We created a separate app that calls the same API using the same P/Invoke and logged the results and had the user randomly run it whenever they felt like it.  It never failed.

I'm perplexed.

-Josh

@ZippyV: haven't been able to determine that in this specific case.  customer is locked down by group policy.

  Private Declare Function GetVolumeSerialNumber Lib "kernel32.dll" Alias "GetVolumeInformationA" (ByVal lpRootPathName As String, _
                     ByVal lpVolumeNameBuffer As String, _
                     ByVal nVolumeNameSize As Integer, _
                     ByRef lpVolumeSerialNumber As Long, _
                     ByVal lpMaximumComponentLength As Integer, _
                     ByVal lpFileSystemFlags As Integer, _
                     ByVal lpFileSystemNameBuffer As String, _
                     ByVal nFileSystemNameSize As Integer) As Long

After taking out my pencil sharpener and trying to come up with the perfect signature, we are changing to the following newer signature to see if that helps:

  <Runtime.InteropServices.DllImport("kernel32.dll", CharSet:=Runtime.InteropServices.CharSet.Unicode, ThrowOnUnmappableChar:=True, SetLastError:=True)> _
  Private Shared Function GetVolumeInformation( _
                                               ByVal lpRootPathName As System.String, _
                                               ByVal lpVolumeNameBuffer As System.Text.StringBuilder, _
                                               ByVal nVolumeNameSize As System.UInt32, _
                                               ByRef lpVolumeSerialNumber As System.UInt32, _
                                               ByRef lpMaximumComponentLength As System.UInt32, _
                                               ByRef lpFileSystemFlags As System.UInt32, _
                                               ByVal lpFileSystemNameBuffer As System.Text.StringBuilder, _
                                               ByVal nFileSystemNameSize As System.UInt32 _
                                               ) As <Runtime.InteropServices.MarshalAs(Runtime.InteropServices.UnmanagedType.Bool)> System.Boolean
  End Function

It isn't good to throw changes out just to see what sticks but the Trend Micro theory doesn't sound provable in this situation.  If you feel like something wouldn't be marshalled right with the first signature it won't hurt my circa 2005 feelings to tell me.  Same for the second signature.