Windows Server  ·  high  ·  Failover clustering & Hyper-V

Live Migration fails — 0x8009030E and delegation errors

The destination host cannot obtain the credentials to open the virtual machine's files, because Kerberos delegation is not configured.

What you see

Live migration fails immediately with 0x8009030E when started from a remote management session, but works when started from the source host's console.

What is actually wrong

CredSSP works only when the migration is initiated from the source host itself. Anything remote requires Kerberos constrained delegation between the hosts.

Codes and articles

0x8009030EEvent 21502Event 20306No credentials are availablelive migration failedconstrained delegation

The fix

Configure constrained delegation between the hosts
Elevated PowerShell with directory rights60 minutesmedium riskreversible

Migration works locally and fails remotely.

  1. Confirm the authentication protocol in use.

    PowerShell
    Get-VMHost | Format-List ComputerName,VirtualMachineMigrationEnabled,VirtualMachineMigrationAuthenticationType,VirtualMachineMigrationPerformanceOption

  2. Switch both hosts to Kerberos.

    PowerShell
    Set-VMHost -VirtualMachineMigrationAuthenticationType KerberosEnable-VMMigration

  3. Configure delegation on each host's computer object, for every other host it will migrate to. This has to be done in both directions.

    PowerShell
    $hosts = 'HV01','HV02','HV03'foreach ($src in $hosts) {  foreach ($dst in $hosts | Where-Object { $_ -ne $src }) {    Set-ADComputer -Identity $src -Add @{ 'msDS-AllowedToDelegateTo' = @("Microsoft Virtual System Migration Service/$dst.example.local", "cifs/$dst.example.local") }  }}

    Both service principal names are required. The migration service moves the virtual machine's state and CIFS moves its files — configuring only the first produces a migration that starts and then fails partway with the same error.

  4. Set the delegation to Kerberos only, not "any authentication protocol", which is a broader grant than this needs.

    PowerShell
    Get-ADComputer HV01 -Properties msDS-AllowedToDelegateTo,TrustedForDelegation | Format-List Name,TrustedForDelegation,msDS-AllowedToDelegateTo

  5. Restart the hosts, or at minimum the Hyper-V Virtual Machine Management service, so the change takes effect.

    PowerShell
    Restart-Service vmms

  6. Test a migration from a remote management session.

Confirm it workedA live migration started from a management workstation completes.
PowerShell
Move-VM -Name TestVM -DestinationHost HV02 -IncludeStorage -DestinationStoragePath C:\ClusterStorage\Volume1\TestVM
If you need to undo itClear msDS-AllowedToDelegateTo on the computer objects, or set the authentication type back to CredSSP.

Related faults

Virtual machines lose network after a host changeWindows ServerKerberos failures — clock skew, SPN duplicates and KDC errorsWindows ServerTime is wrong across the domain — w32time events 129, 36, 47Windows Server

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.