I have an "Access Denied" on certain files

Question

I have an "Access Denied" on certain files

Hakim Yusof 20

After my virtual machine was saved, I now have Access Denied errors on my .bin and .vsv files. How do I get the default permissions back?

Dina Tarek 5 Reputation points

2026-08-21T02:38:37.31+00:00
Hello @Hakim Yusof ,

I had the same issue once, and here is the steps i used to solve the issue,

Restore the ownership

**•** Right-click the .bin/.vsv files → Properties → Security → Advanced **•** Click “Change” next to Owner, set it to your account or Administrators, and check “Replace owner on subcontainers and objects”

Restore the permissions,

Hyper-V VMs need the special NT VIRTUAL MACHINE\Virtual Machines SID to have full control of their files, this is often what’s missing after a save/move. Run this in an elevated PowerShell/Command Prompt, pointing at the VM’s config folder: icacls "C:\path\to\VM\folder" /grant "NT VIRTUAL MACHINE\Virtual Machines":(OI)(CI)F /T

Check the VM’s Automatic Stop Action

If the “Access Denied” happened right after a save, sometimes the save didn’t fully release the files. Try:

**•** Shut the VM down completely (not just save) via Hyper-V Manager **•** If Hyper-V Manager itself throws Access Denied, restart the “Hyper-V Virtual Machine Management” service or reboot the host

Rule out antivirus/EDR

Security software sometimes locks or quarantines .bin/.vsv files, especially in managed Windows 365/Intune environments. Check quarantine logs or add an exclusion for the VM folder.

Finally, since this is tagged Windows 365 Enterprise, local Hyper-V fixes may not apply directly, if this is the Cloud PC’s own storage, a “Restore” or “Reprovision” from the Windows 365 admin portal (or user Settings app → Windows 365 → Reset) is usually faster than manually chasing permissions, since you don’t have host-level file access on a managed Cloud PC.

I hope it will solve your issue too. Please let me if i can help if there is anything.

PS: Dont forget to vote for yes to help the others if they have the same issue.

1 answer

Your answer

Dina Tarek 5 Reputation points

2026-08-21T02:38:37.31+00:00

Hello @Hakim Yusof ,

I had the same issue once, and here is the steps i used to solve the issue,

Restore the ownership

**•** Right-click the .bin/.vsv files → Properties → Security → Advanced **•** Click “Change” next to Owner, set it to your account or Administrators, and check “Replace owner on subcontainers and objects”

Restore the permissions,

Hyper-V VMs need the special NT VIRTUAL MACHINE\Virtual Machines SID to have full control of their files, this is often what’s missing after a save/move. Run this in an elevated PowerShell/Command Prompt, pointing at the VM’s config folder: icacls "C:\path\to\VM\folder" /grant "NT VIRTUAL MACHINE\Virtual Machines":(OI)(CI)F /T

Check the VM’s Automatic Stop Action

If the “Access Denied” happened right after a save, sometimes the save didn’t fully release the files. Try:

**•** Shut the VM down completely (not just save) via Hyper-V Manager **•** If Hyper-V Manager itself throws Access Denied, restart the “Hyper-V Virtual Machine Management” service or reboot the host

Rule out antivirus/EDR

Security software sometimes locks or quarantines .bin/.vsv files, especially in managed Windows 365/Intune environments. Check quarantine logs or add an exclusion for the VM folder.

Finally, since this is tagged Windows 365 Enterprise, local Hyper-V fixes may not apply directly, if this is the Cloud PC’s own storage, a “Restore” or “Reprovision” from the Windows 365 admin portal (or user Settings app → Windows 365 → Reset) is usually faster than manually chasing permissions, since you don’t have host-level file access on a managed Cloud PC.

I hope it will solve your issue too. Please let me if i can help if there is anything.

PS: Dont forget to vote for yes to help the others if they have the same issue.

Answer 1

Hello @Hakim Yusof

If the issue started after you saved/restored the VM, I would avoid resetting permissions on the .bin and .vsv files until you identify which Hyper-V component owns them.

Those extensions are associated with the saved state of a Hyper-V virtual machine on older Hyper-V versions. Access to the VM files isn't determined only by your administrator account; Hyper-V also relies on permissions granted to the VM's security identity.

First, check the existing ACLs rather than replacing them:

icacls "D:\VMs\<VM-folder>"

and specifically:

icacls "D:\VMs\<VM-folder>\*.bin"
icacls "D:\VMs\<VM-folder>\*.vsv"

If you copied the VM files, restored them from backup, or moved them manually, Hyper-V permissions may not have been preserved.

Microsoft documents that Hyper-V virtual machines have a unique VM ID and that the VM's virtual account may require access to its files. The identity follows this format:

NT VIRTUAL MACHINE<VM-GUID>

You can obtain the VM ID with PowerShell:

Get-VM -Name "<VMName>" | Select-Object Name, VMId

If you determine that the VM identity is missing from the affected files/folder, the permission can be restored with icacls, for example:

icacls "D:\VMs\<VM-folder>" /grant "NT VIRTUAL MACHINE\<VM-GUID>":(OI)(CI)F /T

However, don't run this blindly against the entire Hyper-V storage location. Apply it only to the affected VM after confirming its VM ID and current ACLs.

Also check the Hyper-V-VMMS/Admin event log:

Event Viewer > Applications and Services Logs > Microsoft > Windows > Hyper-V-VMMS > Admin

If this is a Hyper-V permission problem, you will commonly find an event identifying the exact file/path for which access was denied.

One more distinction: if you personally get Access Denied while browsing or deleting .bin/.vsv files but the VM starts and runs normally, that doesn't necessarily mean the Hyper-V permissions are broken. Hyper-V manages those files, and you shouldn't normally manipulate them while the VM or its saved state is in use.

If you can provide the Windows Server/Hyper-V version, whether the VM was moved/restored/copied, and the output of:

icacls "<path-to-the-affected-file>"

and the relevant Hyper-V-VMMS event, we can determine whether this is actually a lost VM ACL or simply expected protection of an active saved-state file.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.