Back to All Scenarios
PASSEDvendor / hyperv_vswitch_misconfig
Virtual Switch Misconfiguration — VMs Lose Network
An administrator changes the Hyper-V virtual switch binding from the production NIC team to a single disconnected NIC. All 25 VMs on that virtual switch lose network connectivity instantly. The admin is locked out of remote management.
Pattern
HYPERV_EVENT
Severity
CRITICAL
Confidence
95%
Remediation
Remote Hands
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | HYPERV_EVENT | HYPERV_EVENT | |
| Severity Assessment | CRITICAL | CRITICAL | |
| Incident Correlation | Yes | 36 linked | |
| Cascade Escalation | Yes | Yes | |
| Remediation | — | Remote Hands — Corax contacts on-site support via call, email, or API |
Scenario Conditions
Hyper-V Server 2022. External virtual switch 'Prod-vSwitch' bound to NIC team. Admin rebinds to disconnected NIC via PowerShell. 25 production VMs on the switch. No out-of-band management configured.
Injected Error Messages (3)
Hyper-V virtual switch misconfiguration — Prod-vSwitch rebound to disconnected NIC 'Ethernet 3' (media disconnected), Set-VMSwitch cmdlet completed but physical adapter has no link, all VM network adapters on Prod-vSwitch reporting 'Degraded' status
Domain Controller DC-02 unreachable — Hyper-V virtual switch failure, LDAP/DNS services inaccessible, AD replication partner timeout, Kerberos authentication failing for domain clients on this subnet
Application server network lost — Hyper-V vSwitch binding change caused complete network isolation, 25 VMs on Prod-vSwitch have no connectivity, VM network adapter status: 'No cable connected'
Neural Engine Root Cause Analysis
The Hyper-V virtual switch 'Prod-vSwitch' has been misconfigured and is bound to a physical network adapter 'Ethernet 3' that has no network connectivity (media disconnected). This binding failure causes the virtual switch to lose its uplink to the physical network, resulting in all VM network adapters connected to this vSwitch entering a degraded state. The presence of 14 correlated incidents suggests this is affecting multiple VMs or services that depend on this virtual switch for network connectivity.
Remediation Plan
1. Identify available physical network adapters with active links using Get-NetAdapter. 2. Unbind the current failed adapter from Prod-vSwitch using Set-VMSwitch. 3. Rebind Prod-vSwitch to a functional physical adapter with confirmed link status. 4. Verify VM network adapter status returns to 'Ok' state. 5. Test network connectivity from affected VMs. 6. Monitor for resolution of correlated incidents.
Tested: 2026-03-30Monitors: 3 | Incidents: 3Test ID: cmncjhtqa01mvobqe8ozruduu