{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
        "slug": "dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade",
        "url": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/"
        },
        "title": "Review the live-migration authentication path after a Windows Server upgrade",
        "summary": "Which authentication configuration should be reviewed for nonclustered Hyper-V live migration?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "identity-cloud",
            "label": "Identity & cloud",
            "alt": "Governed cloud identity system with connected service and lifecycle nodes.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-08T18:14:30+00:00",
        "modified_at": "2026-09-08T18:26:31+00:00",
        "reviewed_on": "2026-09-08",
        "reading_minutes": 1,
        "word_count": 204,
        "potentially_affected": "Administrators configuring live migration between nonclustered Hyper-V hosts.",
        "dse_recommendation": "Have the virtualization and directory owners review the required services and destination hosts before configuring delegation.",
        "primary_source": {
            "name": "Set up hosts for live migration without Failover Clustering",
            "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/Set-up-hosts-for-live-migration-without-Failover-Clustering",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft’s nonclustered live-migration procedure requires choosing how the source and destination authenticate migration traffic; the choice affects whether the operator must sign in to the source first. The source states that the Windows Server 2025 Credential Guard default on domain-member servers prevents the prior CredSSP-based migration approach and directs administrators toward Kerberos constrained delegation. Its Kerberos setup procedure uses an account with Domain Administrators membership. <a href=\"https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/Set-up-hosts-for-live-migration-without-Failover-Clustering\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft documentation</a>.</p>\n<h2>Applicability</h2>\n<p>Check both host releases, domain roles, authentication settings, management location, and whether storage will move. Review the source’s exact delegation requirements for the selected migration path.</p>\n<h2>DSE recommendation</h2>\n<p>Have the virtualization and directory owners review the required services and destination hosts before configuring delegation. Document the intended operator entry point and the authorization used for the setup. Keep the change limited to the approved migration relationship and preserve the previous host configuration.</p>\n<h2>Verification</h2>\n<p>Initiate a controlled migration from the intended management location and inspect the source and destination results. Include the required storage-movement case if applicable. Record authentication failures separately from network or storage failures, and reconcile them before relying on the upgraded hosts for planned moves.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/Set-up-hosts-for-live-migration-without-Failover-Clustering\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Set up hosts for live migration without Failover Clustering</a>. Source reviewed September 8, 2026.</p>",
        "content_text": "Source facts\nMicrosoft’s nonclustered live-migration procedure requires choosing how the source and destination authenticate migration traffic; the choice affects whether the operator must sign in to the source first. The source states that the Windows Server 2025 Credential Guard default on domain-member servers prevents the prior CredSSP-based migration approach and directs administrators toward Kerberos constrained delegation. Its Kerberos setup procedure uses an account with Domain Administrators membership. Microsoft documentation.\nApplicability\nCheck both host releases, domain roles, authentication settings, management location, and whether storage will move. Review the source’s exact delegation requirements for the selected migration path.\nDSE recommendation\nHave the virtualization and directory owners review the required services and destination hosts before configuring delegation. Document the intended operator entry point and the authorization used for the setup. Keep the change limited to the approved migration relationship and preserve the previous host configuration.\nVerification\nInitiate a controlled migration from the intended management location and inspect the source and destination results. Include the required storage-movement case if applicable. Record authentication failures separately from network or storage failures, and reconcile them before relying on the upgraded hosts for planned moves.\nOfficial references\nMicrosoft Learn: Set up hosts for live migration without Failover Clustering. Source reviewed September 8, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft’s nonclustered live-migration procedure requires choosing how the source and destination authenticate migration traffic; the choice affects whether the operator must sign in to the source first. The source states that the Windows Server 2025 Credential Guard default on domain-member servers prevents the prior CredSSP-based migration approach and directs administrators toward Kerberos constrained delegation. Its Kerberos setup procedure uses an account with Domain Administrators membership. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/Set-up-hosts-for-live-migration-without-Failover-Clustering).\n\n## Applicability\n\nCheck both host releases, domain roles, authentication settings, management location, and whether storage will move. Review the source’s exact delegation requirements for the selected migration path.\n\n## DSE recommendation\n\nHave the virtualization and directory owners review the required services and destination hosts before configuring delegation. Document the intended operator entry point and the authorization used for the setup. Keep the change limited to the approved migration relationship and preserve the previous host configuration.\n\n## Verification\n\nInitiate a controlled migration from the intended management location and inspect the source and destination results. Include the required storage-movement case if applicable. Record authentication failures separately from network or storage failures, and reconcile them before relying on the upgraded hosts for planned moves.\n\n## Official references\n\n[Microsoft Learn: Set up hosts for live migration without Failover Clustering](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/Set-up-hosts-for-live-migration-without-Failover-Clustering). Source reviewed September 8, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-08"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Review the live-migration authentication path after a Windows Server upgrade",
                        "item": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/",
                "headline": "Review the live-migration authentication path after a Windows Server upgrade",
                "description": "Which authentication configuration should be reviewed for nonclustered Hyper-V live migration?",
                "abstract": "Which authentication configuration should be reviewed for nonclustered Hyper-V live migration?",
                "articleBody": "Source facts\nMicrosoft’s nonclustered live-migration procedure requires choosing how the source and destination authenticate migration traffic; the choice affects whether the operator must sign in to the source first. The source states that the Windows Server 2025 Credential Guard default on domain-member servers prevents the prior CredSSP-based migration approach and directs administrators toward Kerberos constrained delegation. Its Kerberos setup procedure uses an account with Domain Administrators membership. Microsoft documentation.\nApplicability\nCheck both host releases, domain roles, authentication settings, management location, and whether storage will move. Review the source’s exact delegation requirements for the selected migration path.\nDSE recommendation\nHave the virtualization and directory owners review the required services and destination hosts before configuring delegation. Document the intended operator entry point and the authorization used for the setup. Keep the change limited to the approved migration relationship and preserve the previous host configuration.\nVerification\nInitiate a controlled migration from the intended management location and inspect the source and destination results. Include the required storage-movement case if applicable. Record authentication failures separately from network or storage failures, and reconcile them before relying on the upgraded hosts for planned moves.\nOfficial references\nMicrosoft Learn: Set up hosts for live migration without Failover Clustering. Source reviewed September 8, 2026.",
                "datePublished": "2026-09-08T18:14:30+00:00",
                "dateModified": "2026-09-08T18:26:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-161-review-the-live-migration-authentication-path-after-a-windows-server-upgrade/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Review the live-migration authentication path after a Windows Server upgrade"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 204,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Set up hosts for live migration without Failover Clustering",
                    "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/Set-up-hosts-for-live-migration-without-Failover-Clustering"
                }
            }
        ]
    }
}