I recently made a change to a VM that I wanted to roll back but I didn’t have a snapshot. So I turned the VM off, renamed the old vhd, and copied a recent backup from another machine. When I went to start the VM I was greeted with an access denied and the following event in the Hyper-V event log:
‘Win7Seqx86’: IDE/ATAPI Account does not have sufficient privilege to open attachment ‘H:\VM\Win7Seqx86\Win7Seqx86.vhd’. Error: ‘General access denied error’ (0x80070005). (Virtual machine ID ECA0BD63-76CE-4C5E-96AB-44F0D635CBB3)
Okay, so it’s a permissions issue. Poking around the permissions on the files revealed that a specific account with Read/Write permissions was missing:
NT VIRTUAL MACHINE\ECA0BD63-76CE-4C5E-96AB-44F0D635CBB3
Uhm, yeah. Using Windows Explorer I couldn’t get the name to resolve. The solution in this case is icacls.exe. (Cacls.exe is deprecated, icacls.exe is the successor). It should be in your system32 directory:
icacls Win7Seqx86.vhd /grant “nt virtual machine\ECA0BD63-76CE-4C5E-96AB-44F0D635CBB3:(r,w)”
Problem solved. The double-quotes are needed so it sees the entire account name as one string parameter.
Obviously the account name is a GUID so it is should be unique for each virtual machine. Copy if from the event log or use icacls to get the exact string:
NT VIRTUAL MACHINE\ECA0BD63-76CE-4C5E-96AB-44F0D635CBB3:(R,W)
Hyper-V uses per-VM accounts for security isolation, much like the Network Service account.