{"record":{"id":"012933cf9feb72ff","repo":"TechnitiumSoftware/DnsServer","slug":"access-was-denied-012933","errorCode":null,"errorMessage":"Access was denied.","messagePattern":"Access was denied\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/Group.cs","lineNumber":117,"sourceCode":"\n        public string Name\n        {\n            get { return _name; }\n            set\n            {\n                if (string.IsNullOrWhiteSpace(value))\n                    throw new ArgumentException(\"Group name cannot be null or empty.\", nameof(Name));\n\n                if (value.Length > 255)\n                    throw new ArgumentException(\"Group name length cannot exceed 255 characters.\", nameof(Name));\n\n                switch (_name?.ToLowerInvariant())\n                {\n                    case \"everyone\":\n                    case \"administrators\":\n                    case \"dns administrators\":\n                    case \"dhcp administrators\":\n                        throw new InvalidOperationException(\"Access was denied.\");\n\n                    default:\n                        _name = value;\n                        break;\n                }\n            }\n        }\n\n        public string Description\n        {\n            get { return _description; }\n            set\n            {\n                if (string.IsNullOrWhiteSpace(value))\n                    _description = \"\";\n                else if (value.Length > 255)\n                    throw new ArgumentException(\"Group description length cannot exceed 255 characters.\", nameof(Description));\n                else","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/Group.cs#L99-L135","documentation":"Thrown by the Group.Name setter when the group's CURRENT name (_name, lowercased) is one of the reserved built-in names: everyone, administrators, dns administrators, dhcp administrators. It is an InvalidOperationException (not ArgumentException) because the value itself is acceptable but the operation — renaming a built-in group — is forbidden. The switch inspects the existing _name, so this protects built-in groups from being renamed.","triggerScenarios":"Attempting to rename a built-in group (whose current Name is one of the reserved values) by assigning a new Name. The guard keys off the existing name, so only currently-built-in groups hit it.","commonSituations":"An admin script that bulk-renames all groups and inadvertently targets the built-in ones; a UI that lets users edit any group including system groups; a migration that tries to normalize built-in group casing.","solutions":["Do not rename built-in groups (everyone/administrators/dns administrators/dhcp administrators); exclude them from any rename operation.","If you need a differently-named group, create a new group instead of renaming a built-in one.","Filter out reserved names before attempting bulk rename."],"exampleFix":"// before\nforeach (var g in allGroups) g.Name = Normalize(g.Name);\n\n// after\nstatic readonly HashSet<string> Reserved = new(StringComparer.OrdinalIgnoreCase)\n    { \"everyone\", \"administrators\", \"dns administrators\", \"dhcp administrators\" };\nforeach (var g in allGroups.Where(g => !Reserved.Contains(g.Name)))\n    g.Name = Normalize(g.Name);","handlingStrategy":"validation","validationCode":"static readonly HashSet<string> ReservedGroupNames = new(StringComparer.OrdinalIgnoreCase)\n{\n    \"everyone\", \"administrators\", \"dns administrators\", \"dhcp administrators\"\n};\n\nif (group is not null && ReservedGroupNames.Contains(group.Name))\n    return Forbid(\"Built-in groups cannot be renamed.\");\ngroup.Name = newName;","typeGuard":null,"tryCatchPattern":"try { group.Name = newName; }\ncatch (InvalidOperationException ex) when (ex.Message == \"Access was denied.\")\n{ return Forbid(ex.Message); }","preventionTips":["Exclude built-in groups from bulk rename operations.","Never expose built-in group names as editable in the UI.","Create a new group rather than renaming a built-in one."],"tags":["groups","auth","reserved-names","access-control"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}