{"record":{"id":"800eb47b5c62ed0c","repo":"TechnitiumSoftware/DnsServer","slug":"access-was-denied-800eb4","errorCode":null,"errorMessage":"Access was denied.","messagePattern":"Access was denied\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/User.cs","lineNumber":348,"sourceCode":"            _previousSessionLoggedOn = _recentSessionLoggedOn;\n            _previousSessionRemoteAddress = _recentSessionRemoteAddress;\n\n            _recentSessionLoggedOn = DateTime.UtcNow;\n            _recentSessionRemoteAddress = remoteAddress;\n        }\n\n        public void AddToGroup(Group group)\n        {\n            if (_memberOfGroups.Count == 255)\n                throw new InvalidOperationException(\"Cannot add user to group: user can be member of max 255 groups.\");\n\n            _memberOfGroups.TryAdd(group.Name.ToLowerInvariant(), group);\n        }\n\n        public bool RemoveFromGroup(Group group)\n        {\n            if (group.Name.Equals(\"everyone\", StringComparison.OrdinalIgnoreCase))\n                throw new InvalidOperationException(\"Access was denied.\");\n\n            return _memberOfGroups.TryRemove(group.Name.ToLowerInvariant(), out _);\n        }\n\n        public void SyncGroups(IReadOnlyDictionary<string, Group> groups)\n        {\n            //remove non-existent groups\n            foreach (KeyValuePair<string, Group> group in _memberOfGroups)\n            {\n                if (!groups.ContainsKey(group.Key))\n                    _memberOfGroups.TryRemove(group.Key, out _);\n            }\n\n            //set new groups\n            foreach (KeyValuePair<string, Group> group in groups)\n                _memberOfGroups[group.Key] = group.Value;\n        }\n","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/User.cs#L330-L366","documentation":"Thrown by User.RemoveFromGroup(group) when the target group is the built-in 'everyone' group (case-insensitive match). Membership in 'everyone' is implicit and non-removable; removing it would orphan the user from default permissions, so the call is treated as an access violation rather than a normal no-op.","triggerScenarios":"Calling RemoveFromGroup with a Group whose Name equals 'everyone', or a bulk 'remove from all groups' routine that does not exclude the built-in group.","commonSituations":"An admin script iterates all of a user's groups and calls RemoveFromGroup for each; a UI 'leave group' action offered for the everyone group; group rename logic that hits the reserved name.","solutions":["Filter out the 'everyone' (and other system) group before calling RemoveFromGroup.","When bulk-removing, skip names that case-insensitively equal 'everyone'.","Disable the remove action in the UI for system groups."],"exampleFix":"// before\nforeach (var g in userGroups)\n    user.RemoveFromGroup(g);\n\n// after\nforeach (var g in userGroups)\n    if (!g.Name.Equals(\"everyone\", StringComparison.OrdinalIgnoreCase))\n        user.RemoveFromGroup(g);","handlingStrategy":"validation","validationCode":"if (group.Name.Equals(\"everyone\", StringComparison.OrdinalIgnoreCase))\n    return BadRequest(\"Cannot remove the built-in 'everyone' group.\");\nuser.RemoveFromGroup(group);","typeGuard":"static bool IsRemovableGroup(Group group) => !group.Name.Equals(\"everyone\", StringComparison.OrdinalIgnoreCase);","tryCatchPattern":null,"preventionTips":["Filter system groups ('everyone') out of bulk-remove loops.","Disable the remove action in the UI for built-in groups.","Maintain a list of reserved group names and check against it."],"tags":["auth","groups","access-denied","built-in","technitium-dns-server"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}