Users receive intermittent forbidden errors - Event ID 1314 - Sharepoint

Hi Rob,

Are you also seeing Event IDs 7076, 6482, or 6398 in App Log (Source="Office
SharePoint Server") at about the same time as the event you have below?

--
James R. Morey [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Office SharePoint Server 2007
(http://technet2.microsoft.com/Office...1361c1033.mspx)

Windows SharePoint Services 3.0
(http://technet2.microsoft.com/window...a20531033.mspx
)

========================
"Rob M" <RobM@discussions.microsoft.com> wrote in message
news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> This one has me stumped since we were running great for months.
>
> Intermittently users are being denied access to various areas of our
> MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> setup. MOSS is running on Win2k3 R2 x64 machine with all updates applied.
> The
> only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with all
> updates applied.
>
> This happens randomly when a user tries to create new calendar item,
> upload
> a file, add to or create a new list, and if they have access, manage
> various
> permissions. It started about 3 weeks ago and now is happening constantly.
> In
> the past I was able to fix this for a couple days by performing an
> IISRESET,
> but now that is no longer working.
> Here's the strange part. Now I can temporarily fix this error if I Remote
> into the MOSS server and open the affected list/library/calendar area
> using
> our domain admin account. It opens fine without the permissions error and
> I
> then tell the user to try again. The user then has no problems for a few
> hours.
>
> I've seen a few others reporting this in various forums and newsgroups,
> but
> no one has posted a resolution. The only thing I have to work off is this
> description and the error that appears in the MOSS server's event viewer.
> (See Event at bottom) I have called MSFT support and opened a case, but
> they
> are back logged on SharePoint issues and will be calling me back in a few
> days. If I get this resolved I will follow up here at later date, but any
> immediate help would be appreciated.
>
> Thanks!
> Rob Morris
>
> -----------Event ID 1314 ------------
>
> Event Type: Information
> Event Source: ASP.NET 2.0.50727.0
> Event Category: Web Event
> Event ID: 1314
> Date: 7/25/2007
> Time: 8:16:40 AM
> User: N/A
> Computer: INTRANET
> Description:
> Event code: 4011
> Event message: An unhandled access exception has occurred.
> Event time: 7/25/2007 8:16:40 AM
> Event time (UTC): 7/25/2007 12:16:40 PM
> Event ID: b9753e79dae343eeb23914475ca46f52
> Event sequence: 57
> Event occurrence: 2
> Event detail code: 0
>
> Application information:
> Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> Trust level: WSS_Minimal
> Application Virtual Path: /
> Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> Machine name: INTRANET
>
> Process information:
> Process ID: 4432
> Process name: w3wp.exe
> Account name: EDITEDDOMAIN\mossuser
>
> Request information:
> Request URL:
> http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> Request path: /GIS/Lists/Calendar/NewForm.aspx
> User host address: 10.215.14.13
> User: EDITEDDOMAIN\EDITEDUSER
> Is authenticated: True
> Authentication Type: NTLM
> Thread account name: EDITEDDOMAIN\mossuser
>

Hi James thanks for the reply.

I went through my events and I was receiving the 7076, 6482, and 6398 Event
IDs in the past months but they stopped at about the same time the 1314
started. They only overlapped for 3 days. Now I am just receiving Event ID
1314 but no other noticeable errors.

Thanks again for the reply.

Rob







"James Morey [MSFT]" wrote:

> Hi Rob,
>
> Are you also seeing Event IDs 7076, 6482, or 6398 in App Log (Source="Office
> SharePoint Server") at about the same time as the event you have below?
>
> --
> James R. Morey [MS]
> This posting is provided "AS IS" with no warranties, and confers no rights.
> Use of included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
>
> Office SharePoint Server 2007
> (http://technet2.microsoft.com/Office...1361c1033.mspx)
>
> Windows SharePoint Services 3.0
> (http://technet2.microsoft.com/window...a20531033.mspx
> )
>
> ========================
> "Rob M" <RobM@discussions.microsoft.com> wrote in message
> news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> > This one has me stumped since we were running great for months.
> >
> > Intermittently users are being denied access to various areas of our
> > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> > setup. MOSS is running on Win2k3 R2 x64 machine with all updates applied.
> > The
> > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with all
> > updates applied.
> >
> > This happens randomly when a user tries to create new calendar item,
> > upload
> > a file, add to or create a new list, and if they have access, manage
> > various
> > permissions. It started about 3 weeks ago and now is happening constantly.
> > In
> > the past I was able to fix this for a couple days by performing an
> > IISRESET,
> > but now that is no longer working.
> > Here's the strange part. Now I can temporarily fix this error if I Remote
> > into the MOSS server and open the affected list/library/calendar area
> > using
> > our domain admin account. It opens fine without the permissions error and
> > I
> > then tell the user to try again. The user then has no problems for a few
> > hours.
> >
> > I've seen a few others reporting this in various forums and newsgroups,
> > but
> > no one has posted a resolution. The only thing I have to work off is this
> > description and the error that appears in the MOSS server's event viewer.
> > (See Event at bottom) I have called MSFT support and opened a case, but
> > they
> > are back logged on SharePoint issues and will be calling me back in a few
> > days. If I get this resolved I will follow up here at later date, but any
> > immediate help would be appreciated.
> >
> > Thanks!
> > Rob Morris
> >
> > -----------Event ID 1314 ------------
> >
> > Event Type: Information
> > Event Source: ASP.NET 2.0.50727.0
> > Event Category: Web Event
> > Event ID: 1314
> > Date: 7/25/2007
> > Time: 8:16:40 AM
> > User: N/A
> > Computer: INTRANET
> > Description:
> > Event code: 4011
> > Event message: An unhandled access exception has occurred.
> > Event time: 7/25/2007 8:16:40 AM
> > Event time (UTC): 7/25/2007 12:16:40 PM
> > Event ID: b9753e79dae343eeb23914475ca46f52
> > Event sequence: 57
> > Event occurrence: 2
> > Event detail code: 0
> >
> > Application information:
> > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> > Trust level: WSS_Minimal
> > Application Virtual Path: /
> > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> > Machine name: INTRANET
> >
> > Process information:
> > Process ID: 4432
> > Process name: w3wp.exe
> > Account name: EDITEDDOMAIN\mossuser
> >
> > Request information:
> > Request URL:
> > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> > Request path: /GIS/Lists/Calendar/NewForm.aspx
> > User host address: 10.215.14.13
> > User: EDITEDDOMAIN\EDITEDUSER
> > Is authenticated: True
> > Authentication Type: NTLM
> > Thread account name: EDITEDDOMAIN\mossuser
> >
>
>
>

Hi Rob,

The most likely cause is a bug in .NET 2.0. There is a hotfix available.
Look at KB 923028(http://support.microsoft.com/?id=923028). The association
with the other 3 events is a good indicator of this problem.

Hope this helps you.

--
James R. Morey [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Office SharePoint Server 2007
(http://technet2.microsoft.com/Office...1361c1033.mspx)

Windows SharePoint Services 3.0
(http://technet2.microsoft.com/window...a20531033.mspx
)

========================
"Rob M" <RobM@discussions.microsoft.com> wrote in message
news:1EF75468-D083-4194-8F66-0E92C093EF6B@microsoft.com...
> Hi James thanks for the reply.
>
> I went through my events and I was receiving the 7076, 6482, and 6398
> Event
> IDs in the past months but they stopped at about the same time the 1314
> started. They only overlapped for 3 days. Now I am just receiving Event ID
> 1314 but no other noticeable errors.
>
> Thanks again for the reply.
>
> Rob
>
>
>
>
>
>
>
> "James Morey [MSFT]" wrote:
>
>> Hi Rob,
>>
>> Are you also seeing Event IDs 7076, 6482, or 6398 in App Log
>> (Source="Office
>> SharePoint Server") at about the same time as the event you have below?
>>
>> --
>> James R. Morey [MS]
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> Use of included script samples are subject to the terms specified at
>> http://www.microsoft.com/info/cpyright.htm
>>
>> Office SharePoint Server 2007
>> (http://technet2.microsoft.com/Office...1361c1033.mspx)
>>
>> Windows SharePoint Services 3.0
>> (http://technet2.microsoft.com/window...a20531033.mspx
>> )
>>
>> ========================
>> "Rob M" <RobM@discussions.microsoft.com> wrote in message
>> news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
>> > This one has me stumped since we were running great for months.
>> >
>> > Intermittently users are being denied access to various areas of our
>> > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
>> > setup. MOSS is running on Win2k3 R2 x64 machine with all updates
>> > applied.
>> > The
>> > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with
>> > all
>> > updates applied.
>> >
>> > This happens randomly when a user tries to create new calendar item,
>> > upload
>> > a file, add to or create a new list, and if they have access, manage
>> > various
>> > permissions. It started about 3 weeks ago and now is happening
>> > constantly.
>> > In
>> > the past I was able to fix this for a couple days by performing an
>> > IISRESET,
>> > but now that is no longer working.
>> > Here's the strange part. Now I can temporarily fix this error if I
>> > Remote
>> > into the MOSS server and open the affected list/library/calendar area
>> > using
>> > our domain admin account. It opens fine without the permissions error
>> > and
>> > I
>> > then tell the user to try again. The user then has no problems for a
>> > few
>> > hours.
>> >
>> > I've seen a few others reporting this in various forums and newsgroups,
>> > but
>> > no one has posted a resolution. The only thing I have to work off is
>> > this
>> > description and the error that appears in the MOSS server's event
>> > viewer.
>> > (See Event at bottom) I have called MSFT support and opened a case, but
>> > they
>> > are back logged on SharePoint issues and will be calling me back in a
>> > few
>> > days. If I get this resolved I will follow up here at later date, but
>> > any
>> > immediate help would be appreciated.
>> >
>> > Thanks!
>> > Rob Morris
>> >
>> > -----------Event ID 1314 ------------
>> >
>> > Event Type: Information
>> > Event Source: ASP.NET 2.0.50727.0
>> > Event Category: Web Event
>> > Event ID: 1314
>> > Date: 7/25/2007
>> > Time: 8:16:40 AM
>> > User: N/A
>> > Computer: INTRANET
>> > Description:
>> > Event code: 4011
>> > Event message: An unhandled access exception has occurred.
>> > Event time: 7/25/2007 8:16:40 AM
>> > Event time (UTC): 7/25/2007 12:16:40 PM
>> > Event ID: b9753e79dae343eeb23914475ca46f52
>> > Event sequence: 57
>> > Event occurrence: 2
>> > Event detail code: 0
>> >
>> > Application information:
>> > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
>> > Trust level: WSS_Minimal
>> > Application Virtual Path: /
>> > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
>> > Machine name: INTRANET
>> >
>> > Process information:
>> > Process ID: 4432
>> > Process name: w3wp.exe
>> > Account name: EDITEDDOMAIN\mossuser
>> >
>> > Request information:
>> > Request URL:
>> > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
>> > Request path: /GIS/Lists/Calendar/NewForm.aspx
>> > User host address: 10.215.14.13
>> > User: EDITEDDOMAIN\EDITEDUSER
>> > Is authenticated: True
>> > Authentication Type: NTLM
>> > Thread account name: EDITEDDOMAIN\mossuser
>> >
>>
>>
>>

James, this solved my difficult-to-track-down problem as well. Thank you for
this posing !!!

"James Morey [MSFT]" wrote:

> Hi Rob,
>
> The most likely cause is a bug in .NET 2.0. There is a hotfix available.
> Look at KB 923028(http://support.microsoft.com/?id=923028). The association
> with the other 3 events is a good indicator of this problem.
>
> Hope this helps you.
>
> --
> James R. Morey [MS]
> This posting is provided "AS IS" with no warranties, and confers no rights.
> Use of included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
>
> Office SharePoint Server 2007
> (http://technet2.microsoft.com/Office...1361c1033.mspx)
>
> Windows SharePoint Services 3.0
> (http://technet2.microsoft.com/window...a20531033.mspx
> )
>
> ========================
> "Rob M" <RobM@discussions.microsoft.com> wrote in message
> news:1EF75468-D083-4194-8F66-0E92C093EF6B@microsoft.com...
> > Hi James thanks for the reply.
> >
> > I went through my events and I was receiving the 7076, 6482, and 6398
> > Event
> > IDs in the past months but they stopped at about the same time the 1314
> > started. They only overlapped for 3 days. Now I am just receiving Event ID
> > 1314 but no other noticeable errors.
> >
> > Thanks again for the reply.
> >
> > Rob
> >
> >
> >
> >
> >
> >
> >
> > "James Morey [MSFT]" wrote:
> >
> >> Hi Rob,
> >>
> >> Are you also seeing Event IDs 7076, 6482, or 6398 in App Log
> >> (Source="Office
> >> SharePoint Server") at about the same time as the event you have below?
> >>
> >> --
> >> James R. Morey [MS]
> >> This posting is provided "AS IS" with no warranties, and confers no
> >> rights.
> >> Use of included script samples are subject to the terms specified at
> >> http://www.microsoft.com/info/cpyright.htm
> >>
> >> Office SharePoint Server 2007
> >> (http://technet2.microsoft.com/Office...1361c1033.mspx)
> >>
> >> Windows SharePoint Services 3.0
> >> (http://technet2.microsoft.com/window...a20531033.mspx
> >> )
> >>
> >> ========================
> >> "Rob M" <RobM@discussions.microsoft.com> wrote in message
> >> news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> >> > This one has me stumped since we were running great for months.
> >> >
> >> > Intermittently users are being denied access to various areas of our
> >> > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> >> > setup. MOSS is running on Win2k3 R2 x64 machine with all updates
> >> > applied.
> >> > The
> >> > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with
> >> > all
> >> > updates applied.
> >> >
> >> > This happens randomly when a user tries to create new calendar item,
> >> > upload
> >> > a file, add to or create a new list, and if they have access, manage
> >> > various
> >> > permissions. It started about 3 weeks ago and now is happening
> >> > constantly.
> >> > In
> >> > the past I was able to fix this for a couple days by performing an
> >> > IISRESET,
> >> > but now that is no longer working.
> >> > Here's the strange part. Now I can temporarily fix this error if I
> >> > Remote
> >> > into the MOSS server and open the affected list/library/calendar area
> >> > using
> >> > our domain admin account. It opens fine without the permissions error
> >> > and
> >> > I
> >> > then tell the user to try again. The user then has no problems for a
> >> > few
> >> > hours.
> >> >
> >> > I've seen a few others reporting this in various forums and newsgroups,
> >> > but
> >> > no one has posted a resolution. The only thing I have to work off is
> >> > this
> >> > description and the error that appears in the MOSS server's event
> >> > viewer.
> >> > (See Event at bottom) I have called MSFT support and opened a case, but
> >> > they
> >> > are back logged on SharePoint issues and will be calling me back in a
> >> > few
> >> > days. If I get this resolved I will follow up here at later date, but
> >> > any
> >> > immediate help would be appreciated.
> >> >
> >> > Thanks!
> >> > Rob Morris
> >> >
> >> > -----------Event ID 1314 ------------
> >> >
> >> > Event Type: Information
> >> > Event Source: ASP.NET 2.0.50727.0
> >> > Event Category: Web Event
> >> > Event ID: 1314
> >> > Date: 7/25/2007
> >> > Time: 8:16:40 AM
> >> > User: N/A
> >> > Computer: INTRANET
> >> > Description:
> >> > Event code: 4011
> >> > Event message: An unhandled access exception has occurred.
> >> > Event time: 7/25/2007 8:16:40 AM
> >> > Event time (UTC): 7/25/2007 12:16:40 PM
> >> > Event ID: b9753e79dae343eeb23914475ca46f52
> >> > Event sequence: 57
> >> > Event occurrence: 2
> >> > Event detail code: 0
> >> >
> >> > Application information:
> >> > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> >> > Trust level: WSS_Minimal
> >> > Application Virtual Path: /
> >> > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> >> > Machine name: INTRANET
> >> >
> >> > Process information:
> >> > Process ID: 4432
> >> > Process name: w3wp.exe
> >> > Account name: EDITEDDOMAIN\mossuser
> >> >
> >> > Request information:
> >> > Request URL:
> >> > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> >> > Request path: /GIS/Lists/Calendar/NewForm.aspx
> >> > User host address: 10.215.14.13
> >> > User: EDITEDDOMAIN\EDITEDUSER
> >> > Is authenticated: True
> >> > Authentication Type: NTLM
> >> > Thread account name: EDITEDDOMAIN\mossuser
> >> >
> >>
> >>
> >>
>
>
>

James,
I am also having the same issue as the other gentleman. I tried to run the
Hotfix you suggested, but no luck. The issue he described above is just like
what I am experiencing. On the server that is having the issue I have MOSS,
CRM, and Project Server.

Here is a copy of the error in the event viewer:

Event Type: Information
Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event
Event ID: 1314
Date: 8/10/2007
Time: 9:03:22 AM
User: N/A
Computer: PORTAL
Description:
Event code: 4011
Event message: An unhandled access exception has occurred.
Event time: 8/10/2007 9:03:22 AM
Event time (UTC): 8/10/2007 1:03:22 PM
Event ID: a2914b985825406bb79beddbfa15089b
Event sequence: 1143
Event occurrence: 6
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1/ROOT-1-128312004784687500
Trust level: WSS_Minimal
Application Virtual Path: /
Application Path: c:\inetpub\wwwroot\
Machine name: PORTAL
Process information:
Process ID: 1612
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Request information:
Request URL: http://portal/Lists/Employee
Calendar/NewForm.aspx?Source=http://portal/default.aspx
Request path: /Lists/Employee Calendar/NewForm.aspx
User host address: 10.1.1.164
User: CONNEAUTTELEPHO\agildone
Is authenticated: True
Authentication Type: Negotiate
Thread account name: NT AUTHORITY\NETWORK SERVICE
Custom event details:


Any ideas or help on this issue would be appreciated.

Thanks,
Chris

"mr-magoo" wrote:

> James, this solved my difficult-to-track-down problem as well. Thank you for
> this posing !!!
>
> "James Morey [MSFT]" wrote:
>
> > Hi Rob,
> >
> > The most likely cause is a bug in .NET 2.0. There is a hotfix available.
> > Look at KB 923028(http://support.microsoft.com/?id=923028). The association
> > with the other 3 events is a good indicator of this problem.
> >
> > Hope this helps you.
> >
> > --
> > James R. Morey [MS]
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> > Use of included script samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> > Office SharePoint Server 2007
> > (http://technet2.microsoft.com/Office...1361c1033.mspx)
> >
> > Windows SharePoint Services 3.0
> > (http://technet2.microsoft.com/window...a20531033.mspx
> > )
> >
> > ========================
> > "Rob M" <RobM@discussions.microsoft.com> wrote in message
> > news:1EF75468-D083-4194-8F66-0E92C093EF6B@microsoft.com...
> > > Hi James thanks for the reply.
> > >
> > > I went through my events and I was receiving the 7076, 6482, and 6398
> > > Event
> > > IDs in the past months but they stopped at about the same time the 1314
> > > started. They only overlapped for 3 days. Now I am just receiving Event ID
> > > 1314 but no other noticeable errors.
> > >
> > > Thanks again for the reply.
> > >
> > > Rob
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > "James Morey [MSFT]" wrote:
> > >
> > >> Hi Rob,
> > >>
> > >> Are you also seeing Event IDs 7076, 6482, or 6398 in App Log
> > >> (Source="Office
> > >> SharePoint Server") at about the same time as the event you have below?
> > >>
> > >> --
> > >> James R. Morey [MS]
> > >> This posting is provided "AS IS" with no warranties, and confers no
> > >> rights.
> > >> Use of included script samples are subject to the terms specified at
> > >> http://www.microsoft.com/info/cpyright.htm
> > >>
> > >> Office SharePoint Server 2007
> > >> (http://technet2.microsoft.com/Office...1361c1033.mspx)
> > >>
> > >> Windows SharePoint Services 3.0
> > >> (http://technet2.microsoft.com/window...a20531033.mspx
> > >> )
> > >>
> > >> ========================
> > >> "Rob M" <RobM@discussions.microsoft.com> wrote in message
> > >> news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> > >> > This one has me stumped since we were running great for months.
> > >> >
> > >> > Intermittently users are being denied access to various areas of our
> > >> > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> > >> > setup. MOSS is running on Win2k3 R2 x64 machine with all updates
> > >> > applied.
> > >> > The
> > >> > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with
> > >> > all
> > >> > updates applied.
> > >> >
> > >> > This happens randomly when a user tries to create new calendar item,
> > >> > upload
> > >> > a file, add to or create a new list, and if they have access, manage
> > >> > various
> > >> > permissions. It started about 3 weeks ago and now is happening
> > >> > constantly.
> > >> > In
> > >> > the past I was able to fix this for a couple days by performing an
> > >> > IISRESET,
> > >> > but now that is no longer working.
> > >> > Here's the strange part. Now I can temporarily fix this error if I
> > >> > Remote
> > >> > into the MOSS server and open the affected list/library/calendar area
> > >> > using
> > >> > our domain admin account. It opens fine without the permissions error
> > >> > and
> > >> > I
> > >> > then tell the user to try again. The user then has no problems for a
> > >> > few
> > >> > hours.
> > >> >
> > >> > I've seen a few others reporting this in various forums and newsgroups,
> > >> > but
> > >> > no one has posted a resolution. The only thing I have to work off is
> > >> > this
> > >> > description and the error that appears in the MOSS server's event
> > >> > viewer.
> > >> > (See Event at bottom) I have called MSFT support and opened a case, but
> > >> > they
> > >> > are back logged on SharePoint issues and will be calling me back in a
> > >> > few
> > >> > days. If I get this resolved I will follow up here at later date, but
> > >> > any
> > >> > immediate help would be appreciated.
> > >> >
> > >> > Thanks!
> > >> > Rob Morris
> > >> >
> > >> > -----------Event ID 1314 ------------
> > >> >
> > >> > Event Type: Information
> > >> > Event Source: ASP.NET 2.0.50727.0
> > >> > Event Category: Web Event
> > >> > Event ID: 1314
> > >> > Date: 7/25/2007
> > >> > Time: 8:16:40 AM
> > >> > User: N/A
> > >> > Computer: INTRANET
> > >> > Description:
> > >> > Event code: 4011
> > >> > Event message: An unhandled access exception has occurred.
> > >> > Event time: 7/25/2007 8:16:40 AM
> > >> > Event time (UTC): 7/25/2007 12:16:40 PM
> > >> > Event ID: b9753e79dae343eeb23914475ca46f52
> > >> > Event sequence: 57
> > >> > Event occurrence: 2
> > >> > Event detail code: 0
> > >> >
> > >> > Application information:
> > >> > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> > >> > Trust level: WSS_Minimal
> > >> > Application Virtual Path: /
> > >> > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> > >> > Machine name: INTRANET
> > >> >
> > >> > Process information:
> > >> > Process ID: 4432
> > >> > Process name: w3wp.exe
> > >> > Account name: EDITEDDOMAIN\mossuser
> > >> >
> > >> > Request information:
> > >> > Request URL:
> > >> > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> > >> > Request path: /GIS/Lists/Calendar/NewForm.aspx
> > >> > User host address: 10.215.14.13
> > >> > User: EDITEDDOMAIN\EDITEDUSER
> > >> > Is authenticated: True
> > >> > Authentication Type: NTLM
> > >> > Thread account name: EDITEDDOMAIN\mossuser
> > >> >
> > >>
> > >>
> > >>
> >
> >
> >

.... and I spoke too soon. The intermittency of this problem had my optimism
ahead of me. I have the same symptoms as described in this thread, and the
hotfix from KB 923028 did not solve the problem. Any help or pointers to
further diagnostic procedures would be greatly appreciated.


"mr-magoo" wrote:

> James, this solved my difficult-to-track-down problem as well. Thank you for
> this posing !!!
>
> "James Morey [MSFT]" wrote:
>
> > Hi Rob,
> >
> > The most likely cause is a bug in .NET 2.0. There is a hotfix available.
> > Look at KB 923028(http://support.microsoft.com/?id=923028). The association
> > with the other 3 events is a good indicator of this problem.
> >
> > Hope this helps you.
> >
> > --
> > James R. Morey [MS]
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> > Use of included script samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> > Office SharePoint Server 2007
> > (http://technet2.microsoft.com/Office...1361c1033.mspx)
> >
> > Windows SharePoint Services 3.0
> > (http://technet2.microsoft.com/window...a20531033.mspx
> > )
> >
> > ========================
> > "Rob M" <RobM@discussions.microsoft.com> wrote in message
> > news:1EF75468-D083-4194-8F66-0E92C093EF6B@microsoft.com...
> > > Hi James thanks for the reply.
> > >
> > > I went through my events and I was receiving the 7076, 6482, and 6398
> > > Event
> > > IDs in the past months but they stopped at about the same time the 1314
> > > started. They only overlapped for 3 days. Now I am just receiving Event ID
> > > 1314 but no other noticeable errors.
> > >
> > > Thanks again for the reply.
> > >
> > > Rob
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > "James Morey [MSFT]" wrote:
> > >
> > >> Hi Rob,
> > >>
> > >> Are you also seeing Event IDs 7076, 6482, or 6398 in App Log
> > >> (Source="Office
> > >> SharePoint Server") at about the same time as the event you have below?
> > >>
> > >> --
> > >> James R. Morey [MS]
> > >> This posting is provided "AS IS" with no warranties, and confers no
> > >> rights.
> > >> Use of included script samples are subject to the terms specified at
> > >> http://www.microsoft.com/info/cpyright.htm
> > >>
> > >> Office SharePoint Server 2007
> > >> (http://technet2.microsoft.com/Office...1361c1033.mspx)
> > >>
> > >> Windows SharePoint Services 3.0
> > >> (http://technet2.microsoft.com/window...a20531033.mspx
> > >> )
> > >>
> > >> ========================
> > >> "Rob M" <RobM@discussions.microsoft.com> wrote in message
> > >> news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> > >> > This one has me stumped since we were running great for months.
> > >> >
> > >> > Intermittently users are being denied access to various areas of our
> > >> > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> > >> > setup. MOSS is running on Win2k3 R2 x64 machine with all updates
> > >> > applied.
> > >> > The
> > >> > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with
> > >> > all
> > >> > updates applied.
> > >> >
> > >> > This happens randomly when a user tries to create new calendar item,
> > >> > upload
> > >> > a file, add to or create a new list, and if they have access, manage
> > >> > various
> > >> > permissions. It started about 3 weeks ago and now is happening
> > >> > constantly.
> > >> > In
> > >> > the past I was able to fix this for a couple days by performing an
> > >> > IISRESET,
> > >> > but now that is no longer working.
> > >> > Here's the strange part. Now I can temporarily fix this error if I
> > >> > Remote
> > >> > into the MOSS server and open the affected list/library/calendar area
> > >> > using
> > >> > our domain admin account. It opens fine without the permissions error
> > >> > and
> > >> > I
> > >> > then tell the user to try again. The user then has no problems for a
> > >> > few
> > >> > hours.
> > >> >
> > >> > I've seen a few others reporting this in various forums and newsgroups,
> > >> > but
> > >> > no one has posted a resolution. The only thing I have to work off is
> > >> > this
> > >> > description and the error that appears in the MOSS server's event
> > >> > viewer.
> > >> > (See Event at bottom) I have called MSFT support and opened a case, but
> > >> > they
> > >> > are back logged on SharePoint issues and will be calling me back in a
> > >> > few
> > >> > days. If I get this resolved I will follow up here at later date, but
> > >> > any
> > >> > immediate help would be appreciated.
> > >> >
> > >> > Thanks!
> > >> > Rob Morris
> > >> >
> > >> > -----------Event ID 1314 ------------
> > >> >
> > >> > Event Type: Information
> > >> > Event Source: ASP.NET 2.0.50727.0
> > >> > Event Category: Web Event
> > >> > Event ID: 1314
> > >> > Date: 7/25/2007
> > >> > Time: 8:16:40 AM
> > >> > User: N/A
> > >> > Computer: INTRANET
> > >> > Description:
> > >> > Event code: 4011
> > >> > Event message: An unhandled access exception has occurred.
> > >> > Event time: 7/25/2007 8:16:40 AM
> > >> > Event time (UTC): 7/25/2007 12:16:40 PM
> > >> > Event ID: b9753e79dae343eeb23914475ca46f52
> > >> > Event sequence: 57
> > >> > Event occurrence: 2
> > >> > Event detail code: 0
> > >> >
> > >> > Application information:
> > >> > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> > >> > Trust level: WSS_Minimal
> > >> > Application Virtual Path: /
> > >> > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> > >> > Machine name: INTRANET
> > >> >
> > >> > Process information:
> > >> > Process ID: 4432
> > >> > Process name: w3wp.exe
> > >> > Account name: EDITEDDOMAIN\mossuser
> > >> >
> > >> > Request information:
> > >> > Request URL:
> > >> > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> > >> > Request path: /GIS/Lists/Calendar/NewForm.aspx
> > >> > User host address: 10.215.14.13
> > >> > User: EDITEDDOMAIN\EDITEDUSER
> > >> > Is authenticated: True
> > >> > Authentication Type: NTLM
> > >> > Thread account name: EDITEDDOMAIN\mossuser
> > >> >
> > >>
> > >>
> > >>
> >
> >
> >

Check out kb article 936867. (http://support.microsoft.com/kb/936867) The
description/explanation/documentation doesn't mention it fixing this problem
at all.

But it appears to.

Ta
James Finley

"Rob M" <RobM@discussions.microsoft.com> wrote in message
news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> This one has me stumped since we were running great for months.
>
> Intermittently users are being denied access to various areas of our
> MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> setup. MOSS is running on Win2k3 R2 x64 machine with all updates applied.
> The
> only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with all
> updates applied.
>
> This happens randomly when a user tries to create new calendar item,
> upload
> a file, add to or create a new list, and if they have access, manage
> various
> permissions. It started about 3 weeks ago and now is happening constantly.
> In
> the past I was able to fix this for a couple days by performing an
> IISRESET,
> but now that is no longer working.
> Here's the strange part. Now I can temporarily fix this error if I Remote
> into the MOSS server and open the affected list/library/calendar area
> using
> our domain admin account. It opens fine without the permissions error and
> I
> then tell the user to try again. The user then has no problems for a few
> hours.
>
> I've seen a few others reporting this in various forums and newsgroups,
> but
> no one has posted a resolution. The only thing I have to work off is this
> description and the error that appears in the MOSS server's event viewer.
> (See Event at bottom) I have called MSFT support and opened a case, but
> they
> are back logged on SharePoint issues and will be calling me back in a few
> days. If I get this resolved I will follow up here at later date, but any
> immediate help would be appreciated.
>
> Thanks!
> Rob Morris
>
> -----------Event ID 1314 ------------
>
> Event Type: Information
> Event Source: ASP.NET 2.0.50727.0
> Event Category: Web Event
> Event ID: 1314
> Date: 7/25/2007
> Time: 8:16:40 AM
> User: N/A
> Computer: INTRANET
> Description:
> Event code: 4011
> Event message: An unhandled access exception has occurred.
> Event time: 7/25/2007 8:16:40 AM
> Event time (UTC): 7/25/2007 12:16:40 PM
> Event ID: b9753e79dae343eeb23914475ca46f52
> Event sequence: 57
> Event occurrence: 2
> Event detail code: 0
>
> Application information:
> Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> Trust level: WSS_Minimal
> Application Virtual Path: /
> Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> Machine name: INTRANET
>
> Process information:
> Process ID: 4432
> Process name: w3wp.exe
> Account name: EDITEDDOMAIN\mossuser
>
> Request information:
> Request URL:
> http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> Request path: /GIS/Lists/Calendar/NewForm.aspx
> User host address: 10.215.14.13
> User: EDITEDDOMAIN\EDITEDUSER
> Is authenticated: True
> Authentication Type: NTLM
> Thread account name: EDITEDDOMAIN\mossuser
>

I wish I could try it. This hotfix is not generally available, and we don't
have premier support or a TAM.

This thread and my issue with Sharepoint seems highly related to a thread on
TechNet, where suggestion was made that the issue is sidestepped by setting
<identity impersonate="false" /> in web.config. This dis stop the
intermittent 403 forbidden errors, however it breaks the search feature, and
notifications, and probably other things as well.

I'm having trouble getting the technet posting to come up, but you can see
it in google's cache:
http://64.233.169.104/search?q=cache...lnk&cd=1&gl=us

posting is:
http://forums.microsoft.com/MSDN/Sho...74453&SiteID=1



"James Finley" wrote:

> Check out kb article 936867. (http://support.microsoft.com/kb/936867) The
> description/explanation/documentation doesn't mention it fixing this problem
> at all.
>
> But it appears to.
>
> Ta
> James Finley
>
> "Rob M" <RobM@discussions.microsoft.com> wrote in message
> news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> > This one has me stumped since we were running great for months.
> >
> > Intermittently users are being denied access to various areas of our
> > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> > setup. MOSS is running on Win2k3 R2 x64 machine with all updates applied.
> > The
> > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with all
> > updates applied.
> >
> > This happens randomly when a user tries to create new calendar item,
> > upload
> > a file, add to or create a new list, and if they have access, manage
> > various
> > permissions. It started about 3 weeks ago and now is happening constantly.
> > In
> > the past I was able to fix this for a couple days by performing an
> > IISRESET,
> > but now that is no longer working.
> > Here's the strange part. Now I can temporarily fix this error if I Remote
> > into the MOSS server and open the affected list/library/calendar area
> > using
> > our domain admin account. It opens fine without the permissions error and
> > I
> > then tell the user to try again. The user then has no problems for a few
> > hours.
> >
> > I've seen a few others reporting this in various forums and newsgroups,
> > but
> > no one has posted a resolution. The only thing I have to work off is this
> > description and the error that appears in the MOSS server's event viewer.
> > (See Event at bottom) I have called MSFT support and opened a case, but
> > they
> > are back logged on SharePoint issues and will be calling me back in a few
> > days. If I get this resolved I will follow up here at later date, but any
> > immediate help would be appreciated.
> >
> > Thanks!
> > Rob Morris
> >
> > -----------Event ID 1314 ------------
> >
> > Event Type: Information
> > Event Source: ASP.NET 2.0.50727.0
> > Event Category: Web Event
> > Event ID: 1314
> > Date: 7/25/2007
> > Time: 8:16:40 AM
> > User: N/A
> > Computer: INTRANET
> > Description:
> > Event code: 4011
> > Event message: An unhandled access exception has occurred.
> > Event time: 7/25/2007 8:16:40 AM
> > Event time (UTC): 7/25/2007 12:16:40 PM
> > Event ID: b9753e79dae343eeb23914475ca46f52
> > Event sequence: 57
> > Event occurrence: 2
> > Event detail code: 0
> >
> > Application information:
> > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> > Trust level: WSS_Minimal
> > Application Virtual Path: /
> > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> > Machine name: INTRANET
> >
> > Process information:
> > Process ID: 4432
> > Process name: w3wp.exe
> > Account name: EDITEDDOMAIN\mossuser
> >
> > Request information:
> > Request URL:
> > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> > Request path: /GIS/Lists/Calendar/NewForm.aspx
> > User host address: 10.215.14.13
> > User: EDITEDDOMAIN\EDITEDUSER
> > Is authenticated: True
> > Authentication Type: NTLM
> > Thread account name: EDITEDDOMAIN\mossuser
> >
>
>

correct link to the technet posting I believe is related to this thread:
http://forums.microsoft.com/TechNet/...4453&SiteID=17

I'm still seeking a solution to this problem, as I'm sure everyone else is.



"mr-magoo" wrote:

> I wish I could try it. This hotfix is not generally available, and we don't
> have premier support or a TAM.
>
> This thread and my issue with Sharepoint seems highly related to a thread on
> TechNet, where suggestion was made that the issue is sidestepped by setting
> <identity impersonate="false" /> in web.config. This dis stop the
> intermittent 403 forbidden errors, however it breaks the search feature, and
> notifications, and probably other things as well.
>
> I'm having trouble getting the technet posting to come up, but you can see
> it in google's cache:
> http://64.233.169.104/search?q=cache...lnk&cd=1&gl=us
>
> posting is:
> http://forums.microsoft.com/MSDN/Sho...74453&SiteID=1
>
>
>
> "James Finley" wrote:
>
> > Check out kb article 936867. (http://support.microsoft.com/kb/936867) The
> > description/explanation/documentation doesn't mention it fixing this problem
> > at all.
> >
> > But it appears to.
> >
> > Ta
> > James Finley
> >
> > "Rob M" <RobM@discussions.microsoft.com> wrote in message
> > news:869B8EB9-924A-49F4-9017-345BA55D7524@microsoft.com...
> > > This one has me stumped since we were running great for months.
> > >
> > > Intermittently users are being denied access to various areas of our
> > > MOSS/SharePoint 2007 site. This was a clean install and is a very basic
> > > setup. MOSS is running on Win2k3 R2 x64 machine with all updates applied.
> > > The
> > > only other machine in the farm is an SQL2005 Win2k3 R2 x64 server with all
> > > updates applied.
> > >
> > > This happens randomly when a user tries to create new calendar item,
> > > upload
> > > a file, add to or create a new list, and if they have access, manage
> > > various
> > > permissions. It started about 3 weeks ago and now is happening constantly.
> > > In
> > > the past I was able to fix this for a couple days by performing an
> > > IISRESET,
> > > but now that is no longer working.
> > > Here's the strange part. Now I can temporarily fix this error if I Remote
> > > into the MOSS server and open the affected list/library/calendar area
> > > using
> > > our domain admin account. It opens fine without the permissions error and
> > > I
> > > then tell the user to try again. The user then has no problems for a few
> > > hours.
> > >
> > > I've seen a few others reporting this in various forums and newsgroups,
> > > but
> > > no one has posted a resolution. The only thing I have to work off is this
> > > description and the error that appears in the MOSS server's event viewer.
> > > (See Event at bottom) I have called MSFT support and opened a case, but
> > > they
> > > are back logged on SharePoint issues and will be calling me back in a few
> > > days. If I get this resolved I will follow up here at later date, but any
> > > immediate help would be appreciated.
> > >
> > > Thanks!
> > > Rob Morris
> > >
> > > -----------Event ID 1314 ------------
> > >
> > > Event Type: Information
> > > Event Source: ASP.NET 2.0.50727.0
> > > Event Category: Web Event
> > > Event ID: 1314
> > > Date: 7/25/2007
> > > Time: 8:16:40 AM
> > > User: N/A
> > > Computer: INTRANET
> > > Description:
> > > Event code: 4011
> > > Event message: An unhandled access exception has occurred.
> > > Event time: 7/25/2007 8:16:40 AM
> > > Event time (UTC): 7/25/2007 12:16:40 PM
> > > Event ID: b9753e79dae343eeb23914475ca46f52
> > > Event sequence: 57
> > > Event occurrence: 2
> > > Event detail code: 0
> > >
> > > Application information:
> > > Application domain: /LM/W3SVC/1739125262/Root-1-128298391918795347
> > > Trust level: WSS_Minimal
> > > Application Virtual Path: /
> > > Application Path: D:\WEBSITES\EandO.EDITEDDOMAIN.COM\
> > > Machine name: INTRANET
> > >
> > > Process information:
> > > Process ID: 4432
> > > Process name: w3wp.exe
> > > Account name: EDITEDDOMAIN\mossuser
> > >
> > > Request information:
> > > Request URL:
> > > http://eando.EDITEDDOMAIN.com/GIS/Li...ndarPeriod=Day
> > > Request path: /GIS/Lists/Calendar/NewForm.aspx
> > > User host address: 10.215.14.13
> > > User: EDITEDDOMAIN\EDITEDUSER
> > > Is authenticated: True
> > > Authentication Type: NTLM
> > > Thread account name: EDITEDDOMAIN\mossuser
> > >
> >
> >