wsl.exe fails with "Access is denied"

[john-vaudin]

After uninstalling an re-installing Windows Subsystem for Linux I can't install any distro - they all fail with "Access is denied". Even running wsl.exe now fails with "Access is denied".

Your Windows build number: (Type ver at a Windows Command Prompt)

Microsoft Windows [Version 10.0.18362.657]

Steps to reproduce

> wsl.exe
Access is denied

Strace and logs attached.

wsl_strace.txt

logs.zip

[willemdh]

I seem to ahve the same issue... Although I can start ubuntu when I open it from the store, executing wsl always results in " Access is denied".

[hv1pr0]

Same over here.

Switched from WSL 1 to WSL 2. After rebooting I got an
Access is denied. Later I found that I didn't have Windows
Version 2004, Build 19041 install but only 1909 Build 18363.720.

So I removed WSL from Windows Features, reboot, and activated
WSL again with the effect that I get an "Access is denied" in PS being
Admin but runs without Admin. However, I'm stuck now since I
can no longer use wsl.exe being Admin nor revert to any previous
state.

[AllanOricil]

I have the same problem.
I followed these steps https://docs.microsoft.com/pt-br/windows/wsl/install-win10
And got stucked in the part I had to switch to version 2.
I can't simply run wsl because windwos always say Access Denied

[juanBcn]

Same problem, any update or fix?

[juanBcn]

Fixed, modify permisions on WindowsApps folder work for me.

[gujx2017]

Fixed, modify permisions on WindowsApps folder work for me.

I have the same problem, and have't fix it yet.
Could you please to describe in detail of your operation?

[cforce]

same here. please provide a fix

[amstas]

Had the same issue when running as admin, when running without it WSL works fine. try it.

[codemonkey33]

Also got past this with WindowsApps folder permissions. You need to change the owner of this folder so you can get access to it.
Try this link (ignoring the stupid download an app version 1 of course :)
https://www.maketecheasier.com/access-windowsapps-folder-windows-10/

[richardso21]

@codemonkey33 has the solution that worked just fine for me. I still had the problem even when I had imported my ubuntu outside of the WindowsApps folder, weird...

EDIT: @rosea-tf has pinpointed the bug below. It only happens once wsl is shutdown by itself. You'll have to access wsl as admin and then you'll have access again.

[nimamahmoudi]

I have the same issue here. Is there any way we can do something similar to what @codemonkey33 is suggesting, but without the registry tweaking and only for WSL (not the whole windows apps folder)?

[nimamahmoudi]

Weird thing, I just launched Ubuntu from Windows Store, then ran wsl from cmd (running as administrator), and all of a sudden it seems like everything is working fine. Even in cmd without administrator privileges, or from Windows Terminal (which is where my issue started).

[rosea-tf]

I have the same issue on an Ubuntu installation imported from a TAR file to a custom location. I already have access to the WindowsApps folder; this doesn't help.

Running as a regular user: I get the "Access Denied" message when trying to start wsl.exe.
Running as Administrator": wsl.exe works to .start the distro running. I can then use it either as admin or as a regular user (via wsl.exe, Windows Terminal, VS Code...)
However, if the distro shuts down (e.g. via wsl.exe --shutdown), then I lose my ability to connect as a regular user, and have to run wsl.exe as admin again.

Problem seems to have appeared with Windows Update KB4565503 earlier this week.

EDIT: After uninstalling KB4565503, the problem disappears.

[richardso21]

Can confirm the specific update (KB4565503) was the issue. wsl now works perfectly and doesn't say access denied.

[nimamahmoudi]

Same here, uninstalling KB4565503 fixed the issue. Everything is back to normal.

[ojacques]

Issue #5605 has a possible "permanent" fix for the issue triggered by KB4565503.

[aslamdoctor]

Same here. Just updated Win 10 yesterday and now my WSL2 throws "Access denied" but if you run terminal as administrator and then go to wsl, it works.

[dacarey]

Just to +1 to comments by other about KB4565503 as a root cause for this

i.e. I had the same issue, with "access is denied" being returned on wsl commands. Having now uninstalled KB4565503 the problem is resolved.

[nimamahmoudi]

After uninstalling KB4565503, updates automatically install it again. Is there a permanent fix for this issue?

[rosea-tf]

After uninstalling KB4565503, updates automatically install it again. Is there a permanent fix for this issue?

Yes - grant your user account full control over the .vhdx file. See https://answers.microsoft.com/en-us/windows/forum/all/kb4565503-installed-then-wsl-2-failed-to-start/25794c4f-0b20-465e-bbdb-a8af3d9e0e88

[nimamahmoudi]

After uninstalling KB4565503, updates automatically install it again. Is there a permanent fix for this issue?

Yes - grant your user account full control over the .vhdx file. See https://answers.microsoft.com/en-us/windows/forum/all/kb4565503-installed-then-wsl-2-failed-to-start/25794c4f-0b20-465e-bbdb-a8af3d9e0e88

Thanks! It worked!

[mroma82]

After uninstalling KB4565503, updates automatically install it again. Is there a permanent fix for this issue?

Yes - grant your user account full control over the .vhdx file. See https://answers.microsoft.com/en-us/windows/forum/all/kb4565503-installed-then-wsl-2-failed-to-start/25794c4f-0b20-465e-bbdb-a8af3d9e0e88

Thank you - this worked for me!

[jwsinner]

I experienced this issue when Docker stopped unexpectedly.

PowerShell would either return that I didn't have permission (when run outside Administrator) or Access Denied (when run as Administrator. In a command prompt I was getting Access Denied when trying to run wsl, but was still able to run wsl --help.

If you are able to run wsl --help and get information back, you should be able to do the following:

1. Run wsl --list --verbose to get a list of distros
2. wsl --shutdown
3. wsl --unregister [distro name listed from step 1]

Then I had located ext4.vhdx and deleted the folders in AppData that contained this file (Mine was Docker). If you can't delete it because it says it is open in System, restart and you should be able to delete it. After it's deleted, you should have access to wsl in PowerShell and cmd and be able to reinstall the distro you deleted.

[kashif-khan]

I too have this issue but in my case, McAfee endpoint security is installed on my machine and it is blocking me to run it. In the McAfee endpoint security, the below message was posted. The windows update KB4565503 is NOT installed on my machine.

[MyUsername] ran C:\Windows\System32\wsl.exe, which attempted to access the process LxssManagerProxyStub.dll, violating the rule "Executing Windows Subsystem for Linux", and was blocked. For information about how to respond to this event, see KB85494.

I found the resolution from the below source.
Source: answers.microsoft.com

[Wolvverine]

Disable compress and encryption for this folder

%USERPROFILE%\AppData\Local\Packages{distribution_folder}

https://docs.microsoft.com/en-us/windows/wsl/install-win10

[kousu]

I had already installed Ubuntu on my machine a while ago. Today I found I could not start it:

i. Trying to click "Ubuntu" in the Start Menu would appear to not react,
ii. trying to start it from cmd.exe would exit immediately.

What did work, was to start cmd.exe or powershell.exe as Administrator and run wsl from there:

C:\Windows\system32> wsl
root@DESKTOP-XXXXX:~# uname -a
Linux DESKTOP-XXXX 4.4.0-18362-Microsoft #1049-Microsoft Thu Aug 14 12:01:00 PST 2020 x86_64 x86_64 x86_64 GNU/Linux
root@DESKTOP-XXXXX:~# logout

I tried to reinstall:

PS C:\Windows\system32> # this is in powershell
PS C:\Windows\system32> cd C:\Users\user
PS C:\Users\user> Invoke-WebRequest -Uri https://aka.ms/wsl-ubuntu-1804 -OutFile Ubuntu.appx -UseBasicParsing
PS C:\Users\user> Add-ProvisionedAppxPackage -PackagePath .\Ubuntu.appx -Online -SkipLicense

It appeared to install successfully, however I still had the same symptoms.

I tried reinstalling again, this time directly in my user account:

PS C:\Users\user> Get-AppxPackage -name CanonicalGroupLimited.Ubuntu18.04onWindows | Remove-AppxPackage
PS C:\Users\user> Add-AddxPackage .\Ubuntu1804.appx

It didn't solve it, but instead of Ubuntu crashing immediately, it told me:

PS C:\Users\user> ubuntu1804.exe
Access is denied.

(which is what brought me to this thread)

but it still works as Administrator.

@jwsinner's fix in #4920 (comment) seems to have actually fixed it fully! And done it without having to garble my system permissions or anything:

In my Administrator shell:

PS C:\Windows\system32> wsl --list --verbose
  NAME		STATE		VERSION
* Ubuntu-18.04	Running		1
PS C:\Windows\system32> wsl --shutdown
PS C:\Windows\system32> wsl --unregister Ubuntu-18.04
Unregistering...
PS C:\Windows\system32> 

Then, as my regular user, without reinstalling anything package:

PS C:\Users\user> ubuntu1804.exe
Installing, this may take a few minutes...
Please create a default UNIX user account. The username does not need to match your Windows username.
For more information visit: https://aka.ms/wslusers
Enter new UNIX username:

I'm -1 on KB4565503 being the problem. I don't have it installed:

I have Windows 10 Pro N-1909-18363.1440:

[danon]

In my case, windows permission mixed up with linux permissions, and disabled the x attribute on my folders, so I couldn't read them.

I had to do

chmod +x folder

[flaxes]

Had simillar problem. Running as administator won't help. (Access Denied)
After some manipulations, I've decided to turn off Windows Update Blocker (wub)

Now, WSL works

[FoliAGEQBS]

Use the WSL -List command to check whether the old version is completely uninstalled

[wicklander-bryant]

I ended up facing a similar issue where all I got was access denied when attempting to install any distro EXCEPT the default Ubuntu distro that is installed by default when installing wsl from the CLI. I tried every proposed solution in this thread and many others with a similar access denied error, none of them ended up working. The solution that ended up working for me was to perform a full factory reset on my PC. Obviously not the best solution, but you can always back up your data and copy it back over to your fresh install. This was a last resort as I've been facing this issue for over 3 weeks now and needed to get things working again 🤷

[Amarok24]

If anyone are facing this problem, check if you have an App called Windows Subsystem for Linux, if yes, uninstall it and you will get access to wsl2 again.

It was installed here after running wsl --update command.

Thank you!!! That's almost unbelievable, so Microsoft created a conflict between 2 different installations of WSL, one from the command line and the 2nd one from Microsoft Store which appeared automatically without my consent, and that new one was causing this error:
Error code: Wsl/Service/CreateInstance/CreateVm/E_ACCESSDENIED

BTW this is the original message from the terminal whenever I launch wsl.exe:
Windows Subsystem for Linux is now available in the Microsoft Store! You can upgrade by running 'wsl.exe --update' or by visiting https://aka.ms/wslstorepage Installing WSL from the Microsoft Store will give you the latest WSL updates, faster. For more information please visit https://aka.ms/wslstoreinfo

That's why I've run the update command and then it stopped working. BTW I use WSL2.

Update: to be able to use the new WSL version from Microsoft Store, it didn't help to uninstall the old WSL and install the new one, there were still access denied errors and also no distro could be started (Registry entries broken?), so it was necessary to create a new user in Windows and start from scratch.

[codeflorist]

If anyone are facing this problem, check if you have an App called Windows Subsystem for Linux, if yes, uninstall it and you will get access to wsl2 again.

It was installed here after running wsl --update command.

amazing. simply amazing. so wsl.exe --update takes away the possibility to use wsl.exe command line. thus for example completely breaking Docker.

how could this ever have slipped through Microsoft's quality control?! and it's been this way since at least 8 months?!

[ZackPlauche]

For anyone who might still be stuck here, this solution worked for me:

Quoting from that solution:
wsl --unregister ubuntu
followed by
wsl --install
fixes the problem for ubuntu atleast

[vncntk]

I suddenly had this problem. I have been working using an administered laptop and have been using WSL Ubuntu for work environment. Laptop went to sleep and when turned on VSCode and cmd couldn't access WSL.

[ggcannard]

@vncntk Seconding this, the exact same thing happened to me today as well. Have not found a solution yet either.

[dylancarruthers]

Same here, seemed to happen after installing the latest Windows Updates:

• 2024-08 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2 for x64 (KB5042098)
• 2024-08 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5041571)

[koleh-tech]

I have the same problem, but the only update I installed was:

• 2024-08 Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.417.101.0)

[dylancarruthers]

Fixed after running the following in PowerShell as administrator

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\windows\system32\wsl.exe"

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\WSL\wsl.exe"

[McRegt]

Same problem here, have the following updates installed recently:

• 2024-08 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5041571)
• 2024-08 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 23H2 for x64 (KB5042099)

The Windows Store also results in an exception:

Adding the Defender rules did not solve the problem for me.

[vjanssens]

Same for me, the solution provided by @dylancarruthers solved the issue when in Administrator mode. Docker Desktop also stopped working because of this and resolved that by:

1. Stopping Docker Desktop
2. Run wsl --unregister docker-desktop
3. Restart Docker Desktop

[JakeBroughton]

I have the same problem, but the only update I installed was:

* 2024-08 Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.417.101.0)

@koleh-tech Defender was the cause for us too with this rule: Block use of copied or impersonated system tools. If you can check your protection history in Defender you might see all the blocked wsl.exe actions.

[nariman-zk]

Same issue here and @dylancarruthers's solution did not solve the issue for me!

[bharthijairaman]

Having the same issue not solved for me either

[ms08067]

my wsl is broken with "access denied" and it also looks like my traditional virtual machines also fail using vbox after the last windows update. Running Windows 11 10.0.22631 N/A Build 22631

[jordanabakerafs]

This appears to be due to a windows update causing WSL.exe to trigger an attack surface reduction rule in defender for endpoint.

https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-deployment-test#step-2-understand-the-attack-surface-reduction-rules-reporting-page-in-the-microsoft-defender-portal - Your IT admins can use this report to see if wsl.exe is triggering the rule.

We confirmed this was the issue for our users after installing the latest updates pushed on 08.13.

From here we went into the intune ASR policy and set an exemption for WSL.exe (decent write up here, this is not our page - https://www.nielskok.tech/microsoft-defender-for-endpoint/add-exclusion-in-attack-surface-reduction-microsoft-defender-for-endpoint/)

We tested by running gpupdate /force on impacted devices and rebooting. After reboot, we were able to resume normal ops.

[mlcivilengineer]

Also having this issue and adding these rules to powershell in admin mode still gives me an access denied when trying to launch wsl. Any other alternatives?

[jordanabakerafs]

Also having this issue and adding these rules to powershell in admin mode still gives me an access denied when trying to launch wsl. Any other alternatives?

If you are using intune to manage these devices your intune admin will need to go into the attack surface reduction rules and exempt WSL from there then you can run a group policy update and reboot.

You may be able to look at the windows protection history and see if this is the case:

#4920 (comment)

[himanshu-gupta-ocl]

Facing this issue with docker desktop. It was working a few days ago but it just stopped working from yesterday.

No wsl command works for me in powershell Or terminal in admin mode. I get Access is denied error. I've tried reinstalling docker desktop & installing WSL latest 2.3.17 version. Nothing seems to be working. Please help

[codeflorist]

So during not even a full year, Microsoft was able to completely break Docker via WSL two times via bodged updates - creating a massive amount of wasted working hours and annoyance.
👏🏼🤡

[mlcivilengineer]

The issue regarding the Microsoft Defender has been resolved on its own apparently. I would advise everyone that was having this issue because of the Defender to update to the latest Windows version.

[wryMitts]

The issue regarding the Microsoft Defender has been resolved on its own apparently. I would advise everyone that was having this issue because of the Defender to update to the latest Windows version.

Latest monthly cumulative update or latest edition of windows (W11 24h2, etc)?

I'm on Windows 10 22H2 on the latest cumulative patch & getting this from an Attack Surface Reduction event viewer filter:

Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
 For more information please contact your IT administrator.
 	ID: C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB
 	Detection time: 2024-08-14T01:27:54.735Z
 	User: Hostname\User
 	Path: C:\Program Files\WSL\wsl.exe
 	Process Name: C:\Windows\System32\wsl.exe
 	Target Commandline: C:\Windows\system32\wsl.exe ~ -d Ubuntu 
 	Parent Commandline: C:\Windows\system32\wsl.exe ~ -d Ubuntu 
 	Involved File: 
 	Inheritance Flags: 0x00000000
 	Security intelligence Version: 1.417.101.0
 	Engine Version: 1.1.24070.3
 	Product Version: 4.18.24070.5

[Muna-Lombe]

For anyone who encountered this issue after migrating the location of the distros and images, I found that the "accessDenied" was caused becaused the current user didn't have access to the new location I migrated to. This command:
icacls <dir> /grant "<user>:(OI)(CI)(F)"
from this article definitely fixed it. Now I don't need elevated access to start wsl even after shutdown.

[gaetano-fichera]

For anyone who encountered this issue after migrating the location of the distros and images, I found that the "accessDenied" was caused becaused the current user didn't have access to the new location I migrated to. This command: icacls <dir> /grant "<user>:(OI)(CI)(F)" from this article definitely fixed it. Now I don't need elevated access to start wsl even after shutdown.

Thanks, it worked for me. I had the issue after a windows reset and starting a distro from an imported .vhdx.