Ensurepip failing with “Access is denied” error when attempting to read Windows file

Python Help
1

Python version: 3.10.11
OS Version: Windows10 22H2 19045.3208
When trying to create a virtual environment using the venv module without an administrator user, it reports the error below, when trying to execute the error command, it says “[WinError 5] Access is denied”. Anyone can give guidance?
I know using administrative commands can solve from the root, but it is tricky to promote in my team.

D:\Projects\Python>python -m venv --system-site-packages Training3 Django3_4 Flask3_2
Error: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

D:\Projects\Python>cd Training3\Scripts

D:\Projects\Python\Training3\Scripts>python -m ensurepip --upragde --default-pip
usage: python -m ensurepip [-h] [--version] [-v] [-U] [--user] [--root ROOT] [--altinstall] [--default-pip]
python -m ensurepip: error: unrecognized arguments: --upragde

D:\Projects\Python\Training3\Scripts>python -m ensurepip --upgrade --default-pip
Looking in links: c:\Users\TODD_Z~1\AppData\Local\Temp\tmpxq52alt2
ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Check the permissions.

Traceback (most recent call last):
  File "D:\Program Files\Python310\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "D:\Program Files\Python310\lib\runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "D:\Program Files\Python310\lib\ensurepip\__main__.py", line 5, in <module>
    sys.exit(ensurepip._main())
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 287, in _main
    return _bootstrap(
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 203, in _bootstrap
    return _run_pip([*args, *_PACKAGE_NAMES], additional_paths)
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 104, in _run_pip
    return subprocess.run(cmd, check=True).returncode
  File "D:\Program Files\Python310\lib\subprocess.py", line 526, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-W', 'ignore::DeprecationWarning', '-c', '\nimport runpy\nimport sys\nsys.path = [\'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpxq52alt2\\\\setuptools-65.5.0-py3-none-any.whl\', \'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpxq52alt2\\\\pip-23.0.1-py3-none-any.whl\'] + sys.path\nsys.argv[1:] = [\'install\', \'--no-cache-dir\', \'--no-index\', \'--find-links\', \'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpxq52alt2\', \'--upgrade\', \'setuptools\', \'pip\']\nrunpy.run_module("pip", run_name="__main__", alter_sys=True)\n']' returned non-zero exit status 1.
2

Why do you need to run ensurepip at all?

A version of pip is installed when you installed python on Windows.
Atleast that is what has always been the case when I install python.

3

Thanks for your reply. The error happened when creating a virtual environment, I just moved into the created folder and tried to execute the program in it again to see the root cause.

4

Using the solution in the link: Stackoverflow
With the “–without-pip” option, it is solved, but waiting for better guidance here.

5

Installing 3rd party package in the global environment without admin and without the “–user” option could cause the same error, whenever installed base with or without admin.

ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Consider using the --user option or check the permissions.

6

I have had no problem using pip in a venv on windows.

I wonder if the python you are running is the not the one from the venv?
Instead of typing python try using the full path to the python.exe in the venv.

Do you have a set of steps that reproduces the problem that we could use to reproduce what you are doing to trigger the error? Maybe write steps as the a batch script and share the script.

7

Sure, here is a reproducing step set for reference:
Prerequisites: A non-administrative Windows user.

  1. Install base with admin(unselect “using admin privileges when install py.exe” and “Add python.exe to PATH” at install, select all without “for all users” at “Optional features”, select “Install Python3.10 for all users”(it requires an Administrator account, I have one but can’t use it too often, as I got it using an implicit way), “Associate files with Python”, “Create shortcuts for installed applications” and “Precompile standard library” at “Advanced Options”).

  2. Add the program folder and its “Script” subfolder to the user’s environment variable using Registry.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Environment]
"PYTHON"="D:\\Program Files\\Python310"
"PYTHON2"="D:\\ProgramFiles\\Python2"
"WEBDRIVER"="D:\\ProgramFiles\\WebDriver"
  1. Open the user’s CMD, and switch to the folder to create a virtual environment, the error will be reported, try to execute the full path as you suggest, it will report “Access is denied”.
D:\>cd D:\Projects\Python

D:\Projects\Python>python -m venv --system-site-packages Training3
Error: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

D:\Projects\Python>D:\\Projects\\Python\\Training3\\Scripts\\python.exe -m ensurepip --upgrade --default-pip
Looking in links: c:\Users\TODD_Z~1\AppData\Local\Temp\tmpfbdq7av4
ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Check the permissions.

Traceback (most recent call last):
  File "D:\Program Files\Python310\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "D:\Program Files\Python310\lib\runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "D:\Program Files\Python310\lib\ensurepip\__main__.py", line 5, in <module>
    sys.exit(ensurepip._main())
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 287, in _main
    return _bootstrap(
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 203, in _bootstrap
    return _run_pip([*args, *_PACKAGE_NAMES], additional_paths)
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 104, in _run_pip
    return subprocess.run(cmd, check=True).returncode
  File "D:\Program Files\Python310\lib\subprocess.py", line 526, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-W', 'ignore::DeprecationWarning', '-c', '\nimport runpy\nimport sys\nsys.path = [\'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpfbdq7av4\\\\setuptools-65.5.0-py3-none-any.whl\', \'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpfbdq7av4\\\\pip-23.0.1-py3-none-any.whl\'] + sys.path\nsys.argv[1:] = [\'install\', \'--no-cache-dir\', \'--no-index\', \'--find-links\', \'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpfbdq7av4\', \'--upgrade\', \'setuptools\', \'pip\']\nrunpy.run_module("pip", run_name="__main__", alter_sys=True)\n']' returned non-zero exit status 1.
8

Why is step (2) required?

So the steps are

  1. install python 3.10 as user not system.
  2. Create a venv

I note you still type a bare python and not the path to the python.
You might not be running the python you expect.

9

Sorry for misleading you, this step doesn’t require elevated privilege.
Or maybe I have misunderstood it? As I don’t choose “Add Python to Path”, this step is required.

As the environment variable exists, I don’t want to type the path again. Maybe you want to see the following action, but looks like the same.

D:\Projects\Python>"D:\Program Files\Python310\python.exe" -m venv --system-site-packages Training3
Error: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

D:\Projects\Python>

And it’s the “Path” variable.

D:\Projects\Python>echo %Path%
C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;D:\ProgramFiles\scm-cli_1.0.1_Windows_x86_64;D:\ProgramFiles\dotnet-sdk-6.0.412-win-x64;D:\ProgramFiles\jdk-11.0.19+7\bin;D:\Program Files\Python310;D:\Program Files\Python310\Scripts;D:\ProgramFiles\Python2;D:\ProgramFiles\Python2\Scripts;D:\ProgramFiles\WebDriver;C:\Program Files\Google\Chrome\Application;C:\Users\***\.dotnet\tools
10

These keys in the registry do not change the PATH they add environment variables names PYTHON, PYTHON2 and WEBDRIVER.

You should be able to see themin the output of set command from a CMD prompt.

You can change your PATH using the settings app.
In setting I think you search on env and get to the right section.

(I not in front of a windows system to check).

11

Here is a transcript of me using a user installed python 3.10.11 on Windows 11.
Pip is working, but I did not use the --system-site-packages option. Given you
said that you do not have a system install python I’m not sure why you need that option.

I have use full paths and not relied on the PATH being setup.

: 12:57:30.76 C:\Users\barry
: \\BARNSTONE\barry> C:\Users\barry\AppData\Local\Programs\Python\Python310\python.exe
Python 3.10.11 (tags/v3.10.11:7d4cc5a, Apr  5 2023, 00:38:17) [MSC v.1929 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> ^Z


: 12:57:54.79 C:\Users\barry
: \\BARNSTONE\barry> C:\Users\barry\AppData\Local\Programs\Python\Python310\python.exe -m venv wvenv

: 12:58:21.76 C:\Users\barry
: \\BARNSTONE\barry> wvenv\Scripts\python.exe
Python 3.10.11 (tags/v3.10.11:7d4cc5a, Apr  5 2023, 00:38:17) [MSC v.1929 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> ^Z

: 13:06:00.58 C:\Users\barry
: \\BARNSTONE\barry> wvenv\Scripts\python.exe -m pip install colour-text
Collecting colour-text
  Using cached colour_text-1.0.4-py2.py3-none-any.whl (5.8 kB)
Installing collected packages: colour-text
Successfully installed colour-text-1.0.4

[notice] A new release of pip is available: 23.0.1 -> 23.2.1
[notice] To update, run: C:\Users\barry\wvenv\Scripts\python.exe -m pip install --upgrade pip

: 13:06:22.31 C:\Users\barry
: \\BARNSTONE\barry> wvenv\Scripts\python.exe -m colour_text "<>red testing wenv<>"
testing wenv

: 13:06:26.29 C:\Users\barry
: \\BARNSTONE\barry> wvenv\Scripts\python.exe
Python 3.10.11 (tags/v3.10.11:7d4cc5a, Apr  5 2023, 00:38:17) [MSC v.1929 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import colour_text
>>> colour_text
<module 'colour_text' from 'C:\\Users\\barry\\wvenv\\lib\\site-packages\\colour_text\\__init__.py'>
>>>
12

I infer that the venv can’t be “given access to the system site-packages dir”, via --system-site-packages, because such access would include write access (so as to install things with pip), and that directory would be something like D:\Program Files\Python310\lib\site-packages, i.e., somewhere inside D:\Program Files, which isn’t writable by non-admins.

… I think?

13

Is “system” in this case the user’s python 3.10 outside the venv?

There should not be any python 3.10 in Program Files as @ak88 says he does not wish to use admin privs to do the install.

14

Sure, here is a complete list of environment variables(The “Path” was rendered):

D:\Projects\Python>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\***\AppData\Roaming
CHROME=C:\Program Files\Google\Chrome\Application
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
ComSpec=C:\Windows\system32\cmd.exe
DOTNET=D:\ProgramFiles\dotnet-sdk-6.0.412-win-x64
DriverData=C:\Windows\System32\Drivers\DriverData
EFIDE_HOME=D:\Program Files (x86)\dywt\efide
EF_HOME=D:\Program Files (x86)\dywt\ef
EF_LIB_PATHS=D:\Program Files (x86)\dywt\ef\libs;D:\Program Files (x86)\dywt\ef\mylibs;D:\Program Files (x86)\dywt\efide\libs;D:\Program Files (x86)\dywt\efide\mylibs;
HOMEDRIVE=C:
HOMEPATH=\Users\***
IPG_Ver=3.6
JAVA=D:\ProgramFiles\jdk-11.0.19+7
LOCALAPPDATA=C:\Users\***\AppData\Local
LOGONSERVER=\\PKS-DC-PSHV01
NUMBER_OF_PROCESSORS=4
OneDrive=C:\Users\Administrator\OneDrive
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;D:\ProgramFiles\scm-cli_1.0.1_Windows_x86_64;D:\ProgramFiles\dotnet-sdk-6.0.412-win-x64;D:\ProgramFiles\jdk-11.0.19+7\bin;D:\Program Files\Python310;D:\Program Files\Python310\Scripts;D:\ProgramFiles\Python2;D:\ProgramFiles\Python2\Scripts;D:\ProgramFiles\WebDriver;C:\Program Files\Google\Chrome\Application;C:\Users\***\.dotnet\tools
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 78 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=4e03
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules
PUBLIC=C:\Users\Public
PYTHON=D:\Program Files\Python310
PYTHON2=D:\ProgramFiles\Python2
SCM=D:\ProgramFiles\scm-cli_1.0.1_Windows_x86_64
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\TODD_Z~1\AppData\Local\Temp
TMP=C:\Users\TODD_Z~1\AppData\Local\Temp
USERNAME=***
USERPROFILE=C:\Users\***
WEBDRIVER=D:\ProgramFiles\WebDriver
windir=C:\Windows
15

As I want to use linters and formatters globally, I will install them in base, and refer them using “–system-site-packages”.

16

Tried to create without “–system-site-packages”, but still the same.

D:\Projects\Python>python -m venv Training3
Error: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

D:\Projects\Python>D:\\Projects\\Python\\Training3\\Scripts\\python.exe -m ensurepip --upgrade --default-pip
Looking in links: c:\Users\TODD_Z~1\AppData\Local\Temp\tmpc26dnwca
ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Check the permissions.

Traceback (most recent call last):
  File "D:\Program Files\Python310\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "D:\Program Files\Python310\lib\runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "D:\Program Files\Python310\lib\ensurepip\__main__.py", line 5, in <module>
    sys.exit(ensurepip._main())
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 287, in _main
    return _bootstrap(
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 203, in _bootstrap
    return _run_pip([*args, *_PACKAGE_NAMES], additional_paths)
  File "D:\Program Files\Python310\lib\ensurepip\__init__.py", line 104, in _run_pip
    return subprocess.run(cmd, check=True).returncode
  File "D:\Program Files\Python310\lib\subprocess.py", line 526, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['D:\\Projects\\Python\\Training3\\Scripts\\python.exe', '-W', 'ignore::DeprecationWarning', '-c', '\nimport runpy\nimport sys\nsys.path = [\'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpc26dnwca\\\\setuptools-65.5.0-py3-none-any.whl\', \'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpc26dnwca\\\\pip-23.0.1-py3-none-any.whl\'] + sys.path\nsys.argv[1:] = [\'install\', \'--no-cache-dir\', \'--no-index\', \'--find-links\', \'C:\\\\Users\\\\TODD_Z~1\\\\AppData\\\\Local\\\\Temp\\\\tmpc26dnwca\', \'--upgrade\', \'setuptools\', \'pip\']\nrunpy.run_module("pip", run_name="__main__", alter_sys=True)\n']' returned non-zero exit status 1.
17

Tried to install each of the linters and formatters globally, but only “prospector” failed.

D:\Projects\Python>pip3 install -U prospector
Looking in indexes: https://mirrors.aliyun.com/pypi/simple/
Collecting prospector
  Using cached https://mirrors.aliyun.com/pypi/packages/13/3d/e016b9c2de2a24be9c5f7b85033a304419fead6e02787d46ee5368bf0fcb/prospector-1.10.2-py3-none-any.whl (77 kB)
Collecting flake8<6.0.0
  Using cached https://mirrors.aliyun.com/pypi/packages/cf/a0/b881b63a17a59d9d07f5c0cc91a29182c8e8a9aa2bde5b3b2b16519c02f4/flake8-5.0.4-py2.py3-none-any.whl (61 kB)
Collecting packaging
  Downloading https://mirrors.aliyun.com/pypi/packages/ab/c3/57f0601a2d4fe15de7a553c00adbc901425661bf048f2a22dfc500caf121/packaging-23.1-py3-none-any.whl (48 kB)
     ---------------------------------------- 48.9/48.9 kB 1.2 MB/s eta 0:00:00
Collecting pyflakes<3,>=2.2.0
  Downloading https://mirrors.aliyun.com/pypi/packages/dc/13/63178f59f74e53acc2165aee4b002619a3cfa7eeaeac989a9eb41edf364e/pyflakes-2.5.0-py2.py3-none-any.whl (66 kB)
     ---------------------------------------- 66.1/66.1 kB 901.2 kB/s eta 0:00:00
Collecting dodgy<0.3.0,>=0.2.1
  Downloading https://mirrors.aliyun.com/pypi/packages/22/f4/65b8a29adab331611259b86cf1d87a64f523fed52aba5d4bbdb2be2aed43/dodgy-0.2.1-py3-none-any.whl (5.4 kB)
Requirement already satisfied: pycodestyle>=2.9.0 in d:\program files\python310\lib\site-packages (from prospector) (2.10.0)
Collecting pylint-celery==0.3
  Using cached pylint_celery-0.3-py3-none-any.whl
ERROR: Could not install packages due to an OSError: [WinError 5] Access is denied
Consider using the `--user` option or check the permissions.
18

Tried to analyze the activity, and found the following “ACCESS DENIED” activities, anyone can explain them?

"D:\Program Files\Python310\python.exe"  "D:\Program Files\Python310\Scripts\pip3.exe" install -U prospector
RegOpenKey HKLM\System\CurrentControlSet\Services\WinSock2\Parameters Desired Access:	All Access
RegOpenKey HKCR\.264 Desired Access:	Read
19

The same thing happened when using venv:

"D:\Program Files\Python310\python.exe" -W ignore::DeprecationWarning -c "
import runpy
import sys
sys.path = ['C:\\Users\\TODD_Z~1\\AppData\\Local\\Temp\\tmpur5ozbh_\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\TODD_Z~1\\AppData\\Local\\Temp\\tmpur5ozbh_\\pip-23.0.1-py3-none-any.whl'] + sys.path
sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\TODD_Z~1\\AppData\\Local\\Temp\\tmpur5ozbh_', '--upgrade', 'setuptools', 'pip']
runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True)
"
20

Not what you intended? Also notice that the PYTHON2 is missing a space in Program Files