How to troubleshoot Access Denied without guessing?

Question

I had an issue where users are getting "Access Denied" even though they shouldn't. It turned out to be related to custom code and fixed in the end, but there was a lot of guesswork involved.

Is there any way to troubleshoot Access Denied errors without guessing all the time? Surely, something somewhere throws the ThreadAbort/UnauthorizedAccessException, can I get the Stacktrace of that or get SharePoint to emit more logfiles?

I know of ways to handle it once I know where the issue is (SPSecurity), but if all I have is an Access Denied error and possibly 20 different places to look, it becomes tedious.

Answer 1

Access Denied and similar exceptions are almost always logged in the trace/ULS logs, and easy to discover.

Answer 2

When you get ThreadAbortedException, check InnerException.

EDIT: This is only helpful if you can attach a debugger, or have access to the source code and can redeploy. Just a thought :P

EDITEDIT: You should probably review the code in your custom solutions to handle all exceptions properly, too.

Answer 3

While not a definitive answer, some of the questions I ask myself when trying to diagnose issues like that are:

• What is the user trying to do when they receive the error? (ie access content, modify content etc)?
• Is the problem isolated to a specific user, or to a group of users?
• Is the problem isolated to a single site collection?
• Are there any third party apps, workflows etc installed that might modify permissions?
• Are all the site assets that are involved checked in, published etc (ie master pages, page layouts)?
• Is there anything in the ULS logs that might indicate what's going on?

If you can answer some, if not all of these questions, it can help narrow down the areas in which you need to look.