| Previous | Next |
| ERROR_VID_SAVED_STATE_INCOMPATIBLE | ERROR_VMCOMPUTE_TERMINATED_DURING_START |
ERROR_VID_VTL_ACCESS_DENIED
ERROR_VID_VTL_ACCESS_DENIED is HRESULT 0xC037002A in the Virtual Trust Level isolation area of the Windows virtualization stack. It applies to access to a resource protected by a Virtual Trust Level (VTL) boundary.
Why this result is specific
The requesting VTL lacks permission for the resource. VTLs are hierarchical execution and memory-isolation domains; this result should be treated as an authorization boundary, not bypassed by broadening ordinary file or process ACLs.
Neighboring result: A generic access-denied HRESULT can originate from user-mode ACLs. VTL_ACCESS_DENIED specifically points to hypervisor-enforced VSM/VTL policy and partition/VP context.
Records worth collecting
| Evidence | Why it changes the diagnosis |
|---|---|
| Requesting context | Record partition, VP, current VTL, target VTL, and operation. |
| Resource protection | Keep GPA range or resource identity and configured VTL protection mask. |
| Enablement sequence | Record partition-VTL and VP-VTL enablement plus initial context. |
| Policy owner | Identify VBS/VSM component responsible for the protected resource. |
A reproducible test plan
- Confirm the operation runs in the intended VTL and partition.
- Validate VTL enablement and protection configuration in the documented order.
- Do not map or expose protected memory to VTL0 as a workaround.
- Use a controlled nonprotected resource to isolate general mapping failure from VTL policy.
Treat this result as a security-boundary test. When reproducing it, change only VTL enablement, caller context, target resource, or protection mask; never broaden access merely to make the HRESULT disappear.
Comparison matrix
| Control | Interpretation | Hold constant |
|---|---|---|
| Authorized versus lower VTL | If the operation succeeds only from the configured higher trust level, it is enforcing the intended isolation boundary. | Keep partition, VP, resource, and protection mask fixed. |
| Protected versus control GPA/resource | A nonprotected control succeeding while the protected target returns it localizes the decision to VTL policy. | Change only the target protection state. |
| Fresh enablement sequence | Rebuilding the documented partition-VTL and VP-VTL sequence can expose stale context behind it. | Do not weaken default VTL memory protection during the test. |
Misleading shortcuts
Do not weaken VTL protection, expose protected GPA ranges, or move work to VTL0 as a workaround. A valid the correction must preserve the intended isolation policy.
Verification after repair
The authorized VTL completes the operation, unauthorized VTLs remain denied, and memory-protection tests confirm isolation is preserved.
Technical references
These sources define it and the VSM/VTL isolation model; they should be used without weakening the security boundary.
- Microsoft Open Specifications: HRESULT values — used to interpret this result.
- Microsoft TLFS: Virtual Secure Mode — used to interpret this result.
- Microsoft TLFS: partition properties — used to interpret this result.
- Microsoft: Hyper-V architecture — used to interpret this result.
Looking for a different code? Search another status or error code.