While trying to Move a VM between stand-alone Hyper-V servers, you might get an error like this:
The Virtual Machine Management Service failed to establish a connection for a Virtual Machine migration with host ‘HyperVMachine2’: No credentials are available in the security package (0x8009030E).
This would fail the move of the virtual machine.
In this case, it was between a previously installed Windows 2025 server and a newly installed one. The error suggests it is an authentication issue.
What happens is that in Windows 2025 credential guard is enabled by default, and it blocks CredSSP-based delegation to the other server. With older versions of Windows these things can also happen and sometimes you can overcome it by sitting on the source server and opening a Windows explorer and make a connection to a share on the other server. But in this case, we will setup Kerberos contrained Delegation and enable the Hyper-V servers to use Kerberos for migrations of VM’s.
Below you will find a link with an extensive explanation and step-by-step how to do these things. I will use a shorter version here.
First, go to Active Directory Users and Computers MMC tool. Find your Hyper-V computers involved in this story. Open up the properties of a computer and go to the Delegation tab.
Set Trust this computer for delegation to specified services only. Use any authentication protocol. And add services. What you do is you enter the name of the other hyper-v computer and you find and select the “cifs” and “Microsoft Virtual System Migration Service”. In my example here on server M123 I select those two services on the other two hyper-V servers. Next I go to the other computer accounts and select again the two other machines and these services. This configuration takes effect after the domain controllers replicated this change and the domain controller issues a new Kerberos ticket. So if it does not work after 2 seconds, this could be the reason.
Next we go to the Hyper-V servers involved and open the Hyper-V Manager MMC console. We select a hyper-v server on the left. On the right go to Hyper-V Settings. You will find a tab called Live Migrations.
Select Enable incoming and outgoing live migrations. Select any number of simultaeous migrations you feel comfortable with. Select a network to use or select the Use any available network for live migrations. Now comes an extra item, on the left hand side there is a small plus sign next to live migrations. Use that to open up Advanced Features.
Now you can make sure Use Kerberos is selected. Select any performance options you feel OK with.
Now move the VM by selecting a virtual machine and to the right selecting Move and select the options needed and the target hyper-v host.
This is the Microsoft link explaining more and having step-by-step instructions:
https://go.microsoft.com/fwlink/?linkid=2258829
I had to look this up a few months ago while installing a hyper-v server and migrating stuff off an older 2019 machine. And yesterday the error came again while trying to migrate some VM to a newer hyper-v host to spread the load a bit. Searching lead to some old posts and solutions less relevant to to the case, so I decided to blog it for my memory, and hopefully somebody else.