{"record":{"id":"3dc1475acdfb4d70","repo":"TechnitiumSoftware/DnsServer","slug":"access-was-denied","errorCode":null,"errorMessage":"Access was denied.","messagePattern":"Access was denied\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":1112,"sourceCode":"\n            _groups.TryRemove(oldGroupName.ToLowerInvariant(), out _);\n\n            //update users\n            foreach (KeyValuePair<string, User> user in _users)\n                user.Value.RenameGroup(oldGroupName);\n        }\n\n        public bool DeleteGroup(string name)\n        {\n            name = name.ToLowerInvariant();\n\n            switch (name)\n            {\n                case \"everyone\":\n                case \"administrators\":\n                case \"dns administrators\":\n                case \"dhcp administrators\":\n                    throw new InvalidOperationException(\"Access was denied.\");\n\n                default:\n                    if (_groups.TryRemove(name, out Group deletedGroup))\n                    {\n                        //remove all users from deleted group\n                        foreach (KeyValuePair<string, User> user in _users)\n                            user.Value.RemoveFromGroup(deletedGroup);\n\n                        //delete all permissions\n                        foreach (KeyValuePair<PermissionSection, Permission> permission in _permissions)\n                        {\n                            permission.Value.RemovePermission(deletedGroup);\n                            permission.Value.RemoveAllSubItemPermissions(deletedGroup);\n                        }\n\n                        return true;\n                    }\n","sourceCodeStart":1094,"sourceCodeEnd":1130,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L1094-L1130","documentation":"Thrown as InvalidOperationException from DeleteGroup when the target group name (lowercased) is one of the protected built-in groups: 'everyone', 'administrators', 'dns administrators', or 'dhcp administrators'. These groups back core permission sections and cannot be removed. Returned over the API as HTTP 200 with status 'error'.","triggerScenarios":"POST /api/groups/delete with a name matching a protected group; attempting to remove a system group via the API or UI.","commonSituations":"Automation/script trying to clean up all groups indiscriminately; an admin attempting to delete a built-in role group.","solutions":["Do not delete protected groups; manage access by editing their membership and permissions instead.","Filter protected group names out of any bulk-delete loop.","If custom role grouping is needed, create a separate group rather than reusing a built-in one."],"exampleFix":"// before\nforeach (var g in groupsToDelete)\n    _authManager.DeleteGroup(g); // throws on built-ins\n// after\nvar protectedGroups = new[]{\"everyone\",\"administrators\",\"dns administrators\",\"dhcp administrators\"};\nforeach (var g in groupsToDelete.Where(n => !protectedGroups.Contains(n.ToLowerInvariant())))\n    _authManager.DeleteGroup(g);","handlingStrategy":"validation","validationCode":"static readonly HashSet<string> ProtectedGroups = new(StringComparer.OrdinalIgnoreCase)\n    { \"everyone\", \"administrators\", \"dns administrators\", \"dhcp administrators\" };\nif (ProtectedGroups.Contains(name))\n    throw new InvalidOperationException($\"Group '{name}' is protected and cannot be deleted.\");","typeGuard":"static bool IsProtectedGroup(string name) => ProtectedGroups.Contains(name);","tryCatchPattern":"try { await client.DeleteGroupAsync(name); }\ncatch (HttpApiClientException ex) when (ex.Message == \"Access was denied.\")\n{\n    // this is a protected built-in group; cannot be deleted\n}","preventionTips":["Filter protected group names out of bulk-delete operations.","Manage built-in groups via membership/permissions, not deletion."],"tags":["auth","group-management","access-denied","protected"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}