TechnitiumSoftware/DnsServer · error · InvalidOperationException

Access was denied.

Error message

Access was denied.

What it means

Thrown by the Group.Name setter when the group's CURRENT name (_name, lowercased) is one of the reserved built-in names: everyone, administrators, dns administrators, dhcp administrators. It is an InvalidOperationException (not ArgumentException) because the value itself is acceptable but the operation — renaming a built-in group — is forbidden. The switch inspects the existing _name, so this protects built-in groups from being renamed.

Source

Thrown at DnsServerCore/Auth/Group.cs:117

        public string Name
        {
            get { return _name; }
            set
            {
                if (string.IsNullOrWhiteSpace(value))
                    throw new ArgumentException("Group name cannot be null or empty.", nameof(Name));

                if (value.Length > 255)
                    throw new ArgumentException("Group name length cannot exceed 255 characters.", nameof(Name));

                switch (_name?.ToLowerInvariant())
                {
                    case "everyone":
                    case "administrators":
                    case "dns administrators":
                    case "dhcp administrators":
                        throw new InvalidOperationException("Access was denied.");

                    default:
                        _name = value;
                        break;
                }
            }
        }

        public string Description
        {
            get { return _description; }
            set
            {
                if (string.IsNullOrWhiteSpace(value))
                    _description = "";
                else if (value.Length > 255)
                    throw new ArgumentException("Group description length cannot exceed 255 characters.", nameof(Description));
                else

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Do not rename built-in groups (everyone/administrators/dns administrators/dhcp administrators); exclude them from any rename operation.
2. If you need a differently-named group, create a new group instead of renaming a built-in one.
3. Filter out reserved names before attempting bulk rename.

Example fix

// before
foreach (var g in allGroups) g.Name = Normalize(g.Name);

// after
static readonly HashSet<string> Reserved = new(StringComparer.OrdinalIgnoreCase)
    { "everyone", "administrators", "dns administrators", "dhcp administrators" };
foreach (var g in allGroups.Where(g => !Reserved.Contains(g.Name)))
    g.Name = Normalize(g.Name);

static readonly HashSet<string> ReservedGroupNames = new(StringComparer.OrdinalIgnoreCase)
{
    "everyone", "administrators", "dns administrators", "dhcp administrators"
};

if (group is not null && ReservedGroupNames.Contains(group.Name))
    return Forbid("Built-in groups cannot be renamed.");
group.Name = newName;

try { group.Name = newName; }
catch (InvalidOperationException ex) when (ex.Message == "Access was denied.")
{ return Forbid(ex.Message); }

When it happens

Trigger: Attempting to rename a built-in group (whose current Name is one of the reserved values) by assigning a new Name. The guard keys off the existing name, so only currently-built-in groups hit it.

Common situations: An admin script that bulk-renames all groups and inadvertently targets the built-in ones; a UI that lets users edit any group including system groups; a migration that tries to normalize built-in group casing.

Related errors

• Group name cannot be null or empty.
• Group name length cannot exceed 255 characters.
• Cannot add user to group: user can be member of max 255 grou
• Access was denied.
• Already logged in. Please create a new object to use a diffe

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/012933cf9feb72ff. Report an issue: GitHub.