| Previous | Next |
| ERROR_HV_INVALID_PARAMETER | ERROR_HV_INVALID_PARTITION_STATE |
ERROR_HV_ACCESS_DENIED
Hypervisor access checks are based on partition authority
ERROR_HV_ACCESS_DENIED means the caller is not authorized to operate on the selected hypervisor object. TLFS hypercalls commonly require the caller to be the target partition itself, its parent, or a partition granted a specific privilege such as access to VP registers, VSM, SynIC registers, or device assignment.
Do not diagnose this as an NTFS permission or COM security problem. Capture the hypercall code, target partition ID, caller partition, target VTL, and privilege flags discovered for the caller. A root-management component can also receive this result after reusing a handle or identifier from a partition that has been deleted and recreated under a different authority relationship.
Authorization checks to perform
- Confirm whether the call targets self, a child partition, or an unrelated partition.
- Inspect the privilege flags required by the specific hypercall.
- Verify that the target partition ID was obtained in the current lifecycle.
- Separate access denial from an unsupported call or invalid object identifier.
References
- Microsoft TLFS: hypercall reference
- Microsoft TLFS: parent and AccessVpRegisters restrictions
- Linux kernel: guest communication with Hyper-V
Looking for a different code? Search another status or error code.