RE: How to audit application actions.

Hi Frank,

In .Net Winform, we should use Application.ThreadException event as the
global unhandled exception handler to catch all the exceptions in main GUI
thread. In this global unhandled exception handler,
ThreadExceptionEventArgs.Exception.StackTrace property will reveal the call
stack information of the crash exception. You may save it to the event log
or some other suitable places.

However, .Net Winform has set a default global unhandled exception for
Application.ThreadException, which will pop up an error dialog with all the
error information including the stack trace log. Please see the attached
Default_ThreadException.jpg. So, I am actually surprised to see that your
application will pop up a "Send Error To Microsoft" dialog on crash. Note:
this Application.ThreadException event can only catch the exceptions thrown
in main GUI thread. It can not catch the unhandled exceptions in the other
threads. To catch unhandled exceptions in the other threads, you should
place a big try...catch clause around the ThreadProc of other threads.

Based on the description, it seems that you have used big try...catch
clauses to catch the crash exception, but when you are trying to log it to
the disk file, it failed a second time. Because this problem only occurs
under the limited user account, I suspect the second crash during the
logging should be caused by the security issue. In .Net, there are 2 types
of security: .Net Code Access Security and Windows account security.

First, once your Winform application is launched from the local file
system, the .Net CAS will full trust your application, so the .Net CAS
should not cause any problem in this scenario. Then, the most possible
problem is the Windows security exception. Can you tell me which location
your application is trying to log? I suspect the limited user account may
not have enough write NTFS permission to that location(such as
file/directory). So when you are logging to that file, the Windows NTFS
finds you do not have pemission to write to it, and an security exception
is generated. For example, if the log file or the log directory is created
by an Administrator, then the default NTFS security setting over this
file/directory will not allow the limited user account to write to it.

If my assumption is correct, the solution is either changing the logging
location to a private folder which the limited account have write
permission or changing the NTFS security setting of the location to give
this limited user account proper write permission.

Hope this helps.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Attachment: Default_ThreadException.JPG
Description: Binary data

Relevant Pages

  • RE: "not handled in user code" dialog
    ... to handle all the unhandled exception in main Asp.net thread. ... exception you have seen is generated in a worker thread. ... Microsoft Online Community Support ...
    (microsoft.public.vsnet.debugging)
  • RE: Disable continue option when an unhandled exception occurs?
    ... application after unhandled exception is really dangerous. ... event and provide a customized unhandled exception handler for main GUI ... Microsoft Online Community Support ...
    (microsoft.public.dotnet.languages.vb)
  • RE: Cant get exception stack
    ... Server.GetLastError to obtain the original unhandled exception in ASP.NET ... Microsoft MSDN Online Support Lead ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: "not handled in user code" dialog
    ... It seems that your current concern is not unhandled exception in unknown ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.vsnet.debugging)
  • [NT] PNG (Portable Network Graphics) Deflate Heap Corruption Vulnerability (Windows)
    ... Beyond Security would like to welcome Tiscali World Online ... exception filter, overwriting the pointer to the handler with the address ... is set to the address of the unhandled exception filter hook. ...
    (Securiteam)