[BUG]: Access denied on read only and deduplicated file (windows data deduplication)

[Fredatos-gh]

What happened?

A regression has been introduced by #5144, Skip removing read only attribute for Symlinks.
There is a side effects on windows volume with data deduplication enabled

The readonly flag is not removed if there's a reparse point

// Skip for Symlinks
if (!item.Attributes.HasFlag(FileAttributes.ReparsePoint)) {
    // Remove the readonly attribute.
    RemoveReadOnly(item);
}

But symbolic link is not the only usage of reparse point, the Tag value should be checked and equal to 0xa000000c (IO_REPARSE_TAG_SYMLINK).

On our build agent, a check on the "UnauthorizedAccess" idx file show a deduplication tag value 0x80000013 (IO_REPARSE_TAG_DEDUP) :

fsutil reparsepoint query E:\_w\2\r9\a\_Infocentre.CI\drop\InfocentreRepo\.git\objects\pack\pack-baf64e9a2e084be3ab701c4a97a1a34190478e67.idx
Reparse Tag Value : 0x80000013
Tag value: Microsoft

Check on symbolic link (test file):

fsutil reparsepoint query E:\Temp\Essai\SymbolicLinkFile.txt
Reparse Tag Value : 0xa000000c
Tag value: Microsoft
Tag value: Name Surrogate
Tag value: Symbolic Link

Versions

Pipeline Agent 4.264.2 / Windows Server 2022 Standard

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

Azure DevOps Server (Please specify exact version in the textbox below)

Azure DevOps Server Version (if applicable)

Azure Devops Server 2022.1

Operation system

Windows Server 2022 Standard 21H2

Version controll system

git

Relevant log output

2025-11-25T08:48:14.2865231Z Création du répertoire d’artefacts : E:\_w\2\r9\a
2025-11-25T08:48:14.4133917Z Échec de la création du répertoire d’artefact de version E:\_w\2\r9\a avec une exception Microsoft.VisualStudio.Services.Agent.Worker.Release.Artifacts.ArtifactDirectoryCreationFailedException: Échec de la création du répertoire d’artefact de version « E:\_w\2\r9\a ».
 ---> System.UnauthorizedAccessException: Access to the path 'E:\_w\2\r9\a\_Infocentre.CI\drop\InfocentreRepo\.git\objects\pack\pack-baf64e9a2e084be3ab701c4a97a1a34190478e67.idx' is denied.
   at System.IO.FileSystem.DeleteFile(String fullPath)
   at System.IO.FileInfo.Delete()
   at Microsoft.VisualStudio.Services.Agent.Util.IOUtil.<>c__DisplayClass12_0.<DeleteDirectory>b__0(FileSystemInfo item) in D:\a\_work\1\s\src\Agent.Sdk\Util\IOUtil.cs:line 159
   at System.Linq.Parallel.ForAllOperator`1.ForAllEnumerator`1.MoveNext(TInput& currentElement, Int32& currentKey)
   at System.Linq.Parallel.ForAllSpoolingTask`2.SpoolingWork()
   at System.Linq.Parallel.SpoolingTaskBase.Work()
   at System.Linq.Parallel.QueryTask.BaseWork(Object unused)
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
   --- End of inner exception stack trace ---
   at Microsoft.VisualStudio.Services.Agent.Worker.Release.ReleaseFileSystemManager.EnsureEmptyDirectory(String directoryPath, CancellationToken cancellationToken) in D:\a\_work\1\s\src\Agent.Worker\Release\ReleaseFileSystemManager.cs:line 66
   at Microsoft.VisualStudio.Services.Agent.Worker.Release.ReleaseJobExtension.<>c__DisplayClass41_0.<CreateArtifactsFolder>b__1() in D:\a\_work\1\s\src\Agent.Worker\Release\ReleaseJobExtension.cs:line 331
   at Microsoft.VisualStudio.Services.Agent.Worker.Release.RetryExecutor.Execute(Action action) in D:\a\_work\1\s\src\Agent.Worker\Release\RetryExecutor.cs:line 41. Nouvelle tentative de création du répertoire d’artefact de version.

[Fredatos-gh]

File Attributes on the deduplicated file