Windows Server  ·  high  ·  Directory & core infrastructure

Hyper-V: a VM will not start — 0x80070569 or "failed to open attachment"

The VM worker process cannot open something it needs — usually the VHDX — because the per-VM security identity lacks permission on the file or the share.

What you see

Starting a VM fails immediately with a permissions error naming the VHDX path, or a logon failure. Common after restoring a VM, moving files by hand, or copying a VM between hosts.

What is actually wrong

Each VM runs as NT VIRTUAL MACHINE\<VM GUID>. That identity needs explicit permission on the VHDX. Copying or restoring files loses the ACL, and the identity differs on the new host.

Codes and articles

0x800705690x800700050x8007000EEvent 12140Event 12620

Fixes (2)

Restore the per-VM ACL on the disk files
Elevated PowerShell on the Hyper-V host15 minuteslow riskreversible

Files are on local storage or a CSV.

  1. Get the VM's ID — this is the SID the worker process runs under.

    PowerShell
    Get-VM -Name 'MyVM' | Select-Object Name, Id, State

  2. Look at the current ACL on the VHDX and note whether the VM's GUID appears.

    PowerShell
    (Get-Acl 'D:\VMs\MyVM\disk.vhdx').Access | Format-Table IdentityReference, FileSystemRights -AutoSize

  3. Grant the VM identity full control on the file.

    PowerShell
    $vm = Get-VM -Name 'MyVM'icacls "D:\VMs\MyVM\disk.vhdx" /grant "NT VIRTUAL MACHINE\$($vm.Id):(F)"

    The identity is per-VM and contains the VM's GUID, so it cannot be copied between hosts or recreated by inheritance.

  4. If several files are involved — checkpoints, AVHDX chains — grant on the folder instead.

    PowerShell
    icacls "D:\VMs\MyVM" /grant "NT VIRTUAL MACHINE\$($vm.Id):(OI)(CI)(F)" /T

  5. The supported alternative is to remove and re-add the disk in the VM's settings, which makes Hyper-V write the ACL itself.

Confirm it workedThe VM starts.
PowerShell
Start-VM -Name 'MyVM'Get-VM -Name 'MyVM' | Select-Object Name, State
If you need to undo iticacls with /remove for the identity granted.
Fix constrained delegation for SMB-hosted VMs
Elevated PowerShell45 minutesmedium riskreversible

VM files are on an SMB 3 file share.

  1. Confirm the host computer account has full control on the share and the NTFS path — both, not one.

  2. Check delegation is configured for the CIFS service on the file server.

    PowerShell
    Get-ADComputer HV01 -Properties msDS-AllowedToDelegateTo | Select-Object -ExpandProperty 'msDS-AllowedToDelegateTo'

    Without constrained delegation the host cannot present the caller's credentials to the file server, and the failure surfaces as a permissions error on the VHDX.

  3. Add it if missing.

    PowerShell
    Set-ADComputer HV01 -Add @{'msDS-AllowedToDelegateTo'=@('cifs/FS01.example.local','cifs/FS01')}

  4. Restart the Hyper-V host so the ticket cache is rebuilt.

Confirm it workedThe VM starts and the host can browse the share as itself.
PowerShell
Get-SmbShareAccess -Name VMs -CimSession FS01
If you need to undo itSet-ADComputer HV01 -Remove @{'msDS-AllowedToDelegateTo'=...}

Reference

Hyper-V storage permissions — Microsoft Learn ↗

Related faults

Hyper-V checkpoints will not merge, and the disk fillsWindows Server0x80070005 — access denied during update or activationWindows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.