Azure Migrate
A central hub of Azure cloud migration services and tools to discover, assess, and migrate workloads to the cloud.
Azure Migrate Appliance - Unable to Validate HyperV Cluster - WinRM error
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 14.000000000000002%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
Dale
5
Reputation points
I am running into an error where the Azure Migration appliance will not validate a HyperV cluster with 2 servers.
Worked through: https://learn.microsoft.com/en-us/azure/migrate/tutorial-discover-hyper-v
- Ran the Hyper-V prep script "MicrosoftAzureMigrate-Hyper-V.ps1" as described in the documentation, finished without errors.
- Created the project and generated keys
- Downloaded the VHD and set up the appliance
- Connected to the web interface
- Followed all the Setup Prerequisites by running the script on both hosts, all finished successfully.
- Registered the appliance successfully - was able to confirm in Azure Portal and see the appliance
- Set up domain admin credentials in the domain\username format with password
- Added the cluster as a discovery source
- Validation fails with error "Server '[ClusterName]' WinRM cannot complete the operation - Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows Access from this computer"
- Modified firewall of each cluster host server to ensure WinRM was allowed from public
- Tried pointing to an individual server, appliance detected cluster and changed to the cluster automatically.
- Re-Validation same failure
- Tried "enforce SSL" same failure.
- Verified the time on the migration appliance, time and time zone are correct
- Ran the "#Needs client/Appliance side settings change" from the "MicrosoftAzureMigrate-Hyper-V.ps1" script, validation still failed.
Screenshot of the error:
Additional troubleshooting performed:
From the Hyper-V host servers (both):
- Verified time was correct
- Verified they are on the domain
- Verified they are using a supported OS (Server 2016)
- Verified we can log in using the same username and password as was being used by the appliance
- Ran “winrm quickconfig” finished out saying it was already installed.
From the migration appliance:
- Enter-PSSession -ComputerName "[cluster address]" -Credential $Creds
- Same credentials as is being used on the appliance
- Able to access Cluster with same creds used by appliance from the appliance.
- Test-wsman -computerName "[Host1]" -Credential $creds -Authentication Default
- Same credentials as is being used on the appliance
- Get a positive response
- Test-wsman -computerName "[Host2]" -Credential $creds -Authentication Default
- Same credentials as is being used on the appliance
- Get a positive response
- Test-wsman -computerName "[cluster]" -Credential $creds -Authentication Default
- Same credentials as is being used on the appliance
- Get a positive response
- Get-Item WSMan:\localhost\Client\TrustedHosts
- Returns "*", so all should be good.
- Dug through Event logs with nothing really standing out.
After looking through the communities and Google, I am not finding a lot on this error. Any help would be appreciated.
Azure Migrate
{count} vote
-
Sam Erde 151 Reputation points MVP2025-11-12T14:46:25.41+00:00 You tested everything I would have. Let me know what the resolution turns out to be!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 6%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Siva shunmugam Nadessin 3,025 Reputation points Microsoft External Staff Moderator2025-11-12T15:19:41.5633333+00:00 Hello Dale,
Kindly share the screenshot of the error you are facing for us to investigate further?
-
Dale 5 Reputation points
2025-11-12T15:27:27.9533333+00:00 Screenshot attached.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 68%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBY%3C/text%3E%3C/svg%3E)
Bharath Y P 2,560 Reputation points Microsoft External Staff Moderator2025-11-12T21:00:57.4966667+00:00 Hello Dale, Thanks for the update,
- when you added the cluster as a discovery source, did you enter the full FQDN (e.g.,
ClusterName.domain.local) or just the short NetBIOS name? This matters because Kerberos and WinRM validation often fail if the SPN doesn’t match the exact name used. If it’s the short name, switching to FQDN usually resolves the issue. - Make listeners accept traffic arriving via the cluster IP and open the firewall for the active profile.
Binding to Address=* avoids failures when requests hit the node via the cluster VIP.# Run elevated on each node Enable-PSRemoting -Force # Verify listeners are present and bound broadly winrm e winrm/config/listener - Check the SPN for the cluster FQDN; add port‑scoped SPNs to each node if needed.
- The certificate CN/SAN must equal the exact FQDN used by the appliance (cluster FQDN).
https://learn.microsoft.com/en-us/azure/migrate/how-to-set-up-appliance-hyper-v?view=migrate
If still encounter an issue, please let us know, thanks
- when you added the cluster as a discovery source, did you enter the full FQDN (e.g.,
-
Dale 5 Reputation points
2025-11-12T22:47:12.39+00:00 Bharath thanks for the reply!
- FQDN - When the cluster was added the FQDN was used, not the NetbiosName.
- Accepted traffic - In the troubleshooting performed, "Enter-PSSession" was accessed via the IP and the FQDN of the cluster, both which worked when starting from the desktop of the appliance. I am unable to check right now, but would that mean that the listener is configured to allow connections from a broad address like *?
- I will check the SPNs and Certificate CN/SAN. If the port scoped SPNs are added, are there any ports other then 5985 and 5896 that should be added?
- The article shared appears to be substantially similar to the one linked in the original post with no additional information on the error. Is there something I am missing in the article?
Thanks again for helping to get to the bottom of this!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 97%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Suchitra Suregaunkar 3,545 Reputation points Microsoft External Staff Moderator2025-11-18T07:29:56.34+00:00 Hello Dale,
- A successful
Enter‑PSSessionmeans WinRM is reachable, but it doesn’t guarantee the listener is bound toAddress=*. To be sure, runwinrm e winrm/config/listeneron every node and check thatAddressis set to*. If not, recreate it so it accepts traffic via the cluster IP. - Azure Migrate uses WinRM only, so the relevant ports are:
- 5985 (HTTP)
- 5986 (HTTPS)
- Proxy and short names: Even if you added the cluster by FQDN, the appliance may still try short node names internally. If a proxy is configured, add those short names to the bypass list or map them in
hosts.
SSL enforcement: If you enable “Enforce SSL,” the certificate CN/SAN on each node’s WinRM HTTPS listener must match the exact cluster FQDN you entered in the appliance. A mismatch will fail validation even if HTTP works.
The appliance validates the cluster name but connects to individual nodes. If the listener binding or SPN doesn’t match the name used, Kerberos fails silently and you see the WinRM error.
If you have any other questions or need further support, please feel free to contact us.
Thanks,
Suchitra.
- A successful
-
Suchitra Suregaunkar 3,545 Reputation points Microsoft External Staff Moderator
2025-11-19T07:05:45.2466667+00:00 Hello Dale,
Could you please let us know if the solution shared in the comment addressed your query. If you have any other questions or need further support, please feel free to contact us.
Thanks,
Suchitra.
Sign in to comment
Sign in to answer