TechnitiumSoftware/DnsServer · error · InvalidOperationException

Access was denied.

Error message

Access was denied.

What it means

Thrown by User.RemoveFromGroup(group) when the target group is the built-in 'everyone' group (case-insensitive match). Membership in 'everyone' is implicit and non-removable; removing it would orphan the user from default permissions, so the call is treated as an access violation rather than a normal no-op.

Source

Thrown at DnsServerCore/Auth/User.cs:348

            _previousSessionLoggedOn = _recentSessionLoggedOn;
            _previousSessionRemoteAddress = _recentSessionRemoteAddress;

            _recentSessionLoggedOn = DateTime.UtcNow;
            _recentSessionRemoteAddress = remoteAddress;
        }

        public void AddToGroup(Group group)
        {
            if (_memberOfGroups.Count == 255)
                throw new InvalidOperationException("Cannot add user to group: user can be member of max 255 groups.");

            _memberOfGroups.TryAdd(group.Name.ToLowerInvariant(), group);
        }

        public bool RemoveFromGroup(Group group)
        {
            if (group.Name.Equals("everyone", StringComparison.OrdinalIgnoreCase))
                throw new InvalidOperationException("Access was denied.");

            return _memberOfGroups.TryRemove(group.Name.ToLowerInvariant(), out _);
        }

        public void SyncGroups(IReadOnlyDictionary<string, Group> groups)
        {
            //remove non-existent groups
            foreach (KeyValuePair<string, Group> group in _memberOfGroups)
            {
                if (!groups.ContainsKey(group.Key))
                    _memberOfGroups.TryRemove(group.Key, out _);
            }

            //set new groups
            foreach (KeyValuePair<string, Group> group in groups)
                _memberOfGroups[group.Key] = group.Value;
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Filter out the 'everyone' (and other system) group before calling RemoveFromGroup.
2. When bulk-removing, skip names that case-insensitively equal 'everyone'.
3. Disable the remove action in the UI for system groups.

Example fix

// before
foreach (var g in userGroups)
    user.RemoveFromGroup(g);

// after
foreach (var g in userGroups)
    if (!g.Name.Equals("everyone", StringComparison.OrdinalIgnoreCase))
        user.RemoveFromGroup(g);

if (group.Name.Equals("everyone", StringComparison.OrdinalIgnoreCase))
    return BadRequest("Cannot remove the built-in 'everyone' group.");
user.RemoveFromGroup(group);

static bool IsRemovableGroup(Group group) => !group.Name.Equals("everyone", StringComparison.OrdinalIgnoreCase);

When it happens

Trigger: Calling RemoveFromGroup with a Group whose Name equals 'everyone', or a bulk 'remove from all groups' routine that does not exclude the built-in group.

Common situations: An admin script iterates all of a user's groups and calls RemoveFromGroup for each; a UI 'leave group' action offered for the everyone group; group rename logic that hits the reserved name.

Related errors

• Cannot add user to group: user can be member of max 255 grou
• Access was denied.
• Group name cannot be null or empty.
• Group name length cannot exceed 255 characters.
• Access was denied.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/800eb47b5c62ed0c. Report an issue: GitHub.