HyperV/VMM folder- and VM-level permissions?

Question

With VMWare and vCenter, I'm used to creating folders in a filesystem manner to delegate permissions to users within the organization. For example, I might create a folder named QA, place all the QA VM's within that folder, and allow the QA Active Directory group to only have console access to this VM (unable to change it). I'm now evaluating HyperV R2 with VMM 2008 R2 and I can't find any such functionality. I've found "User Roles", but that seems to be more of a host-level solution, not VM or folder-level. Does such functionality exist yet within HyperV/VMM?

Answer 1

In Hyper-V you normally keep all the VHD files together in a central folder that normal users have no access to. It's a different way of securing the system; complete separation of hosts from users. Because of that users who will be creating and modifying VMs have to have some kind of administrative access to the Hosts, and that either covers the whole machine (as is common for IT type staff) or through a role in VMM (through either SSP or Administrative Delegation).

An example configuration might be that you have QA VMs for testing. The QA users need to be able to create a new VMs based on a simple base server, do their testing, and either save the machine for more extensive testing or scrub it.

You create a Role for the QA Group, making it a SSP User Role. Then create a VM template, basically a syspreped VM, which can be made from an existing VM by cloning it them making a template from the clone (the templating process destroys the source VM). You then assign the template to the QA group. QA Users can now create VMs based on this template, the new VMs will belong to QA and the QA users will be allowed full access to them (or limited access, depends on the settings in the SSP User Role you setup).

You can also assign ownership of existing VMs to that user group, which can then have access to the VM through SSP (again subject to the restrictions imposed by the User Role granting that group access).

In this example the QA users need no rights to the VHD files, no rights on the Host machines, and only limited rights in AD & VMM. This would not allows them to use the VMM Admin Console, but that is meant for Admins, not Users.

Alternatively, you can delegate administrative control of certain machines to particular users. If there is a QA testings Host, and they will not be running their VMs on the "main" cluster; you can delegate administrative control of that Host (through a Host Group) to the QA Users. This would allows users of the QA group to use the VMM Admin Console and have full administrative control of that particular host group. The same sort of delegation can be applies to Libraries, allowing for a QA library separate from the "main" library.

I'm sure this is all as clear as mud to someone who hasn't used it extensively; feel free to ask as many questions as you want to help clear this up.
_{(Full Disclosure: I work for a MS Gold Partner, we build these sorts of systems)}