No Admin permissions in VM

No Admin permissions in VM

Introduction

Accountable, Privileged and Advanced Members have 'Admin' permissions within a VM. These roles have administrator permission within a VM that allows them to install software and run software as administrator. In rare cases however, VMs can be deployed without the correct Admin permissions even though users have one of the above-mentioned roles assigned. When trying to run or open software as administrator, it will ask for a username and password. It will look something like this:



Note that this is normal if you have been assigned a role that is not Accountable, Privileged or Advanced Member.

When this happens, there are generally two options:
Idea
  1. Delete the VM and deploy a new VM. This is the fastest option if there is nothing important installed on the VM.
Info
  1. Add the MYDRE\[ACRONYM]-Admins group back to the VM.

Below we will describe how to perform the second option.

Steps to verify

  1. The first step is to check your role in the Workspace. Go to the Members tab. If you're not Accountable, Privileged or Advanced Member then this is working as intended. If you have one of the three roles described above, continue with the next steps.
  2. Check whether the [Acronym]-Admins group is indeed missing from the VM. Within the VM, find the magnifying glass on the bottom left and type lusrmgr.msc.

  1. Double click on Groups and then Administrators. Check whether MYDRE\[ACRONYM]-Admins is present in the list. There should be four groups in total. Replace [ACRONYM] with the acronym of your Workspace. For example, my Workspace is dws-1178-SMOKE. Therefore, the group MYDRE\SMOKE-Admins must be present. If not, you won't have Admin permissions in the VM. It will look like this (note the [ACRONYM]-Admins group is missing):


Steps to remediate

  1. Please contact the local Support Team through a ticket. Provide at least the following information:
    1. Name of the Workspace in dws-xxx-YYY format.
    2. Name of the affected VM in dwsxxxYYYserverz format.
    3. Role in the Workspace.
    4. Permission for the anDREa Support Team to turn on the VM and execute the script to re-add the Admins group.
For transparency, we will add the steps performed by the anDREa Support Team:
  1. Turn on the affected VM in the Azure Portal. You don't have to connect to the VM.
  2. On the left hand side, under the Operations menu, you can find Run command.

  1. Click on RunPowershellScript.

  1. In the text box type the following:
  1. Add-LocalGroupMember -Name "Administrators" -Member 'MYDRE\[ACRONYM]-Admins'
  2. Get-LocalGroupMember -Group "Administrators"
  1. Replace [ACRONYM] with the acronym of the Workspace. In the example, the acronym is SMOKE.
  2. The output verifies whether the group has been added properly.

  1. Turn off the VM.