WMI Error. Not Enough Permissions (code 1916)

Situation

A Hyper-V backup plan terminates with the following error: WMI Error. Not Enough Permissions

Cause

The occurrence of this error means that WMI returned the 'not enough permissions' error with identified error code.

WMI is a core Microsoft technology for managing Windows systems. It creates a standard way to get information from/perform actions on the system's hardware, software, and Windows components. For details, refer to the relevant Microsoft documentation.

WMI error codes that may appear:

• WMI error code: 32774
• WMI error code: 32769

Solution

Step 1. Allow NT Virtual Machine logon as a service

1. Open Local Security Policy in the Start Menu.
2. Browse to Security Settings > Local Policies > User Rights Assigments.
3. Double-click Log on as a service to open the policy's properties.
4. In the properties window, click Add User or Group.
5. In the Select Users or Groups dialog, type NT Virtual Machine\Virtual Machines and click Check Names.
6. If it doesn't find the name, try searching by default SID: S-1-5-83-0 and click "Check Names".
7. If still not found, verify that the Hyper-V role is installed correctly.

Step 2. Check required NT Virtual Machine security permissions on the VM folder

The folder that houses VM's .vhdx and configuration files, must be granted with both the host machine's account and the specific Virtual Machine ID (SID) access.

1. Locate the VM files: the default location is C:\ProgramData\Microsoft\Windows\Hyper-V\.
2. Navigate to the specific folder for the virtual machine, right-click it to select Properties.
3. Open Security settings, go to the Security tab > Advanced.

Step 3. Apply required NT Virtual Machine security permissions on the VM folder

You have 3 options:

• Option 1: Manually
• Option 2: Automatic PowerShell Script
• Apply Default Permissions Using Native Hyper-V VM Move

Option 1: Manually:

1. Run an elevated PowerShell console and execute:

Get-VM | Format-List Name, ID

2. Find the name of the VM that produced the error to keep its ID to use further.
3. Once the ID is found, get back to PowerShell and run the following command:

Icacls "path_to_virtual_machines_folder" /grant "NT VIRTUAL MACHINE\\Virtual Machines:(OI)F"

Option 2: Automatic Powershell script:

1. Run an elevated PowerShell script

#©MSP360
$hv_file_types = @(".vmcx" , ".vmgs", ".vmrs", ".vhd", ".vhdx", ".avhdx", ".xml", ".mrt", ".rct")
$hv_vm_ace = "(A;;0x12008f;;;S-1-5-83-0)(A;CIIO;DCLCGR;;;S-1-5-83-0)"
$hv_vm_reset_ace = "(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200af;;;BU)"

Function CBL-Pause ($message)
{
    if ($psISE)
    {
        Add-Type -AssemblyName System.Windows.Forms
        [System.Windows.Forms.MessageBox]::Show("$message")
    }
    else
    {
        Write-Host "$message" -ForegroundColor Yellow
        $x = $host.ui.RawUI.ReadKey("NoEcho,IncludeKeyDown")
    }
}

Function CBL-EnsureHyper-VPath
{
    [CmdletBinding()] Param ([Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)][string] $path = $(Throw("-path is required")))
    Process 
    {
        $flag = $false
        if ((Test-Path($path)) -eq $false)
        {
            Write-Host "Path not found..." -ForegroundColor Red
            CBL-Pause "Hit any key to close session..."
            exit
        }
        foreach ($item in gci $path -recurse)
        {
            if (($hv_file_types.Contains($item.Extension)) -eq $true)
            {
                $flag = $true
                return 
            }
        }   
        if ($flag -eq $false)
        {
            if ((Read-Host 'Seems the specified directory does not contain any of Hyper-V related files. Are you sure you want to proceed? [yes/no]') -match '^\s*y') 
            { 
                return
            } 
            else 
            { 
                exit 1
            }
        }    	   
    }
}
       
Function CBL-ApplyDefaultHyper-VDirectoryPermissions 
{
	[CmdletBinding()] Param ([Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)] [string] $path = $(Throw("-path is required")))
	Process 
    {
        CBL-EnsureHyper-VPath $path
        $path_acl = Get-Acl -Path $path
        $sdl_preamble = $path_acl.sddl -replace "\(.*", ""
        $sddl = $sdl_preamble + $hv_vm_ace + $hv_vm_reset_ace
        $path_acl.SetSecurityDescriptorsddlForm($sddl)
        $path_acl.SetAccessRuleProtection($true,$false)
        try
        {
            Set-Acl -Path $path -AclObject $path_acl -ErrorAction Stop
        }
        catch
        {
             Write-Host "Error: " $_ -ForegroundColor Red
             CBL-Pause "Hit any key to close session..."
             exit 2
        }  
        Write-Host "Permissions:" $path_acl.Sddl "set for:" $path -ForegroundColor Green
        CBL-Pause "Hit any key to close session..."
    }
}

$Path = Read-Host "Enter path"
CBL-ApplyDefaultHyper-VDirectoryPermissions $Path

2. Run script and follow instructions on the screen.

Option 3: Apply default permissions using native Hyper-V VM Move

1. Open Hyper-V Manager from the Start Menu.
2. In the "Virtual Machines" list, ight-click the VM you want to move and select Move...*.
3. choose Move the virtual machine's storage and click Next.
4. Choose Move all of the virtual machine's data to a single location and click Next.
5. Select a new location and complete the wizard.

Once moved, repeat the process to move the VM back to its original location.

Recreate VM

1. Delete the failed VM instance, but do not delete its associated disk files (with the .VHDX extension).

2. Create a new VM instance from scratch, and then attach the original .VHDX disks to the recreated VM.

Apply Permissions to the VM Configuration File

1. Run an elevated PowerShell console and execute:

Get-VM | Format-List Name, ID

2. Find the name of the VM that produced the error to keep its ID to use further.

3. As the ID is found, get back to PowerShell and run the following command:

Icacls "[path_to_virtual_machine_xml_files]\[VM_ID].xml" /grant "NT VIRTUAL MACHINE[VM_ID]:(OI)F"

• where:
  • path_t-virtual_machine_xml_files is a path to the Hyper-V VM files (example: C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines)
  • VM_OD is a virtual machine ID