While attempting to use "Migrate" in Virtual Machine Manager 2008 R2 to move Server1 from VMHost1 to VMHost2,
the job failed witht the following error:
VMM cannot complete the Hyper-V operation on the VMHost1.mydomain.local server because of the error:
'Server1' could not initiate a snapshot operation. (Virtual machine ID 4E42A1EB-27B8-34B1-A182-F00BA2330E92)
'Server1' could not create auto virtual hard disk D:\VHDs\Vol2\Server1-Disk2_A64B71D5-4A2A-32D0-8322-BBC223A3D0CD.avhd:
General access denied error (0x80070005). (Virtual machine ID 4E42A1EB-27B8-34B1-A182-F00BA2330E92)
(Unknown error (0x8001))
On this server, I had a 1TB volume mounted on the folder "D:\VHDs\Vol2". The permissions were
correct on the "symbolic folder" (junction point), but the root of the 1TB volume did NOT have the
correct permissions for the special "Virtual Machines" group.
A quick search turned up an
indicating that a mounted volume does not have the correct permissions for the special "Virtual Machines"
group on the root of the mounted volume.
I wasted almost 2 hours getting the special "Virtual Machines" group added to the ACL! Hopefully
this information will save someone a bunch of time.
- Run icacls command from Command Prompt window:
icacls D:\VHDs\Vol2 /grant "NT VIRTUAL MACHINE\Virtual Machines":F /T
Note the "/T" switch to perform the operation on all files/sub-directories in the tree.
Why in the world would Microsoft NOT allow me to add the group "Virtual Machines" (or "NT VIRTUAL
MACHINE\Virtual Machines") through the normal "Right-click > Properties > Mounted Volume > Properties >
Security" tab is beyond me. What a frustrating waste of time!
Note: for those familiar with the old cacls command using the switch "/M" (which targets the mounted
volume), be aware that although the icacls does NOT have a switch to target the mounted volume, the icacls
command in fact DOES work on the mounted volume WITHOUT a switch (more wasted time).