What you need to know
Which authentication configuration should be reviewed for nonclustered Hyper-V live migration?
Potentially affected
Administrators configuring live migration between nonclustered Hyper-V hosts.
DSE recommendation
Have the virtualization and directory owners review the required services and destination hosts before configuring delegation.
Source facts
Microsoft’s nonclustered live-migration procedure requires choosing how the source and destination authenticate migration traffic; the choice affects whether the operator must sign in to the source first. The source states that the Windows Server 2025 Credential Guard default on domain-member servers prevents the prior CredSSP-based migration approach and directs administrators toward Kerberos constrained delegation. Its Kerberos setup procedure uses an account with Domain Administrators membership. Microsoft documentation.
Applicability
Check both host releases, domain roles, authentication settings, management location, and whether storage will move. Review the source’s exact delegation requirements for the selected migration path.
DSE recommendation
Have the virtualization and directory owners review the required services and destination hosts before configuring delegation. Document the intended operator entry point and the authorization used for the setup. Keep the change limited to the approved migration relationship and preserve the previous host configuration.
Verification
Initiate a controlled migration from the intended management location and inspect the source and destination results. Include the required storage-movement case if applicable. Record authentication failures separately from network or storage failures, and reconcile them before relying on the upgraded hosts for planned moves.
Official references
Microsoft Learn: Set up hosts for live migration without Failover Clustering. Source reviewed September 8, 2026.
Review the official source
Set up hosts for live migration without Failover Clustering · Verified September 8, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE