016 VM.

We’re in the process of upgrading, new drives, new RAIDs, fresh install of Hyper V Core, but wanted to know the following:

Should the Hyper V Core server really been joined to the domain in this setup? If we had multi servers/DCs I can totally understand this. As one could authenticate with secondary DCs etc.

As Server Essentials is the only DC, the way I’m thinking (please correct me if I’m wrong). If the Hyper V is domain joined, unless it can see the DC (Server Essentials 2016) it won’t be able to authenticate and thus we won’t be able to log in. So, if the Essentials VM doesn’t boot for whatever reason, the Hyper V won’t be able to authenticate with the DC.

I’m thinking if the Hyper V Core is purely set in a workgroup, it won’t matter if the DC doesn’t boot or not and we’ll still be able to log in on it to manage via Windows Admin Center/Hyper V Manager. Does that make sense?

Does anyone have any best practices/tips/comments for this kind of environment?

6 Spice ups
2

I think you might have misunderstooded as there are 3 different OS and/or hypervisor you are mentioning

  • Hyper-v 2019 which is the “harden” hypervisor much like VMware ESXi which receives or have patches only once every 3-6 months. This is no longer being offered after hyper-v 2019
  • Server 2019 “core” with hyper-v role which is a full server 2019 without the GUI, it still have the functionality of server 2019 std with updates etc but requires only cmd lines
  • server 2019 “GUI” with hyper-v role

If I read the min hardware requirements between core vs GUI is like CPU 300Mhz and 1.5GB of RAM, it does makes no sense not to use the GUI with its ease of usage and troubleshooting especially with event viewer etc ?

3

Hi Adrian,

Thanks for the reply. It’s Microsoft Hyper-V Server 2019 . My apologies.

Reason being is costs. Microsoft Hyper-V Server 2019 is free and my boss likes “free” :slight_smile:

4

Single Hyper-V host is safer in a workgroup, as an attacker that has domain credentials or Kerberos tickets couldn’t directly leverage them against the host.

Managing a host in workgroup is a little harder to get going.

It isn’t true that you wouldn’t be able to login to the host if the domain controller was down. You would still have local accounts available, which is exactly how you would login to a workgroup host.

3 Spice ups
5

I am making no distinction between Hyper-V Server and Windows with Hyper-V role, because from the authentication and security perspective around workgroup and domain joined there is no difference.

2 Spice ups
6

All 3 are “free” as long as you do not have other roles and features enabled (other than hyper-v) or applications installed on the server 20xx with hyper-v role.

The only drawbacks is that Hyper-v server, like ESXi have much fewer updates and patches unlike server 20xx with hyper-v role that can have monthly CU & feature updates etc and have to reboot the host.

Being in Domain can be easier to control as you can start using Domain users or assign to Domain groups for VM management. But depending on your Org sector, it can also mean if it gets attacked or compromised, the intruder can get access to Domain data…

1 Spice up
7

I never add hypervisors and backup infrastructure to the same domain as users. They are usually in the workgroup.
Yes, they are a bit harder to manage but also better protected.

1 Spice up