Windows Server 2019 — Hyper-V live migration fails with Kerberos constrained delegation errors — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Live migration jobs fail and planned host maintenance cannot proceed without VM downtime.

Environment & Reproduction

Windows Server 2019 Hyper-V cluster using Kerberos authentication for migration.

Get-VMHost | Select VirtualMachineMigrationAuthenticationType
Get-ClusterNode

Root Cause Analysis

Constrained delegation for CIFS and Microsoft Virtual System Migration Service is missing or misconfigured.

Quick Triage

Validate SPN resolution and host trust configuration in AD.

setspn -L HV01
Get-ADComputer HV01 -Properties msDS-AllowedToDelegateTo

Step-by-Step Diagnosis

Review migration logs, verify delegation targets, and test host-to-host authentication.

Get-WinEvent -LogName 'Microsoft-Windows-Hyper-V-VMMS/Admin' -MaxEvents 80
Test-Cluster

Solution — Primary Fix

Configure constrained delegation correctly for both source and destination hosts, then retry migration.

# Configure in AD Users and Computers or PowerShell
Set-VMHost -VirtualMachineMigrationAuthenticationType Kerberos
Restart-Service vmms

Solution — Alternative Approaches

Temporarily use CredSSP for emergency migrations while finalizing KCD settings.

Set-VMHost -VirtualMachineMigrationAuthenticationType CredSSP

Verification & Acceptance Criteria

Test VM migrates successfully between two cluster nodes without credential prompts.

Move-VM -Name TestVM -DestinationHost HV02 -IncludeStorage -WhatIf

Rollback Plan

Return authentication method to previous mode if KCD introduces unexpected auth failures.

Set-VMHost -VirtualMachineMigrationAuthenticationType CredSSP

Prevention & Hardening

Document delegation requirements in cluster build runbooks and validate after host joins.

Get-ADComputer -Filter 'Name -like "HV*"' -Properties msDS-AllowedToDelegateTo

Related Errors & Cross-Refs

Commonly linked to duplicate SPNs and DNS reverse lookup mismatches.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: Hyper-V live migration authentication and constrained delegation setup.