1

Windows Server 2012, running Terminal Services has a client application installed. The server part is located on another Windows Server 2012.

The client application is an old one, based on dBase.

The problem is, said application cannot create emails using extended MAPI from the client computer.

When you try to create an email; a temporary file is saved in a shared folder, located on the server host. When Outlook (or any other email-client) tries to attach the PDF the application gives the error message "An error has occured during file access". So the message originates from the application, not the email client.

So naturally, we expect this to be a permissions issue and fire up process monitor from sysinternals. Problem is. You can now send emails. The second you disable logging in procmon, you get the error message back upon your next attempt to send an email.

This works in other enviroments, Say XP/Vista/Win7 -> Server2003/2008 It only occurs with Server 2012 -> Server 2012 I suspect SMB3 being involved with this somehow.

But the question is, what actually happens when you enable logging with procmon? Because whatever procmon does - that's what I want to use as a workaround.

EDIT: Oh, also happens with Win8 -> Server2012

4
  • 1
    That's freakin' weird. – Ryan Ries May 14 '13 at 12:16
  • Things I would check: 1) Do you have any antivirus installed that may be intercepting email? 2) Do you have MAPI objects installed on the server? 3) Does Server 2012 even support MAPI? – John Homer May 14 '13 at 12:58
  • 1) No. Also, this behavior occurs in other 2012 <--> 2012 setups, in completely different enviroments. The only thing these have in common is Server 2012. 2) Simple MAPI, works fine (mailto). I'm not sure what you mean with MAPI objects, but for instance sending a page from your web browser works, which I believe is extended MAPI. Correct me if I'm wrong. Mapi keys located at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem have been checked. 3) It works with procmon enabled - so I guess it must. Also, it worked from web browsers – user2076553 May 14 '13 at 15:25
  • I know 'me too' is frowned on, but 'me too!'. I'm scanning on a Win7 box to a file share on another Win7 box. I'm wrestling with a problem where midway through it errors out saying it can't create a file, although the process has already created a number of them. I went to use procmon to troubleshoot and the thing works perfectly when I'm logging. What gives? – Peter Tirrell May 17 '13 at 16:02
0

Process Monitor uses API hooks to intercept file/registry access calls to the API. It logs them and then passes them to the API. This is also how most antivirus and rootkits work.

More info: http://www.codeproject.com/Articles/2082/API-hooking-revealed

2
  • But how would this possibly modify the behavior of the system in the way OP describes? – Ryan Ries May 14 '13 at 13:27
  • Yeah, an explanation would be nice. This stuff freaks me out. Surely there's an explanation for it, but my quest on Google has resulted in nothing so far. – user2076553 May 16 '13 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.