0

When using our WCF-service to add an attachment to a list item, files that are named with a image extension ("xxx.jpg", "xxx.png", etc) are triggering an discrete error:

w3wp.exe (0x3934)   0x1698  SharePoint Foundation   Unified Logging Service ajsqu   High    mutex creation failed. error code = 1346

Error 1346 is a Windows system error code and means Either a required impersonation level was not provided, or the provided impersonation level is invalid..

When using ProcMon I see som BAD IMPERSONATION for entries for both a request with a text file that works as expected, and for a request with an image that fails. There are slight differences though in the end:

Failed request (with an image extension in the file name)

11:37:55.9475993 AM w3wp.exe    12692   RegOpenKey  HKU\.Default    BAD IMPERSONATION   Desired Access: Maximum Allowed
11:37:56.0344555 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Cryptography\Providers    BAD IMPERSONATION   Desired Access: Read
11:37:56.0346125 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Cryptography\Providers    BAD IMPERSONATION   Desired Access: Read
11:37:56.0346808 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Cryptography\Providers    BAD IMPERSONATION   Desired Access: Read
11:37:56.1581212 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Cryptography\Providers    BAD IMPERSONATION   Desired Access: Read
11:37:56.1582325 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Cryptography\Providers    BAD IMPERSONATION   Desired Access: Read
11:37:56.1582954 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Cryptography\Providers    BAD IMPERSONATION   Desired Access: Read
11:37:56.9824610 AM w3wp.exe    12692   RegOpenKey  HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\IRMProtectors   BAD IMPERSONATION   Desired Access: Read
11:37:58.0455812 AM w3wp.exe    12692   QueryOpen   C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\BIN\OISIMG.DLL  BAD IMPERSONATION   
11:37:58.0456718 AM w3wp.exe    12692   QueryOpen   C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\BIN\OISIMG.DLL  BAD IMPERSONATION   
11:37:58.0457252 AM w3wp.exe    12692   QueryOpen   C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\BIN\OISIMG.DLL  BAD IMPERSONATION   
11:37:58.0459377 AM w3wp.exe    12692   QueryOpen   C:\Windows\System32\KernelBase.dll  BAD IMPERSONATION   
11:37:58.0462135 AM w3wp.exe    12692   QueryOpen   C:\Windows\System32\dbghelp.dll BAD IMPERSONATION   
11:37:58.0463792 AM w3wp.exe    12692   RegOpenKey  HKLM\System\CurrentControlSet\Control\Session Manager   BAD IMPERSONATION   Desired Access: Query Value, Enumerate Sub Keys
11:37:58.5275449 AM w3wp.exe    12692   QueryOpen   C:\Windows\System32 BAD IMPERSONATION   
11:37:58.5276784 AM w3wp.exe    12692   RegOpenKey  HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug   BAD IMPERSONATION   Desired Access: Query Value
11:37:58.5281365 AM w3wp.exe    12692   CreateFile  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\cffadaff\aa3d2820\profileoptimization.prof BAD IMPERSONATION   Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: 0, Impersonating: AD\SA00421
11:37:58.5290753 AM w3wp.exe    12692   CreateFile  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\e7a81998\60d7fd38\profileoptimization.prof BAD IMPERSONATION   Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: 0, Impersonating: AD\SA00421
11:38:00.2067183 AM w3wp.exe    12692   RegOpenKey  HKLM\Software\Policies  BAD IMPERSONATION   Desired Access: Read
11:38:00.2067683 AM w3wp.exe    12692   RegOpenKey  HKLM\Software   BAD IMPERSONATION   Desired Access: Read
11:38:00.2096010 AM w3wp.exe    12692   RegOpenKey  HKLM\Software\Policies  BAD IMPERSONATION   Desired Access: Read
11:38:00.2096538 AM w3wp.exe    12692   RegOpenKey  HKLM\Software   BAD IMPERSONATION   Desired Access: Read

Successful request (with a text file name)

4:35:41.5836886 PM  w3wp.exe    14500   RegOpenKey  HKU\.Default    BAD IMPERSONATION   Desired Access: Maximum Allowed
4:35:41.6093915 PM  w3wp.exe    14500   RegOpenKey  HKLM\Software\Microsoft\MSSQLServer\Client\SuperSocketNetLib    BAD IMPERSONATION   Desired Access: Read
4:35:41.6096744 PM  w3wp.exe    14500   RegOpenKey  HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32    BAD IMPERSONATION   Desired Access: Read
4:35:41.6097987 PM  w3wp.exe    14500   RegOpenKey  HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32    BAD IMPERSONATION   Desired Access: Read
4:35:41.6415277 PM  w3wp.exe    14500   RegOpenKey  HKLM\Software\Microsoft\MSSQLServer\Client\SuperSocketNetLib    BAD IMPERSONATION   Desired Access: Read
4:35:41.6621615 PM  w3wp.exe    14500   RegOpenKey  HKCR\CLSID\{BDEADF26-C265-11D0-BCED-00A0C90AB50F}\InprocServer32    BAD IMPERSONATION   Desired Access: Read
4:35:42.0190194 PM  w3wp.exe    14500   RegOpenKey  HKCR\CLSID\{BDEADF26-C265-11D0-BCED-00A0C90AB50F}\InprocServer32    BAD IMPERSONATION   Desired Access: Read

Another strange is that this has recently worked without any problems, then stopped working, then started working again just to stop working again over the timespan over some days, and I have no idea of what the variable factor could be.

Something is sometimes triggering on that the file is named as an image file and then runs some other code that crashes due to what seems to be invalid permissions. Other concurrent updates on the list item are fine, it's just the attachments that disappears. What can this be?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.