{"record":{"id":"8c7792b2c918a4d5","repo":"nats-io/nats-server","slug":"unable-to-create-access-directory-q-v","errorCode":null,"errorMessage":"unable to create/access directory %q: %v","messagePattern":"unable to create/access directory %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":88,"sourceCode":"\t\t},\n\t}\n\t// Create the parent key against which to seal the data\n\tsrkHandle, _, err := tpm2.CreatePrimary(rwc, tpm2.HandleOwner, tpm2.PCRSelection{}, \"\", srkPassword, srkTemplate)\n\treturn srkHandle, err\n}\n\ntype natsTPMPersistedKeys struct {\n\tVersion    int    `json:\"version\"`\n\tPrivateKey []byte `json:\"private_key\"`\n\tPublicKey  []byte `json:\"public_key\"`\n}\n\n// Writes the private and public blobs to disk in a single file. If the directory does\n// not exist, it will be created. If the file already exists it will be overwritten.\nfunc writeTPMKeysToFile(filename string, privateBlob []byte, publicBlob []byte) error {\n\tkeyDir := filepath.Dir(filename)\n\tif err := os.MkdirAll(keyDir, 0750); err != nil {\n\t\treturn fmt.Errorf(\"unable to create/access directory %q: %v\", keyDir, err)\n\t}\n\n\t// Create a new set of persisted keys. Note that the private key doesn't necessarily\n\t// need to be protected as the TPM password is required to use unseal, although it's\n\t// a good idea to put this in a secure location accessible to the server.\n\ttpmKeys := natsTPMPersistedKeys{\n\t\tVersion:    JsKeyTPMVersion,\n\t\tPrivateKey: make([]byte, base64.StdEncoding.EncodedLen(len(privateBlob))),\n\t\tPublicKey:  make([]byte, base64.StdEncoding.EncodedLen(len(publicBlob))),\n\t}\n\tbase64.StdEncoding.Encode(tpmKeys.PrivateKey, privateBlob)\n\tbase64.StdEncoding.Encode(tpmKeys.PublicKey, publicBlob)\n\t// Convert to JSON\n\tkeysJSON, err := json.Marshal(tpmKeys)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to marshal keys to JSON: %v\", err)\n\t}\n\t// Write the JSON to a file","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L70-L106","documentation":"Emitted on Windows during JetStream TPM key setup: the directory that should hold the persisted TPM-sealed key blobs could not be created or accessed (os.MkdirAll/open failure). Typical causes are insufficient NTFS permissions for the service account, an invalid path, or the directory being locked by another process; without it the sealed key material cannot be written.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:88 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the NATS service account has create/write permission on the parent directory (commonly under ProgramData)","Remove stale lock files or permissions overrides on the target directory","Manually create the directory with correct ACLs, then restart the server so key sealing can proceed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}