Hyper-V VM Network 'Access Denied' Error: Solutions

What the Error Code Means

The "Access Denied" error in a Hyper-V virtual machine (VM) network occurs when the guest OS cannot obtain an IP address, connect to the internet, or see other devices on the network. The full system error text often includes the code 0x80070005. The problem arises on the first VM launch after creation or after changes to the host's network. The diagnostic screen in the guest OS may show "Network access denied" or "Failed to obtain an IP address".

Causes

The error is caused by security restrictions and configuration conflicts:

1. Hyper-V's default isolation. Virtual machines in "External" mode use a virtual switch that, by policy, blocks direct access to the physical adapter to prevent attacks.
2. Firewall/antivirus policy conflicts. Third-party antiviruses (Kaspersky, Avast, etc.) or the Windows Firewall may block traffic for the vEthernet virtual switch.
3. Corrupted or misconfigured virtual switch. After a Windows update or power failure, the switch configuration may become invalid.
4. Insufficient permissions for the Hyper-V account. The Hyper-V system service (vmms) lacks sufficient rights to manage network adapters (often after manual registry editing).

Solutions

Method 1: Switch Network Adapter to NAT Mode (Fastest)

NAT (Network Address Translation) mode provides the VM with internet access through the host's primary adapter, bypassing isolation issues.

1. Open Hyper-V Manager (Win+R → virtmgmt.msc).
2. In the VM list, select the problematic VM, right-click → Settings.
3. In the left pane, go to Network Adapter.
4. In the Virtual Switch section, select the switch labeled NAT from the list (if none exists, create one via Virtual Switch Manager → Create Virtual Switch → Internal type).
5. Click OK and restart the virtual machine.
6. In the guest OS, run ipconfig /release and ipconfig /renew to obtain a new IP.

💡 Tip: A NAT switch usually automatically creates a 192.168.x.x subnet. Ensure DHCP is enabled in the host's adapter settings (in Hyper-V Virtual Ethernet Adapter).

Method 2: Delete and Recreate the Virtual Switch

If the problem is a corrupted switch, it must be completely removed and recreated.

1. In Hyper-V Manager, click Actions (on the right) → Virtual Switch Manager.
2. Select the problematic switch (e.g., External) and click Remove.
3. Click Create Virtual Switch.
4. Select the type:
   • External — for direct access to the physical network (requires admin rights).
   • Internal — for communication only between VMs and the host (no internet).
   • Private — only between VMs.
5. Specify the physical network adapter (for External type).
6. Click OK, wait for application.
7. Return to the VM's settings and bind the network adapter to the new switch.
8. Restart the VM.

Method 3: Configure Isolation Policy via PowerShell (Advanced)

For advanced users: allow the hypervisor to manage network adapter teaming, which lifts certain restrictions.

1. Launch PowerShell as Administrator.
2. Run the command, substituting your VM's name:

Set-VMNetworkAdapter -VMName "YourVMName" -AllowTeaming On

3. You can also reset the adapter settings:

Remove-VMNetworkAdapter -VMName "YourVMName" -Name "Network Adapter"
Add-VMNetworkAdapter -VMName "YourVMName" -SwitchName "SwitchName"

4. Restart the VM.

Method 4: Manual Registry Permissions Fix (Last Resort)

If the error is caused by insufficient permissions for the Hyper-V service, you must manually grant permissions.

1. Press Win+R, type regedit, confirm UAC.
2. Navigate to the key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization
   

3. Right-click the Virtualization folder → Permissions....
4. Click Add, enter SYSTEM and LOCAL SERVICE.
5. For each of these accounts, check Full Control.
6. Click Apply and OK.
7. Restart the computer (the host, not just the VM).
8. Start the VM and check the network.

⚠️ Important: Be careful when editing the registry. Export the key (File → Export) before making changes.

Prevention

To avoid the error recurring:

1. Use NAT mode for most VMs unless direct connection to the local network is required.
2. Regularly update Windows — updates often contain fixes for Hyper-V.
3. Avoid installing multiple antiviruses simultaneously. If using a third-party one, add exclusions for the folders C:\ProgramData\Microsoft\Windows\Hyper-V and C:\Windows\System32\vmms.exe.
4. Do not disable the Hyper-V Virtual Machine Management (vmms) service — it is critical for network operation.
5. After major Windows updates, recreate virtual switches if problems arise.

# Command to quickly check the status of VM network adapters
Get-VMNetworkAdapter -VMName "VMName" | Format-List Name, SwitchName, AllowTeaming