Symptoms & Diagnosis
The Hyper-V error 0x80070005 on Windows Server 2022 is a classic “Access Denied” message. It typically triggers when the Virtual Machine Management Service (VMMS) lacks the necessary permissions to access virtual hard disk (VHDX) files or configuration folders.
Administrators often encounter this error when starting a virtual machine, creating a snapshot, or importing a VM from another host. The system logs will usually point to a failure in the security descriptor of the virtual machine’s resource files.
| Symptom | Error Code | Primary Cause |
|---|---|---|
| VM Fails to Start | 0x80070005 | Missing NTFS permissions on .vhdx files. |
| Snapshot Failure | 0x80070005 | Inadequate rights to the “Snapshots” folder. |
| Import VM Failure | 0x80070005 | Service SID mismatch during migration. |
Diagnostic steps involve checking the Event Viewer under “Applications and Services Logs > Microsoft > Windows > Hyper-V-VMMS”. Look for Event ID 12240 or 16300, which specifically mentions the file path causing the access violation.
Troubleshooting Guide
The most effective fix involves resetting the security descriptors for the Hyper-V virtual machine files. This ensures the “Virtual Machines” group has the required access.
Method 1: Grant Permissions via ICACLS
Open PowerShell as an Administrator. You need to grant the “NT VIRTUAL MACHINE\Virtual Machines” identity access to your VM directory. Replace the path with your actual VM storage location.
# Grant full control to the Hyper-V Virtual Machines group
icacls "D:\Hyper-V\Virtual Machines" /grant "NT VIRTUAL MACHINE\Virtual Machines":F /TMethod 2: Refreshing Service SID Permissions
Sometimes the specific SID of the virtual machine is not added to the VHDX file. You can manually re-trigger the permission inheritance by toggling the file security settings.
- Navigate to the folder containing the .vhdx files.
- Right-click the folder and select Properties.
- Go to the Security tab and click Advanced.
- Check the box “Replace all child object permission entries with inheritable permission entries from this object” and click Apply.
Method 3: Antivirus Exclusions
Third-party antivirus software or Windows Defender can sometimes lock Hyper-V files, leading to a 0x80070005 error. You must exclude the Hyper-V process and directory paths.
| Exclusion Type | Value to Exclude |
|---|---|
| Process | Vmms.exe and Vmwp.exe |
| File Extensions | .vhd, .vhdx, .avhdx, .vsv, .iso |
| Directories | Default Virtual Hard Disks and Config folders |
Prevention
To prevent error 0x80070005 in the future, avoid moving virtual machine files manually through File Explorer without using the Hyper-V Manager “Move” wizard. The wizard automatically updates the security descriptors.
Always ensure that the storage volume hosting your VMs is formatted with NTFS or ReFS. If you are using an SMB share for storage, ensure the Hyper-V host’s computer account has “Full Control” permissions on both the Share and NTFS levels.
Regularly audit your Group Policy Objects (GPO). Ensure that no policy is stripping away “Log on as a service” rights for the NT VIRTUAL MACHINE\Virtual Machines account, as this is a common cause for systemic 0x80070005 errors across the cluster.