Hyper-V virtual machine fails to start after moving the VHD files

Recently I had to replace a hard drive in one of my servers running Microsoft Hyper-V 2008 R2 which contained the virtual machine configuration and VHD files. I used robocopy to copy the data from the server drive, to a temporary drive, then replaced the drive before copying the data on to it.

Unfortunately, I forgot to copy the ACL’s as well, which caused issues when trying to start the virtual machines again. I use System Center Virtual Machine Manager, so when I tried to start my virtual machines again, I got the following error logged in the Jobs log: -

Error (12700)
VMM cannot complete the Hyper-V operation on the server.domain server because of the error: ‘Unnamed VM’ could not initialize. (Virtual machine ID 598AFA1B-1726-44B7-8435-E00B2ACAF2B5)

‘Unnamed VM’ could not read or update the virtual machine configuration because access was denied: General access denied error (0×80070005). Check the security settings on the folder in which the virtual machine is stored. (Virtual machine ID 598AFA1B-1726-44B7-8435-E00B2ACAF2B5)
 (Unknown error (0×8001))

Recommended Action
Resolve the issue in Hyper-V and then try the operation again.

In Hyper-V Manager, the following error is displayed when trying to start the same machine: -

‘SERVER’ failed to start.

Microsoft Emulated IDE Controller (Instance ID {598AFA1B-1726-44B7-8435-E00B2ACAF2B5}): Failed to Power on with Error ‘General access denied error’

IDE/ATAPI Account does not have sufficient privilege to open attachment ‘D:\Virtual Server\Virtual Machines\server\system.vhd’. Error: ‘General access denied error’

 Account does not have sufficient privilege to open attachment ‘D:\Virtual Server\Virtual Machines\server\system.vhd’. Error: ‘General access denied error’

[Expanded Information]
‘SERVER’ failed to start. (Virtual machine ID 598AFA1B-1726-44B7-8435-E00B2ACAF2B5)

‘SERVER’ Microsoft Emulated IDE Controller (Instance ID {598AFA1B-1726-44B7-8435-E00B2ACAF2B5}): Failed to Power on with Error ‘General access denied error’ (0×80070005). (Virtual machine ID 598AFA1B-1726-44B7-8435-E00B2ACAF2B5)

‘SERVER’: IDE/ATAPI Account does not have sufficient privilege to open attachment ‘D:\Virtual Server\Virtual Machines\server\system.vhd’. Error: ‘General access denied error’ (0×80070005). (Virtual machine ID 598AFA1B-1726-44B7-8435-E00B2ACAF2B5)

‘SERVER’:  Account does not have sufficient privilege to open attachment ‘D:\Virtual Server\Virtual Machines\server\system.vhd’. Error: ‘General access denied error’ (0×80070005). (Virtual machine ID 598AFA1B-1726-44B7-8435-E00B2ACAF2B5)

The issue is of course, that because the ACL’s weren’t preserved, Hyper-V can’t read the virtual machine files. Unfortunately, it’s not as simple as just adding the SYSTEM account to the root and applying permissions down, as Hyper-V R2 has it’s own security “namespace” (referred to in Microsoft documentation as the Service SID) called “NT VIRTUAL MACHINE” which contains the GUID’s for all registered virtual machines.

The easiest way to add permissions back to your virtual machines, in order to have them accessible via Hyper-V, is to use the following process on each machine (this is assuming you’re using System Center Virtual Machine Manager): -

  • Open the directory that stores your virtual machine
  • Open the “Virtual Machines” subdirectory under your virtual machine directory
  • Record the GUID as per the file name of the .xml file in this directory
  • Run icacls “<virtualmachinefolder>” /grant “NT VIRTUAL MACHINE\<virtualmachineguid>”:F /T (for example icacls “D:\Virtual Server\Virtual Machines\Server” /grant “NT VIRTUAL MACHINE\598AFA1B-1726-44B7-8435-E00B2ACAF2B5″:F /T

Now you should be able to start your virtual machine.

32 Responses to “Hyper-V virtual machine fails to start after moving the VHD files”

  1. Bert De Ridder says:

    Great post!! Thx for this!

    Bert

  2. jojo says:

    This Post is exactly my Problem… but i have a German Version installed and procedure comes up with the Error that the Account was not found…. i think it is talking about the NT Virtual Machines account. Where can i find the german name? What about a solution without System Center ?

    Thanks for the post anyway… now i am on the right road.

    Best Regards

    jojo

  3. Mat Mirabito says:

    Hi jojo,

    I recommend reading this article, which will help you identify the correct account name for your virtual machine – http://www.virtualizationteam.com/microsoft/hyper-v/hyper-v-a-new-breed-of-sid.html

  4. Brad Baker says:

    You sir are awesome! I thought for sure we had lost one of our virtual machines and the fix above worked. Thank you so much.

  5. Mat Mirabito says:

    :) Excellent!

  6. Richard says:

    Awesome! Thank you. I wanted to add that if you have multiple vhd files in the same folder, you need to sort out with GUID you need to use, from the Virtual Machines folder, and specify the vhd file to apply it to.

  7. NLS says:

    THANKS Mat! You… almost solved my problem.
    Made the exact same mistake with two VMs. Unfortunately the first was made with SCVMM so all files where indeed in the same place, but the second was created by Hyper-V console. I had to manually do the same process on each file/folder/vhd/avhd to make that second machine start.

    Unfortunately I crashed on a second problem. Although my VM starts, the second VHD shows as unformatted. Probably some file corruption while copying the disks back (“copying back” if I am lucky – “copying” if I am not).

    Thanks anyway, you helped me greatly.

  8. MDrysea says:

    Excellent. This little gem will save me hours in the future. Thank you for posting the tip!

  9. Mat Mirabito says:

    Thanks NLS and MDrysea for your comments.

  10. John says:

    I found that Hyper-V Manager will add the correct GUID by detaching and reattaching the VHD to the proper VM.

    Thanks

  11. Brian says:

    Thanks John. That worked a lot easier by just detaching and reattaching.

  12. I have some problem too and I created a tool to fix this issue. The tool is called Hyper-V Unnamed VM Fix and is available FREE at http://ctxadmtools.musumeci.com.ar/HyperVHotFixes

    Guillermo Musumeci
    CtxAdmTools

  13. Rob Burke says:

    Thanks for saving my backside. I tried using Guillermo’s tool, and after using it still had to perform the icacls step. Relieved to have my VMs back after robocopying them to a larger drive!

  14. Wayne M says:

    I found another thread with this problem but it had a different (and quicker) solution: on the folder containing the VM(s) go to Properties/Security and add “Network Service” with Full Control. Then push the permissions down to all child objects.

    This worked for me and now SCVMM can run the VMs.

  15. colin says:

    Using icacls to set the permissions worked a treat. The only difference is that I had to do it for each file that represents a virtual machine because I use Hyper-V manager and the VHDs are stored in a different place from the XML file. Anyway that’s only a minor difference.

    Thanks again
    Colin Bruce

  16. Lee says:

    Wayne M’s fix worked for me. I just added “Network Service” with full control and bam, it worked after an hour of frustration.

  17. matt says:

    worked a treat, after expanding a drive it dropped the security for some reason

  18. Reinier says:

    Works like a charm, Thank you very much!
    was scared i totally ruined the server!

  19. roy chartier says:

    I tried both the command line and the util, neither worked for me after a power failure.
    Any suggestions?

  20. Daniel Zorab says:

    Good tutorial for a quick fix. Worked 100%.
    Thank you.

  21. EBE says:

    Thank you Guillermo Musumeci says !
    Your tool worked like a charme, many dozen of VMs fixed with your tool.
    THANKS !

  22. EBE says:

    But indeed VHD need to be removed then added again.. but still thx for the tool..

  23. Maxtonso says:

    Thanks for the fix. In my case, I’ve had a little problem. I am using an spanish version of the operating system, so when i tried to use the icacls fix, nothing happened.
    It was because of the name of the “security namespace”: in english is called “NT VIRTUAL MACHINE”, but in spanish is called “MÁQUINA VIRTUAL NT”.
    You can see this name if you have a working virtual machine and run icacls virtual_machine_name.vhd. I get this:
    C:\ClusterStorage\Volume1\server01\Virtual Hard Disks>icacls srv01.vhd
    srv01.vhd MÁQUINA VIRTUAL NT\DBDBAB1F-69D7-45DD-AC8A-9933CD2AD806:
    (F)
    MÁQUINA VIRTUAL NT\DBDBAB1F-69D7-45DD-AC8A-9933CD2AD806:
    (R,W)
    NT AUTHORITY\SYSTEM:(F)
    BUILTIN\Administradores:(I)(F)
    NT AUTHORITY\SYSTEM:(I)(F)
    BUILTIN\Usuarios:(I)(RX)
    Se procesaron correctamente 1 archivos; error al procesar 0 archivos

    So in my case, the correct sintax of icacls would be:
    icacls “C:\ClusterStorage\Volume1\server01\Virtual Hard Disks\srv01.vhd” /grant “MÁQUINA VIRTUAL NT\DBDBAB1F-69D7-45DD-AC8A-9933CD2AD806″:(F)

    Hope this can help someone.

  24. KS says:

    Thanks a lot for the tip with the NETWORK SERVICE!

  25. SMaximus says:

    Go to the Folder/Share where you have the Virtual Machine. Add “Authenticated Users” with read rights.

  26. Arvid says:

    Thank you so much for this… You saved my life :)
    I thought my VMs were lost forever

  27. Charles says:

    Thanks! Saved me a headache!..

  28. Micah says:

    I am running Hyper-V on a Server 2012 machine. When I try to run this command, I get an error message: Invalid parameter \\NT\. Any idea why and/or how to do this on a 2012? Thanks.

  29. ASB says:

    Micah, be sure to use quotes with the iCACLS command.

    Example: icacls MYVHD.VHD* /grant “NT VIRTUAL MACHINE\ZZ9ZZ547-Z4ZZ-4ZZ5-Z16Z-4ZZ7Z527746Z:(R,W)”

  30. Michael says:

    Or, you can Export your Hyper-V VM to another folder and re-import it. Permissions will get reset that way too.

  31. Krunal says:

    Really Great post. Thanks

Leave a Reply