PowerShell/PowerShell · error · UnauthorizedAccessException

Access to the path '{0}' is denied.

Error message

Access to the path '{0}' is denied.

What it means

Thrown by Invoke-WebRequest/Invoke-RestMethod when -InFile points to a file that cannot be opened for read due to UnauthorizedAccessException. The original exception is caught and re-thrown with a formatted 'access denied' message referencing the _originalFilePath.

Source

Thrown at src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs:1228

                        break;
                    default:
                        SetRequestContent(request, (string)LanguagePrimitives.ConvertTo(content, typeof(string), CultureInfo.InvariantCulture));
                        break;
                }
            }
            else if (InFile is not null)
            {
                // Copy InFile data
                try
                {
                    // Open the input file
                    SetRequestContent(request, new FileStream(InFile, FileMode.Open, FileAccess.Read, FileShare.Read));
                }
                catch (UnauthorizedAccessException)
                {
                    string msg = string.Format(CultureInfo.InvariantCulture, WebCmdletStrings.AccessDenied, _originalFilePath);

                    throw new UnauthorizedAccessException(msg);
                }
            }

            // For other methods like Put where empty content has meaning, we need to fill in the content
            if (request.Content is null)
            {
                // If this is a Get request and there is no content, then don't fill in the content as empty content gets rejected by some web services per RFC7230
                if (request.Method == HttpMethod.Get && ContentType is null)
                {
                    return;
                }

                request.Content = new StringContent(string.Empty);
                request.Content.Headers.Clear();
            }

            foreach (KeyValuePair<string, string> entry in WebSession.ContentHeaders)
            {

View on GitHub (pinned to 3ff3c711bf)

Solutions

1. Check the file ACL and grant the invoking account read access (icacls / icacls grant)
2. Close the process holding an exclusive lock on the file, or copy the file to a temp location you own
3. Verify the path resolves to a real, readable file with Test-Path / Get-Item before calling

Example fix

# before
Invoke-WebRequest -Uri $u -Method Put -InFile 'C:\protected\data.bin'

# after
Copy-Item 'C:\protected\data.bin' "$env:TEMP\data.bin"
Invoke-WebRequest -Uri $u -Method Put -InFile "$env:TEMP\data.bin"

if (-not (Test-Path $InFile) -or -not (Get-Item $InFile).CanRead) { throw "InFile $InFile not readable by current identity." }

null

try { Invoke-WebRequest -InFile $InFile @params } catch [UnauthorizedAccessException] { Write-Error "Access denied to $InFile; check ACL/locks." }

When it happens

Trigger: Using -InFile with a path the current identity cannot read (locked, ACL-restricted, or held exclusively by another process), or a path that resolves outside permitted access.

Common situations: File held open by another process with an exclusive lock; NTFS ACL denying the service account read access; running under a restricted AppLocker/CI policy; InFile path is a directory or protected system file.

Related errors

• Unable to retrieve certificates because the thumbprint is no
• The request was canceled due to the configured OperationTime
• The request was canceled due to the configured OperationTime

AI-assisted analysis of PowerShell/PowerShell@3ff3c711bf (2026-08-13). Data as JSON: /api/errors/de002cfd9ede0779. Report an issue: GitHub.