Access denied errors in Windows Server 2019 builds (Invoke-Cleanup.ps1)

[stefanes]

Description

We have started to see access denied errors in our Windows Server 2019 builds using your template. The failure occurs when calling the Invoke-Cleanup.ps1 script:

==> azure-arm.image: Provisioning with powershell script: C:/a/1/s/runner-images/images/windows/templates/../scripts/build/Invoke-Cleanup.ps1
    azure-arm.image: Cleanup WinSxS
    azure-arm.image:
    azure-arm.image: Deployment Image Servicing and Management tool
    azure-arm.image: Version: 10.0.17763.5830
    azure-arm.image:
    azure-arm.image: Image Version: 10.0.17763.6775
    azure-arm.image:
    azure-arm.image: [                           1.4%                           ]
    azure-arm.image: [=                          2.5%                           ]
...
    azure-arm.image: [===========================99.8%========================= ]
    azure-arm.image: [==========================100.0%==========================]
    azure-arm.image: The operation completed successfully.
==> azure-arm.image: Remove-Item : Access is denied
==> azure-arm.image: At C:\Windows\Temp\script-678e5117-d426-1c2a-ccdf-dfbea86e7202.ps1:71 char:9
    azure-arm.image: Clean up various directories
    azure-arm.image: Removing C:\Recovery
    azure-arm.image: Removing C:\Windows\logs
==> azure-arm.image: +         Remove-Item $_ -Recurse -Force -ErrorAction SilentlyContinue  ...
==> azure-arm.image: +         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
==> azure-arm.image:     + CategoryInfo          : NotSpecified: (:) [Remove-Item], UnauthorizedAccessException
==> azure-arm.image:     + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.RemoveItemCommand
==> azure-arm.image:
==> azure-arm.image: Provisioning step had errors: Running the cleanup provisioner, if present...

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 12
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Image version and build link

N/A (new image build issue)

Is it regression?

No

Expected behavior

No access denied error.

Actual behavior

The Remove-Item call throws an Access is denied error.

Repro steps

Has started to happen when we run a normal Windows Server 2019 image build.

[stefanes]

Issue goes away by changing this line:

runner-images/images/windows/scripts/build/Invoke-Cleanup.ps1

Line 34 in 6020692

Remove-Item $_ -Recurse -Force -ErrorAction SilentlyContinue | Out-Null

to:

Get-ChildItem $_ -Recurse -Force | % { Remove-Item $_ -Force -ErrorAction SilentlyContinue } | Out-Null

Please let me know if you want me to create a PR with this change.

[kishorekumar-anchala]

Hi @stefanes - We're working on it , we'll update once investigation done.

[kishorekumar-anchala]

Hi @stefanes - we're not encountering this issue with runner image, could you please confirm , if it is still persist ?

[stefanes]

I can reproduce this issue, correct. I can also reproduce it on a very minimal build (basically only installing PowerShell). With the fix described in comment #11448 (comment) above the issue goes away.

[kishorekumar-anchala]

Thanks @stefanes for confirmation, i will test it and confirm you :)