| Previous | Next |
| ERROR_VID_SAVED_STATE_INCOMPATIBLE | ERROR_VMCOMPUTE_TERMINATED_DURING_START |
ERROR_VID_VTL_ACCESS_DENIED
ERROR_VID_VTL_ACCESS_DENIED is HRESULT 0xC037002A in the Virtual Trust Level isolation area of the Windows virtualization stack. The built-in message names the immediate result; the useful custom context is the exact boundary: access to a resource protected by a Virtual Trust Level (VTL) boundary. Record the first returning operation and host-side event before a management layer retries or translates it.
Why this HRESULT is specific
The requesting VTL lacks permission for the resource. VTLs are hierarchical execution and memory-isolation domains; this result should be treated as an authorization boundary, not bypassed by broadening ordinary file or process ACLs.
Hyper-V architecture documentation identifies VID as the component that provides partition, virtual-processor, and memory-management services., many ERROR_VID_* values describe internal host objects rather than a public API that administrators should call directly. Accordingly, diagnose this result through the named object/state, the VMMS or Worker event chain, and the operation that produced it; do not invent a user-mode VID call from the constant name.
Neighboring result: A generic access-denied HRESULT can originate from user-mode ACLs. VTL_ACCESS_DENIED specifically points to hypervisor-enforced VSM/VTL policy and partition/VP context.
Records worth collecting
| Evidence | Why it changes the diagnosis |
|---|---|
| Requesting context | Record partition, VP, current VTL, target VTL, and operation. |
| Resource protection | Keep GPA range or resource identity and configured VTL protection mask. |
| Enablement sequence | Record partition-VTL and VP-VTL enablement plus initial context. |
| Policy owner | Identify VBS/VSM component responsible for the protected resource. |
Preserve identifiers and counts without dumping guest secrets or unrelated memory. Useful this result timestamps include the last successful operation, first failure, any automatic retry, and the object-generation change that followed.
A reproducible test plan
- Confirm the operation runs in the intended VTL and partition.
- Validate VTL enablement and protection configuration in the documented order.
- Do not map or expose protected memory to VTL0 as a workaround.
- Use a controlled nonprotected resource to isolate general mapping failure from VTL policy.
Treat this result as a security-boundary test. When reproducing it, change only VTL enablement, caller context, target resource, or protection mask; never broaden access merely to make the HRESULT disappear.
Comparison matrix
Across these controls for it, preserve access to a resource protected by a Virtual Trust Level (VTL) boundary as the boundary under test.
| Control | Interpretation | Hold constant |
|---|---|---|
| Authorized versus lower VTL — it | If the operation succeeds only from the configured higher trust level, it is enforcing the intended isolation boundary. | Keep partition, VP, resource, and protection mask fixed for it. |
| Protected versus control GPA/resource — it | A nonprotected control succeeding while the protected target returns it localizes the decision to VTL policy. | Change only the target protection state. |
| Fresh enablement sequence — it | Rebuilding the documented partition-VTL and VP-VTL sequence can expose stale context behind it. | Do not weaken default VTL memory protection during the result test. |
Misleading shortcuts
Do not weaken VTL protection, expose protected GPA ranges, or move work to VTL0 as a workaround for it. A valid the correction must preserve the intended isolation policy.
Verification after repair
The authorized VTL completes the operation, unauthorized VTLs remain denied, and memory-protection tests confirm isolation is preserved. Repeat the original operation under the original supported conditions and retain one deliberate negative control. A management command succeeding on a different object is not sufficient to close this incident.
Technical references
These sources define it and the VSM/VTL isolation model; they should be used without weakening the security boundary.
- Microsoft Open Specifications: HRESULT values — used to interpret the boundary.
- Microsoft TLFS: Virtual Secure Mode — used to interpret the boundary.
- Microsoft TLFS: partition properties — used to interpret the boundary.
- Microsoft: Hyper-V architecture — used to interpret the boundary.
Looking for a different code? Search another status or error code.