Good day,

Recently we been having issues with one user account specific in our environment, when the workflow assign a task to this specific user she receive the email but cannot interact with the task as it says (this site has not been shared with you).

This has been happening to this user only and all the others 1000+ are fine. To fix this issue I normally have to remove the user from the members group and re add her and then she is able to interact with the task.

I opened ULS Viewer and found errors in the log file regarding UPN and account not being found.

SPSecurityContext: Could not retrieve a valid windows identity for username 'domain\username' with UPN '[email protected]'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.FaultException1[System.ServiceModel.ExceptionDetail]: WTS0003: The caller is not authorized to access the service. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.UnauthorizedAccessException: WTS0003: The caller is not authorized to access the service.
at Microsoft.IdentityModel.WindowsTokenService.CallerSecurity.CheckCaller(WindowsIdentity callerIdentity)
at Microsoft.IdentityModel.WindowsTokenService.S4UServiceContract.PerformLogon(Func
1 logonOperation, Int32 pid)
at SyncInvokeUpnLogon(Object , Object[] , Object[] )
at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet))..

And in a separate line

No windows identity for Domain\username.

Also the Claim to Windows Token Service is started

I check AD Users and Computers and the UPN match what there, also double check the account has claim base authentication. Now every time a task comes in for this user I have to re assign permissions.

Anyone can help would be greatly appreciated.


1 Answer 1


You can check the following points to narrow down your issue:

  1. Check the task list that is associated with the workflow , whether it has unique permission for this user. Make sure the user has at least edit access to the specific task list for the workflow, and Read access to the item that's the target of the workflow.

  2. Try to assign the user permission directly to the site(not through Group), and check again.

  3. Whether the workflow is OOB SharePoint 2010 workflow or Custom workflow created in SharePoint designer? Try to switch to another method to check again.

  4. Besides, based on the log you provided, whether the 'domain\username' is the only user who encounters the access denied user?

    Sometimes, this is not necessarily an "error". Reference: SharePoint: Facts and Troubleshooting the Claims To Windows Token Service (C2WTS)

  • Hey thanks for your reply much appreciated. 1. The task list inherit from parents no unique perms 2. Tried already and no success there 3. The workflow is in 2010 mode works for all the other users just not this one but I will give that a try 4. Yes so far the only user who is experiencing the issue
    – Breau
    Aug 30, 2019 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.