Disclaimer: The following is not supported in any way. Try it on your own risk.

1. See the excelent post on how to manually import VMs not previously exported.  Restrictions: It only works for Win2008, it does not work for R2.
2. Use the following simple script to automate #1 - you'd see why if you have snapshots. Your VM including vhd and snapshots are in the folder pathtovm. Save the following script in importvm.cmd. Usage: importvm pathtovm. The script will generate vmiport.txt containing the commands you'll need to run to manually import your VM.

@echo off

@setlocal ENABLEEXTENSIONS

pushd .

for %%f in (%1"\Virtual Machines\*.xml") do (
    set vm=%%~nf
    @echo mklink "%systemdrive%\programdata\Microsoft\Windows\Hyper-V\Virtual Machines\%%~nf.xml" "%1\Virtual Machines\%%~nf.xml" >> vmimport.txt
    @echo icacls "%systemdrive%\programdata\Microsoft\Windows\Hyper-V\Virtual Machines\%%~nf.xml" /grant "NT VIRTUAL MACHINE\%%~nf":^(F^) /L >> vmimport.txt
    @echo icacls %1 /T /grant "NT VIRTUAL MACHINE\%%~nf":^(F^) >> vmimport.txt
    @echo rem >> vmimport.txt
)

for %%s in (%1"\Snapshots\*.xml") do (
    @echo mklink "%systemdrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\%%~ns.xml" "%1\Snapshots\%%~ns.xml" >> vmimport.txt
    @echo icacls "%systemdrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\%%~ns.xml" /grant "NT VIRTUAL MACHINE\%vm%":^(F^) /L >> vmimport.txt
    @echo rem >> vmimport.txt
)

popd

@endlocal

FIM CM Operations

Although simple and intuitive at first sight, FIM CM Operations sometimes yield rather interesting and subtle results. The differences among certain operations are border line and sometimes are misinterpreted.

This post is intended to provide a clear and concise hands-on summary to help out understanding each operation's purpose, context and outcome.       

Operations in FIM CM can be categorized:

• A. from CA functionality perspective grouped in Enrollment and Revocation operations:

Enrollment

• § Software profiles
• § Duplicate
• § Enroll
• § Online Update
• § Recover on Behalf
• § Recovery
• § Renew
• § Smartcard profiles
• § Duplicate
• § Enroll
• § Online Update
• § Recover On Behalf
• § Renew
• § Replace
• § Temp card Enroll

Revocation

• § Software profiles
• § Online Update
• § Renew
• § Revoke
• § Suspend
• § Reinstate
• § Smart card profiles
• § Disable
• § Online Update
• § Renew
• § Replace
• § Retire
• § Suspend
• § Reinstate
• § Temp card Disable
• § Temp card Retire

• B. from FIM CM Management Policies perspective grouped in software (SW) and smart card (SC) related operations.

Management Policies

Management Policy	Self Serve	Initiator	Approver	Enroll Agent	OTP	Data Collection
Disable	√	√	-	-	√	User/Mgr
Duplicate	√	√	√	√	√	User/Mgr
Enroll	√	√	√	√	√	User/Mgr
Offline Unblock	-	√	-	√	-	Mgr
Online Update	√	√	√	√	√	User/Mgr
Recover on Behalf	-	√	√	√	-	Mgr
Recovery	√	√	√	√	√	User/Mgr
Renew	√	√	√	√	√	User/Mgr
Replace	√	√	√	√	√	User/Mgr
Retire	√	√	√	-	√	User/Mgr
Revoke	√	√	√	-	√	User/Mgr
Suspend	√	√	√	-	√	User/Mgr
Reinstate	√	√	√	-	√	User/Mgr
Temporary Cards Enroll	√	√	√	√	√	User/Mgr
Temporary Cards Disable	√	√	-	-	-	-
Temporary Cards Retire	√	√	√	-	-	-
Unblock	√	√	√	-	√	User/Mgr

Management Policy	SW	SC	CA function	Outcome	Revocation and DeltaCRL published
Disable		√	Revoke	All certs revoked.	After approver Approve and subscriber Enter DC
Duplicate	√	√	Enroll	Primary profile: all certs unchanged. Duplicate profile certs: primary profile valid arch certs and new auth certs.
Enroll	√	√	Enroll	All new certs.
Offline Unblock		√	-	User Pin changed
Online Update	√	√	Enroll Revoke	Certificate content change. New valid updated all certs. Revoke old auth (and optional old arch) certs. Certificate template list change. If added to list, then enroll new certs. If deleted from list, then revoke old certs: auth removed from profile, arch kept in profile. Certificate expiry. Same as Renew except that old arch certs are optionally revoked.	After approver Approve and subscriber Enter DC
Recover on Behalf	√	√	Enroll	Arch certs revoked recovered.
Recovery	√		Enroll	Arch certs revoked recovered and new auth certs.
Renew	√	√	Enroll Revoke	Old profile: all certs revoked. New profile certs: old arch recovered certs, new arch certs and new auth certs.	After approver Approve and subscriber Enter DC
Replace		√	Enroll Revoke	Old profile: all certs revoked. Recovered profile certs: arch certs recovered and new auth certs.	After approver Approve BEFORE subscriber Enter DC
Retire		√	Revoke	All certs revoked.	After approver Approve and subscriber Enter DC
Revoke	√		Revoke	All certs revoked.	After approver Approve and subscriber Enter DC
Suspend	√	√	Revoke	All certs temporary revoked.	After approver Approve and subscriber Enter DC. Reason Certificate Hold
Reinstate	√	√	Revoke	All certs un-revoked.	After approver Approve and subscriber Enter DC. Reason Remove from CRL.
Temporary Cards Enroll		√	Enroll Revoke(*)	Not linked to perm card: new auth certs, no arch certs. Linked to perm card, suspend perm card(*) Perm card: auth cert revoked, arch cert valid. Temp card: recovered archived revoked certs and new auth certs.	After enroll agent executes. Reason Certificate Hold(*)
Temporary Cards Disable		√	Revoke	Not linked to perm card: Temp auth certs revoked, no arch certs. Linked to perm card, suspend perm card: Perm card: perm auth cert un-revoked and old arch cert valid. Temp card: auth cert revoked and arch cert valid.	After initiator Initiate
Temporary Cards Retire		√	Revoke	Not linked to perm card: Temp auth certs revoked, no arch certs. Linked to perm card, suspend perm card: Perm card: perm auth cert un-revoked and old arch cert valid. Temp card: auth cert revoked and arch cert valid.	After approver Approve
Unblock		√	-	User Pin changed

Given the recently increased usage of Hyper-V VM environments especially in Internal Networks there’s need for a way of access to and from external resources without changing the network configuration. Sometimes, for complex topologies, that might too expensive or maybe not feasible at all.

A quick yet effective solution to this problem can be implemented via configuring TCP/IPv4 routing on the VM Host box.

Scenarios:

·         Need to TS from a corp machine to a VM Internal Network

·         Need to join a physical box to a VM Internal Network

·         Need to access a resource outside a VM Internal Network

Let’s assume following network configuration:

1.       CORP LAN

Name:  corpclient1

Domain: acme.com

LAN Configuration: default (DHCP enabled)

IP: 157.59.74.c1

2.       Hyper-V VM HOST

Name: vmhost1

Workgroup: workgroup1

LAN Configuration: default (DHCP enabled)

IP (External): 157.59.79.g1

LAN Configuration: static IP

IP (Internal): 192.168.1.g2

3.       VM GUEST INTERNAL NETWORK

Name: vmdc1

Domain: vmad1.com

LAN Configuration: static IP

IP: 192.168.1.y

Default Gateway: 192.168.1.y

Name: vmguest1

Domain: vmad1.com

LAN Configuration: default (DHCP enabled)

IP: 192.168.1.g1

Step1: On VM HOST enable and configure Routing and Remote Access.

·         Add role Network Policy and Access Services

·         Select  Role Services: Routing and Remote Access

·         Choose Custom Configuration

·         Select only LAN Routing

·         Start Routing and Remote Access

Step2: On corpclient1 add route to external gateway

·         route add 192.168.1.0 mask 255.255.255.0 157.59.79.g1 metric 1

NOTE: If this machine is intended to be joined to a domain in internal network:

• This route needs to be persistent (route add -p...) 
• The TCP/IPv4 DNS set to point to the internal network DNS server address

Step3: On vmguest1 add route to internal gateway

·         Route add 157.59.79.0 mask 255.255.255.0 192.168.1.g2 metric 1

NOTE: This step can be avoided if the default gateway is set on the DC to 192.168.g2 via setting “003 Router” parameter in DHCP Server configuration to 192.168.1.g2.

Now you should be able to ping from corpclient1 to vmguest1 and vice versa, TS, etc.