WinVerifyTrust returned ERROR_NOT_ENOUGH_MEMORY under impersonate account S-1-5-82-*

Question

Hi Experts,

I am running WinVerifyTrust to verify signature of binaries. But it returned ERROR_NOT_ENOUGH_MEMORY under impersonate account S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415. While WinVerifyTrust returned success under normal user. This issue is running under ASP.NET web service project. It is managed by IIS. The C# code will invoke a C++ implemented native DLL. The DLL will create a process. At the beginning of the new process it will verify binaries' signature via WinVerifyTrust. Below attach the usage of WinVerifyTrust. Can you help to give some advice for solving this issue?

LONG lStatus = ERROR_SUCCESS;  
wchar_t errorMsg[1000];  
ZeroMemory(errorMsg, sizeof(WCHAR) * 1000);  
  
const LPCWSTR wfilename = filename.c_str();  
  
// Initialize the WINTRUST_FILE_INFO structure.  
WINTRUST_FILE_INFO fileData;  
ZeroMemory(&fileData, sizeof fileData);  
fileData.cbStruct = sizeof(WINTRUST_FILE_INFO);  
fileData.pcwszFilePath = wfilename;  
fileData.hFile = NULL;  
fileData.pgKnownSubject = NULL;  
  
/*  
WVTPolicyGUID specifies the policy to apply on the file  
WINTRUST_ACTION_GENERIC_VERIFY_V2 policy checks:  
1) The certificate used to sign the file chains up to a root  
certificate located in the trusted root certificate store. This  
implies that the identity of the publisher has been verified by  
a certification authority.  
2) In cases where user interface is displayed (which this example  
does not do), WinVerifyTrust will check for whether the  
end entity certificate is stored in the trusted publisher store,  
implying that the user trusts content from this publisher.  
3) The end entity certificate has sufficient permission to sign  
code, as indicated by the presence of a code signing EKU or no  
EKU.  
*/  
  
GUID wvtPolicyGUID = WINTRUST_ACTION_GENERIC_VERIFY_V2;  
WINTRUST_DATA winTrustData;  
  
// Initialize the WinVerifyTrust input data structure.  
  
// Default all fields to 0.  
ZeroMemory(&winTrustData, sizeof(winTrustData));  
  
winTrustData.cbStruct = sizeof(winTrustData);  
  
// Use default code signing EKU.  
winTrustData.pPolicyCallbackData = NULL;  
  
// No data to pass to SIP.  
winTrustData.pSIPClientData = NULL;  
  
// Disable WVT UI.  
winTrustData.dwUIChoice = WTD_UI_NONE;  
  
// No revocation checking.  
winTrustData.fdwRevocationChecks = WTD_REVOKE_NONE;  
  
// Verify an embedded signature on a file.  
winTrustData.dwUnionChoice = WTD_CHOICE_FILE;  
  
// Verify action.  
winTrustData.dwStateAction = WTD_STATEACTION_VERIFY;  
  
// Verification sets this value.  
winTrustData.hWVTStateData = NULL;  
  
// Not used.  
winTrustData.pwszURLReference = NULL;  
  
// This is not applicable if there is no UI because it changes  
// the UI to accommodate running applications instead of  
// installing applications.  
winTrustData.dwUIContext = 0;  
  
// Set pFile.  
winTrustData.pFile = &fileData;  
  
// WinVerifyTrust verifies signatures as specified by the GUID  
// and Wintrust_Data.  
lStatus = WinVerifyTrust(NULL, &wvtPolicyGUID, &winTrustData);  
  
// Any hWVTStateData must be released by a call with close.  
winTrustData.dwStateAction = WTD_STATEACTION_CLOSE;  
WinVerifyTrust(NULL, &wvtPolicyGUID, &winTrustData);  
  
return lStatus == ERROR_SUCCESS;  

Answer 1

There is a limitation in your IIS setting which causes the process cannot get enough memory resources. For example: Adjust memory quotas for a process
The picture is from Internet.