Explanation:
hvc.exe, ssh User2@VM2
The requirement is to use a direct SSH session to manage all the supported virtual machines on HyperV1, without relying on a network path to the guest. Hyper-V provides hvc.exe, a helper used as an SSH ProxyCommand, that opens an SSH session to a virtual machine over the VMBus (the internal Hyper-V socket
/console channel) rather than over the network, which works even when the guest has no reachable IP configuration and only default management tools installed, matching the stated environment. Direct SSH management this way requires the guest to run an SSH server; of the three VMs, only VM2 runs Red Hat Enterprise Linux, which includes OpenSSH server support out of the box, so it is the only VM realistically " supported " for this direct SSH scenario as described, and the account to use is User2, the local account that exists on VM2. VM1 and VM3 both run Windows Server, so " direct SSH, " as intended by this requirement, targets the Linux guest. Connect-PSSession and Connect-WSMan are PowerShell remoting tools, not SSH, and mstsc.exe launches a graphical Remote Desktop session rather than a console-mode SSH session, so none of those alternatives fit. The correct combination is hvc.exe used as the SSH proxy, connecting as User2@VM2.

When a VM is exported from one Hyper-V host and imported on another using Hyper-V Manager, attributes stored inside the virtual machine ' s own configuration and virtual hard disk are preserved automatically: the VM ' s configuration version, its generation (which cannot be changed after creation), and any statically assigned IP address configured inside the guest operating system all carry over. The virtual network connection is not preserved because it depends on a virtual switch that must exist by the same name on the destination host; Server2 is not guaranteed to have a virtual switch named VNet1, so the imported VM ' s network adapter must be manually reconnected to an appropriate virtual switch after import. Because Server2 runs a newer Windows Server 2025 Hyper-V version, the imported VM also keeps running at its original configuration version 8.0 until an administrator explicitly upgrades the configuration version, which is a separate, optional step performed after a successful import.

This is a classic Kerberos double-hop scenario, but with a critical twist: User1 is a member of the Protected Users security group, and Microsoft ' s documentation on the Protected Users group explicitly states that members are unable to " delegate with unconstrained or constrained delegation, " and separately that Credential Delegation (CredSSP) " doesn ' t cache the user ' s plain text credentials even when the user enables the Allow delegating default credentials Group Policy setting. " This means neither unconstrained Kerberos delegation nor CredSSP can be used to solve the double-hop for User1 ' s own credentials -- both are explicitly blocked by Protected Users membership by design, and resource-based constrained delegation relies on the same underlying Kerberos S4U ticket-delegation mechanism for the user ' s identity, which Protected Users membership likewise prevents from being used. The solution that sidesteps the problem entirely, rather than attempting to delegate User1 ' s own (undelegatable) credentials, is to configure a PowerShell session configuration (as used in Just Enough Administration) on Server2 with a fixed RunAs credential: commands run inside that session configuration execute using the RunAs account ' s identity when reaching out to Backup1, rather than using User1 ' s identity for the second hop at all, so no delegation of User1 ' s own protected credentials is ever needed. This also satisfies least privilege and minimal administrative effort, since a single, purpose-built session configuration can be scoped to exactly the actions User1 needs, without provisioning any delegation for User1 individually. Therefore, configuring a PSSessionConfiguration that uses RunAs is the correct solution.

Explanation:
User1 can read the files in Share1: Yes. User3 can delete files in Share1: No. If User2 connects to \\Server1.
adatum.com from File Explorer, Share1 will be listed: Yes.
When a folder is accessed across the network through its share, the effective permission is always the more restrictive of the NTFS permission and the share permission evaluated together. User1 belongs to Group1, which has NTFS Read and share-level Change; the combined effective permission is Read, so User1 can indeed read the files in Share1. User3 belongs to Group3, which has no NTFS permission entry at all on D:
\Folder1 (only Administrators, Group1, and Group2 appear in the NTFS ACL, with no inheritance from a parent granting Group3 access), even though Group3 holds Full Control at the share level; because NTFS grants nothing to Group3, the combined effective permission is no access whatsoever, so User3 cannot delete, read, or otherwise touch the files, regardless of the generous share permission. The third statement concerns Access-Based Enumeration (ABE), which Windows exposes on a share through its folder enumeration mode:
Share1 ' s FolderEnumerationMode is set to Unrestricted, meaning ABE is disabled for this share. With ABE disabled, every share is listed to every user browsing \\Server1.adatum.com regardless of that user ' s actual access rights, so Share1 will appear in the listing when User2 (Group2, which has no share permission entry and effectively no access to the share ' s contents at all) browses to the server, even though User2 could not open the share ' s contents once inside. ABE only hides shares from users with zero effective access when it is explicitly enabled (AccessBased mode), which is not the case here.

When upgrading a Remote Desktop Services deployment, Microsoft ' s documented order is to upgrade the RD Connection Broker server or servers first, because the Connection Broker holds the deployment configuration and every other role server depends on it; RD License servers and RD Session Host servers follow, with RD Web Access, RD Virtualization Host, and RD Gateway able to be upgraded afterward. In the table, Server3 hosts the RD Connection Broker role, so it must be the first server upgraded to Windows Server
2025 before the rest of the deployment is upgraded. Upgrading a dependent role server first, such as a Session Host or Web Access server, risks a version mismatch against a still-outdated Connection Broker and can break the deployment ' s ability to broker new sessions, which is why Microsoft ' s guidance treats the Connection Broker ' s own upgrade as the mandatory starting point for any RDS deployment upgrade regardless of how many other role servers are involved.