Windows Server 2016 – Container bind mount access denied on NTFS host path – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Container starts but cannot read or write mounted host directory, breaking app runtime.

Environment & Reproduction

Occurs with restrictive NTFS ACLs or identity mismatch between container user and host permissions.

docker run -v C:data:C:appdata  cmd /c dir C:appdata
icacls C:data

Root Cause Analysis

Host directory ACL does not grant required access to container process token context.

Quick Triage

Inspect mount parameters, container user, and host ACL inheritance.

docker inspect 
whoami
icacls C:data

Step-by-Step Diagnosis

Trace denied operations and compare with expected service account rights.

Get-WinEvent -LogName Security -MaxEvents 200 | ? {$_.Id -eq 4663}
icacls C:data /save C:Tempdata_acl.txt

Solution – Primary Fix

Grant explicit least-privilege ACL for container runtime identity and remount volume.

icacls C:data /grant 'Users:(OI)(CI)M'
docker restart 

Solution – Alternative Approaches

Use named volumes managed by Docker when host ACL management is too complex.

Verification & Acceptance Criteria

Application can create, read, and update files in mounted path without access errors.

Rollback Plan

Restore ACL from backup file and revert container mount strategy if side effects occur.

Prevention & Hardening

Define standard ACL templates for container host paths and validate pre-deployment.

Related Errors & Cross-Refs

Can co-occur with read-only mount flags and anti-malware file-lock contention.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: Windows container storage and host path mount permissions.