Callout debug: Access is Denied

I'm not sure if more people are experiencing the same thing, but at least I'd like to share this information with you.

After creating a debug build of a callout, I do copy the dll and pdb files to the \Microsoft CRM\Server\bin\assembly folder. Now I can normally debug the callout. But after modifying the code and copying the files again, then I cannot step into the code. CRM just steps over the whole callout.

When searching for a reason for this behaviour, I found a message in the event viewer. The message says:
Event Type: Error
Event Source: MSCRMCallout
Event Category: None
Event ID: 16912
Date: 6/22/2006
Time: 11:53:00 AM
User: N/A
Computer: CRMTest
Error: ISV code threw exception: assembly:
Microsoft.Crm.Sdk.FullSample.CalloutSample.dll; class:
Microsoft.Crm.Sdk.FullSample.Callouts.CalloutSample; entity: account,
event: precreate, exception: System.IO.FileLoadException: Access is
denied: 'Microsoft.Crm.Sdk.FullSample.CalloutSample.dll'.
File name: "Microsoft.Crm.Sdk.FullSample.CalloutSample.dll"
at System.Reflection.Assembly.nLoad(AssemblyName fileName, String
codeBase, Boolean isStringized, Evidence assemblySecurity, Boolean
throwOnFileNotFound, Assembly locationHint, StackCrawlMark& stackMark)
at System.Reflection.Assembly.InternalLoad(AssemblyName assemblyRef,
Boolean stringized, Evidence assemblySecurity, StackCrawlMark&
at System.Reflection.Assembly.LoadFrom(String assemblyFile, Evidence
securityEvidence, Byte[] hashValue, AssemblyHashAlgorithm
at System.Activator.CreateInstanceFrom(String assemblyFile, String
typeName, Boolean ignoreCase, BindingFlags bindingAttr, Binder binder,
Object[] args, CultureInfo culture, Object[] activationAttributes,
Evidence securityInfo)
at Microsoft.Crm.Callout.CalloutHost.PreCreate(CalloutUserContext
userContext, CalloutEntityContext entityContext, String& entityXml,
String& errorMessage)

=== Pre-bind state information ===
LOG: Where-ref bind. Location = C:\Program Files\Microsoft
CRM\server\bin\assembly\ Microsoft.Crm.Sdk.FullSample.CalloutSample.dll
LOG: Appbase = c:\windows\system32\inetsrvLOG: Initial PrivatePath = NULL
Calling assembly : (Unknown).

LOG: Policy not being applied to reference at this time (private,
custom, partial, or location-based assembly bind).
LOG: Attempting download of new URL file:///C:/Program Files/Microsoft
CRM /server/bin/assembly/ Microsoft.Crm.Sdk.FullSample.CalloutSample.dll.

For more information, see Help and Support Center at

Now how to solve this?
The resolution is quite simple. After copying the files to the assembly folder, you should give the user "Network Service" full permissions. The callout will work now and you will be able to debug the code.

Good luck!

Update: Ofcourse you can also give the user "Network Service" full rights on the bin folder of your project. You will not have to modify the file then again and again.


Anonymous said...

hi. i enjoy reading your blog!

how do you debug callouts? do you have a link / howto where it is described?

greets, cribe

Ronald Lemmen said...

Hi Cribe,

In your Visual Studio project, set the output folder to "c:\Program Files\Microsoft CRM\server\bin\assembly\". Then make a debug build of your application.

Now you need to start crm and run the code which triggers the callout. This causes the callout to be loaded into the w3wp process. You can now attach the debugger to the w3wp process via the visual studio menu (Debug -> Attach to Process).

As soon as the w3wp process which hosts the callouthost is attached to the debugger, then run the code which triggers the callout again. Ofcourse there should be a breakpoint in the code as well :)

Anonymous said...

Hello Ronald, I'm working with callouts, and I'm trying to display a warning message (open a web dialog o an alert) to the user when an exception is occured in the post-create callout. I don't know how to do it. Any suggestions?



Ronald Lemmen said...

Hi Marcos,

You cannot do that.

A post callout runs after the data has been stored. There is no connection with the user anymore and therefore you cannot send any error information to the user.

The way to do this, is to make all the checks in a pre-callout. There you should determine if all the actions you wish to do can be done. If not, then you can set an error message for the user.

Ofcourse you could write a code which sends out an email to the user who fired the callout, but thats a totally different approach.

Kind regards,


Anonymous said...

Ronald, for what you say, I figured out that if something goes wrong (like a web exception or soap exception) my callout will fail silently? The user should know that an error happened during the execution of the post create callout...

Thanks again,


Ronald Lemmen said...

Hi Marcos,

There will be an error logged in the event viewer. Your users will not be notified. Therefore you do indeed have to test and double test your callout to make sure that it always works. And in the case of an error, then catch that error and make sure that you have enough information on why the error occurred.

Kind regards

Edmundo said...

Hey Ronald,

Thanks for your post! Here we had a problem due to copying a dll over an existing one, the strange thing was the new dll did not inherit the permissions from the previous one, so the IIS could not load it when required. After reading your post, I added the permission for 'Network Service' and voilá! it works again.

losk said...

I can add that, when missing permissions for Network Services, workflow don't work too!

Anonymous said...


I know this article it's a bit old. But, well, I encounter the "Access is Denied" randomly in MS CRM 4.0.

The callout works well but sometimes and for unknown reason, it crashes. the callout is trying top open the app.config we setup in the bin folder but failed.

Here a more details about our environnement:
- MS CRM 4.0 running under a Windows Server 2008 64 bit and a SQL Server 2008 64 bit.

And my collegue failed to debug the callout with Visual Studio 2003 since VS2003 doesn't found any managed code. :/

The only solution we found was to make an IISReset. Is there any solution you can suggest ?
And, is it possible to debug a Callout in a MS CRM 4.0 ?


Ronald Lemmen said...

Hi Sam,

For all of my projects where we have installed CRM 4.0, I have upgraded all the callouts to plugins. It is usually not too much work to do and you can then follow the new coding standards for CRM 4.0. You are then also able to just debug the plug-ins as described in the SDK and on blogs.