SharePoint 2013 Unable to Edit Office Web Apps files with users that are members of security groups

Symptoms
Users provided access to SharePoint through Active Directory (AD) Security Groups may not able to edit documents via the browser using Office Online (OWA) and Office Online Server without error.

In this scenario, the error from the Word App is: "Sorry, this document can't be opened for editing.”

We may find the following information after analyzing the ULS logs from the Office Web Apps Server and SharePoint Server.

From Office web apps server:

w3wp.exe (0x29F8) 0x194C Office Online WAC Hosting Interaction aiwe1 Medium Misc message from host: SyncUPA da6f9c1b-c78c-4d5f-87aa-9d6e4da8c852

w3wp.exe (0x29F8) 0x194C Office Online Word Online File Locking mg6z Unexpected AcquireLock: Unexpected error. [Error: FileUnauthorizedAccess] da6f9c1b-c78c-4d5f-87aa-9d6e4da8c852

From SharePoint:

w3wp.exe (0x1E3C) 0x2950 SharePoint Foundation WOPI ajahs Monitorable WOPI (Cobalt) - UPA Appears to be out of sync: https://sharepoint.consoto.com/sites/site1/_vti_bin/wopi.ashx/files/03b74dc367af41cbf54842f21f001be8?access_token=REDACTED&access_token_ttl=1383369291030 CALLER-[machine: WFE01, version: 15.0.4481.1000, CorrelationId: da6f9c1b-c78c-4d5f-87aa-9d6e4da8c852] da6f9c1b-c78c-4d5f-87aa-9d6e4da8c852

w3wp.exe (0x1E3C) 0x2950 SharePoint Foundation Files 9mpn High File exception:
System.UnauthorizedAccessException: Access denied.
at Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex)
at Microsoft.SharePoint.Library.SPRequest.GetFileLock(String bstrUrl, String bstrWebRelDocUrl, Int32 lockType, String lockId, Int32 minutes)
at Microsoft.SharePoint.SPFile.Lock(SPLockType lockType, String lockId, TimeSpan timeout) da6f9c1b-c78c-4d5f-87aa-9d6e4da8c852

Cause
This issue can occur if the User Profile Application (UPA) is out of sync. If a user profile and the relevant group memberships for the user are not synchronized, SharePoint Server 2013 may incorrectly deny access to a given resource.
Resolution
To resolve this issue ensure the User Profile Service Application (UPA) is properly configured and fully synchronized with user and group memberships.
More information
Plan Office Online (Used with SharePoint 2013)
http://technet.microsoft.com/en-us/library/ff431682.aspx

Configure Office Online for SharePoint 2013
http://technet.microsoft.com/en-us/library/ff431687.aspx

Configure licensing in SharePoint Server 2013
http://technet.microsoft.com/en-us/library/jj219627.aspx

Server-to-server authentication and user profiles in SharePoint Server 2013
http://technet.microsoft.com/en-us/library/jj729797.aspx

Synchronize user and group profiles in SharePoint Server 2013
http://technet.microsoft.com/en-us/library/ee721049.aspx

UPA administrator cannot change the synchronization connection settings in SharePoint Server 2013
http://support.microsoft.com/kb/2752606
wac OWA Sharepoint UPA FileUnauthorizedAccess groups OOS OWA UNC 
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 2908321 - Last Review: 04/22/2016 02:14:00 - Revision: 3.2

Microsoft Office Web Apps Server 2013, Microsoft SharePoint Server 2013, Microsoft Office Online Server

  • KB2908321
Feedback