Wednesday, May 27, 2009

How to recover Hyper-V Virtual Machine manually (unsupported ways...)

One of these days I was testing one of my Hyper-Vs and because of a mistake of mine I removed all the VM associations to Hyper-V mmc console and SCVMM…

Now what!!!! I knew that the supported way to add those machines back to the Hyper-V and SCVMM was through backup/Restore or I could import them using an “previous” export, but those machines were new VMs created only for the test propose, I had no backup or export of them.

How to import them back? Ok, no panic, first thing to check is the files, are the VM files still in place? Yes!!! Ok, that means not all is lost…

Note: The GUIDs mentioned here belong to my virtual machine, in your network the GUIDs will differ.

How to recover Hyper-V Virtual Machine manually (unsupported ways...)

1 Option:
Easy enough, you create a new VM choose the option “attach a virtual hard disk latter” or “Use an existing virtual hard disk” and then map the VM to the disk used before by the other “missing” VM, of course, you can copy the disk to the new VM folder to keep all files together.

Nah….. I need the VM configuration, those configurations were critical to my tests and I don’t have the configuration paper with me. Let's try Option 2


2 Option:

First go to the “missing VM folder\virtual Machines\” and take note of the file {GUID}.xml (In this scenario is the 71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml).

Now open the Hyper-V mmc and create a new VM with the same name, and point the new VM to the same drive/folder where the “missing VM” is at.

Choose the option “attach a virtual hard disk latter” and do a next, next, thing until you finish the VM creation process.

Now go to the VM folder and under “Virtual Machines” folder you have 2 GUIds.xml, the original 71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml (that you take note in the first step) and the new (in this scenario) E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24.xml that refers to the new VM (Note: The GUIDs that you have, will differ from these).

The next step is to copy everything that is inside of the old 71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml to the new E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24.xml, yes, everything… Basically you’re replacing the contents of the new {GUID}.xml with data from the old one. Save the file with the same name in the same place replacing the existing one.

Next step, open the E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24.xml, and the replace everything that has the 71DB1869-534A-4B0B-B2B8-B89170FC0EF0 with E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24. Save the file replacing the existing one.

Next step, copy the files that are inside the “F:\VM01\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0” to “F:\VM01\Virtual Machines\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24”, you must also rename the files (.bin and .vsv) that are inside that folder to match the new GUID.

If you have snapshots, then you also need to rename some files and folders inside Snapshots folder. OpenVM01\Snapshots” folder. Rename the folder “VM01\Snapshots \71DB1869-534A-4B0B-B2B8-B89170FC0EF0” to “VM01\Snapshots\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24”. Then open the “VM01\Snapshots\{GUIDofTheSnapshot}” and rename the files inside that folder (.bin and .vsv) to match the GUID of the new VM (If you have multiple snapshots, you have to repeat the same process to each one).
Now, open “VM01\Snapshots\{GUIDofTheSnapshot}.xml” and replace the values with “71DB1869-534A-4B0B-B2B8-B89170FC0EF0” with the new VM GUID “E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24”.
(If you have multiple snapshots, you have to repeat the same process to each one).

Now is time to allow access to the Service SID access to all files in VM01, from cmdline type:

Icacls F:\VM01\ /T /grant "NT VIRTUAL MACHINE\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24":(F)

The last step is to manually create a symbolic link and grant the proper permissions to each individual snapshot that has a {GUID}.xml inside the VM01\snapshots folder (in this case there’re 2 snapshots).

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml" "F:\VM01\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml"

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml" "F:\VM01\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml"

Now give access permissions to the new VM Service SID access.

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml /grant "NT VIRTUAL MACHINE\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24":(F) /L

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml /grant "NT VIRTUAL MACHINE\E5D8FBFC-4E01-4D48-AE95-1CF1630E2C24":(F) /L

Go to the settings of the VM01 and assign the proper Network switch.
Start VM01 and you’re DONE!!!!
Are you NUTS!!!! That’s too much work for a VM recovery!!!! And if I had 20 VMs to recover, that process will take the entire month…


This method is simpler, we’ll re-assign the “missing” Symbolic links and give permissions to the Service SID.

Using Mklink, create the Symbolic link under "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines"

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml" "F:\VM01\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml"

Now give access permissions to the service SID to this Symbolic link.

Icacls "C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml" /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F) /L

Then you need to give access permissions to the Service SID to all files in VM01

Icacls F:\VM01\ /T /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F)

Since VM01 has also Snapshots, we need to create the correspondent symbolic link and give the necessary permissions to the files (This process must be done to each snapshot).

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml" "F:\VM01\Snapshots\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml"

Mklink "C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml" "F:\VM01\Snapshots\71DB1869-534A-4B0B-B2B8-B89170FC0EF0.xml"

Now, assign the permissions:

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\324E6E76-77EC-4671-9E25-3D4B5D3133BA.xml /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F) /L

Icacls C:\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\D6EC4773-75A6-49E7-84D2-3B619D1D450C.xml /grant "NT VIRTUAL MACHINE\71DB1869-534A-4B0B-B2B8-B89170FC0EF0":(F) /L

Go to the settings of the VM01 and assign the proper Network switch.
Start VM01 and you’re DONE!!!!


  1. That works a treat..fantastic! Note that if you have moved from 2008 to 2008 R2 the saved state files are incompatible so you will have to delete that before you can start the machine.

  2. This article was pure magic!! After recovering my VM I later added the snapshots back in by using MKlink. However now I am getting "'General access denied error' (0x80070005) when Starting Hyper-V Virtual Machines" . I've tried everything permissions wise no luck. There is a support article with the exact error verbiage however I do NOT have Intel motherboard. HELP??!!

  3. Please review the configurations and perform the fix to all files (vhd and snapshots) BEFORE STARTING the VM. If that doesn't help you, you may want start with Process Monitor, download it from sysinternals and check for access denied errors, check if the files are being locked out.

    Process Monitor

  4. Unfortunately when I first recovered the machine I fired it up and ran it. I, of course, began getting event log errors about the snapshots not being able to be loaded. As soon as I went through your procedure to MKLink and grant permissions they became visible in Hyper-V. The next time I turned off the physical box the VM went to saved state and I cannot restart it. There is a new .vsv file but no .bin file for that day. There are a total of 3 snapshots with corresponding .vsv, .bin, avhd and .xml files. Then there is the final day with just a .vsv and avhd. The error at start up is: "'SERVER2008' Microsoft Emulated IDE Controller (Instance ID {83F8638B-8DCA-4152-9EDA-2CA8B33039B4}): Failed to restore with Error 'General access denied error' (0x80070005). (Virtual machine ID 7D5A2A0B-C204-4C7C-B70E-6E7B2113F4A5)" and "'SERVER2008': Attachment 'g:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\SERVER2008\Snapshots\7D5A2A0B-C204-4C7C-B70E-6E7B2113F4A5\C_2008-10-24T171022_41BB4EC8-49EC-46CB-B9CE-5C06ABCAB49F.avhd' is read only. Please provide read/write access to add the attachment. Error: 'General access denied error' (0x80070005). (Virtual machine ID 7D5A2A0B-C204-4C7C-B70E-6E7B2113F4A5)" I have tried already the process monitor solution to see WHAT exactly is being denied, however, the tool is somewhat hard for a rookie to manipulate. I will again try to do a capture. THANK YOU so much for your time.

  5. This does not work on Windows Server 2008 R2. Any luck with that?. I don't know why Microsoft makes this so difficult....

  6. Coming to this late (and appreciatively) but what are the "Configurations" that you recover by messing with all the support files?

    Is it just the number of CPUs, RAM, etc. etc. bits, or is it more fundamental than that?

    I need to recover some VMs from a crashed system, and *do* have notes of how they were all set up originally, so I'm wondering what trouble I'm storing up for myself by recreating the VMs in Hyper-V and just attaching the VHD as in Option 1?



  7. Wow, what an easy process to recover a VM even though you have all the files!
    With ESX, you browse to the directory that conatins the .vmx and .vmdk files, right-click on the .vmx and 'add to inventory' and you're done.
    It should that easy with Hyper-V as well, why did MS make it such a PITA to get a VM back?
    There are many scenarios where all you have is the volume with the VM config and VHD files on it - lost server and array based replication of the volume come to mind.

  8. Thanks for this the midst of recovering from a backup of a VM. Using method 2, I have no snapshots so it shouldn't be too bad.

    My problem is I have a AVHD that somehow got created and every time I try to merge it into the VHD it corrupts the OS. What a PITA. On recovery number 3 and I'm just going to leave the AVHD alone.

  9. Thanks for this post, it's working very well with the option 3. I'm working with Windows 2008 R2

  10. Hi all,
    When i try the option 3, i cannot assign security account nt virtual machine\sid on xml symbolic link: i have the error when using xcacls telling me that security id cannot be mapped as this sid doesn't exist as a user on the server. I'm running 2K8 R2
    Thks for your help !

  11. I got it : i'm using 2K8 R2 FRENCH : "NT VIRTUAL MACHINE" must be replace by "ORDINATEUR VIRTUEL NT"
    You can see it by creating a new VM and do an xcacls file.xml

  12. We're trying to move some VM's with snapshots from a 2008 to 2008R2, but the SCVMM migration function doesn't support it. This looks promising! Thanks!

  13. Thanks dear,

    People like you save us almost all days. Else we would definatlly find our self in trouble all the time due to lack of MSDN / microsoft product documentations.

    Thanks for posting and helping..