Microsoft KB Archive/838672

Knowledge Base

You cannot add the Administrators group to the Virtual Server Security Settings in Virtual Server 2005

Article ID: 838672

Article Last Modified on 11/2/2007

---

APPLIES TO

• Microsoft Virtual Server 2005 Standard Edition

---

Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

After you remove the Administrators permission entry from the Virtual Server Security Settings page of the Microsoft Virtual Server 2005 Virtual Server administration Web page, you experience both the following symptoms:

• When you next log on to the Virtual Server administration page, the following information appears under Servername Recent Events:

  Type	Date/Time	Category	Message
  warning symbol	date and time	Setting Change	The security settings for the Virtual Server event log cannot be synchronized with the Virtual Server security settings. See Virtual Server Help for more information.

• When you try to add the Administrators group to an entry on the Virtual Server Security Settings page, you receive the following error message:

  The access control settings could not be saved. The parameter is incorrect.

CAUSE

This issue occurs because the security permissions for the Administrators group have been removed from the Virtual Server files and from the Virtual Server event log registry key.

RESOLUTION

To resolve, this issue, follow these steps:

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Log on to the computer as Administrator or as a member of the Administrators group.
2. Start Windows Explorer, and then take ownership of all the following files and folders:

   \Documents and Settings\All Users\Shared Documents\Shared Virtual Networks
   \Documents and Settings\All Users\Application Data\Microsoft\Virtual Server

   Note When you take ownership of these folders, click to select the Replace owner on subcontainers and objects check box. To do this, follow these steps:

   1. Right-click the \Documents and Settings\All Users\Shared Documents\Shared Virtual Networks folder, and then click Properties.
   2. Click the Security tab, and then click Advanced.
   3. Click the Owner tab, and then click Administrators (Servername\Administrators).
   4. Click to select the Replace owner on subcontainers and objects check box, and then click OK.
   5. If you receive the following error message, click Yes:

      You do not have permission to read the contents of directory C:\Documents and Settings\All Users\Documents\Shared Virtual Networks. Do you want to replace the directory permissions with permissions granting you Full Control?
      
      All permissions will be replaced if you press Yes.

   6. Click OK.
   7. Right-click the \Documents and Settings\All Users\Application Data\Microsoft\Virtual Server folder, and then click Properties.
   8. Click the Security tab, and then click Advanced.
   9. Click the Owner tab, and then click Administrators (Servername\Administrators).
   10. Click to select the Replace owner on subcontainers and objects check box, and then click OK.
   11. If you receive the following error message, click Yes:

       You do not have permission to read the contents of directory C:\Documents and Settings\All Users\Application Data\Microsoft\Virtual Server. Do you want to replace the directory permissions with permissions granting you Full Control?
       
       All permissions will be replaced if you press Yes.

   12. Click OK.
3. Assign the following accounts Full Control permissions to the \Documents and Settings\All Users\Shared Documents\Shared Virtual Machines folder and to all its child objects:

   Administrators
   SYSTEM
   NETWORK SERVICE

   To do this:

   1. Right-click the \Documents and Settings\All Users\Shared Documents\Shared Virtual Machines folder, and then click Properties.
   2. Click the Security tab, and then click Add.
   3. Type administrators; system; network service, click Check Names, and then click OK.
   4. In the Group or user names list, click Administrators (Servername\Administrators), click to select the Full Control check box that is in the Allow column, click NETWORK SERVICE, click to select the Full Control check box that is in the Allow column, click SYSTEM, and then click to select the Full Control check box that is in the Allow column.
   5. Click Advanced, click to select the Replace permission entries on all child objects with entries show here that apply to child objects check box, click OK, and then click Yes when you receive the following message:

      This will remove explicitly defined permissions on all child objects and enable propagation of inheritable permissions to those child objects. Only inheritable permissions propagated from Shared Virtual Machines will take effect.
      
      Do you wish to continue?

   6. Click OK.
4. Assign the following accounts Full Control permissions to the \Documents and Settings\All Users\Shared Documents\Shared Virtual Networks folder and to all its child objects:

   Administrators
   SYSTEM
   NETWORK SERVICE

5. Assign the Administrators group Full Control permissions to the following registry subkey:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Virtual Server

   To do this:
   
   Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

   1. Click Start, click Run, type regedit in the Open box, and then click OK.
   2. Locate, and then click the following registry subkey:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Virtual Server

   3. Right-click Virtual Server, and then click Permissions.
   4. Click Add, type administrators in the Enter the object names to select box, click Check Names, and then click OK.
   5. In the Group or user names list, click Administrators (Servername\Administrators), click to select the Full Control check box that is in the Allow column, and then click OK.
   6. Quit Registry Editor.
6. Restart the Virtual Server service, and then quit Internet Explorer if it was running during this process. To restart the Virtual Server service, follow these steps:
   1. Click Start, click Run, type services.msc in the Open box, and then click OK.
   2. Right-click Virtual Server, and then click Restart.
7. Start Internet Explorer, and then open the Virtual Server administration Web page.
   
   

Additional query words: VS, VM

Keywords: kbenv kbprb KB838672

---

Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.