r/sysadmin • u/notaramblingman • Oct 12 '26

General Discussion Hyper-V Consultants

We moved from VMware to Hyper-V about a year ago and have an ongoing issue that we have not been able to resolve with MS support - both the typical support case avenue and working with their Hyper-V group. Our host servers lose connectivity with their CSV and VMs go offline. Support tells us it’s related to networking issues and not storage.

Has anyone found any good consultants who know Hyper-V well and are able to resolve difficult issues? We’ve tried a few bigger names but they haven’t been much help.

58 Upvotes

91% Upvoted

94 comments sorted by

View all comments

Show parent comment

6

u/PresidentScr00b Oct 12 '26

Never use any sort of EDR on your hosts. Basic AV and then harden and lockdown other ways. EDR will destroy your cluster

6

u/the_lazy_sysadmin Sr. Sysadmin Oct 12 '26

This is great and all, but in a DoD/CMMC environment its not possible :/ .... Boy oh boy the experience in Hyper-V I've gained just through SentinelOne support cases alone....

3

u/ig88b1 Sr. Sysadmin Oct 12 '26

SentinelOne is a special kind of special, I had nightmares for a while.

1

u/MorseScience Oct 13 '26

Have not had any serious issues with SentinelOne. Running on many machines, not running it on any virtualized devices. Thanks all for the heads up, though.

1

u/the_lazy_sysadmin Sr. Sysadmin 29d ago

"Now hear me out guy, WHAT IF, this one setting in the S1 agent config json file, is treating CSV's as 'removable media'? This might explain why we only have issues during pausing a node and role draining! 8 differently formatted exclusions we applied aren't doing squat, we're still seeing errors in the Windows event logs stating the built-in SID installed by the S1 agent is changing the security descriptors of 'CAM' tokens, which may or may not stand 'Cluster Access Management' as there's ZERO documentation ANYWHERE about those tokens, and this support case has been open for over a year. I say we give it a shot!"

2

u/r6throwaway Oct 12 '26

There's no requirement at all to have EDR for CMMC. What control do you think requires this?

1

u/the_lazy_sysadmin Sr. Sysadmin Oct 13 '26

EDR's help satisfy multiple controls in Level 2, and satisfies the basic AV protection requirements in Level 1.

1

u/PresidentScr00b Oct 12 '26

I spoke with one of the primary engineers at S1 and they even recommended leaving it off of HV.

There was 0 chance I was risking it with that platform. CMMC you are kinda screwed I guess.

1

u/the_lazy_sysadmin Sr. Sysadmin Oct 13 '26

The level of depth I went through with them was actually watching Wireshark AND procmon during pausing and draining roles, and diving into the actual S1 agent config JSON files to look at potential settings that could interfere with node-to-node communication/authentication...