Drifter88zxtW
asked on
w3wp.exe crashing, changed pool identity to Local System, no crash, changed back to Network Service, no crash, why?
IIS 6.0 is being ran on a Windows Server 2003 Domain Controller machine. A problem was sent my way to fix. The problem is as follows.
The w3wp.exe worker process would crash after a machine reboot. I reproduced the error (see below) 6 times. I then changed the Identity of the default application pool to Local_System from Network_Service. I then rebooted. The error did not appear. I reboot about 5 times and there was still no error appearing visually or in the event log. I then set the application pool identity back to Network_Service and rebooted. However, the error did not appear. I rebooted another 5 times and the error would still not occur, and I can't get it to reoccur. What I am wondering is did the application pool need higher privliges to do something it only had to do once? And since it was able to do it once when I gave it higher privliged identity setting it back down would not have reproduced the error? Is anyone aware of anything that it may have only had to do once?
Beyond just that, any ideas on why the described events occured the way they did?
Lastly, once the error occured it did not keep reoccuring during the same session, meaning I had no problem starting ASP.NET web applications or ASP apps, and they all ran fine. This error only occured on startup.
Oh, and at the moment I do not have the ability to install IIS Diags or IIS State.
Any ideas / help would be appreciated.
The following is the generic crash error logged in the Application Event Log:
Event Type:Information
Event Source:Application Error
Event Category:(100)
Event ID:1004
Date:3/29/2007
Time:9:09:55 AM
User:N/A
Computer:ROUGE
Description:
Reporting queued error: faulting application w3wp.exe, version 6.0.3790.1830, faulting module unknown, version 0.0.0.0, fault address 0x001f0001.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
The w3wp.exe worker process would crash after a machine reboot. I reproduced the error (see below) 6 times. I then changed the Identity of the default application pool to Local_System from Network_Service. I then rebooted. The error did not appear. I reboot about 5 times and there was still no error appearing visually or in the event log. I then set the application pool identity back to Network_Service and rebooted. However, the error did not appear. I rebooted another 5 times and the error would still not occur, and I can't get it to reoccur. What I am wondering is did the application pool need higher privliges to do something it only had to do once? And since it was able to do it once when I gave it higher privliged identity setting it back down would not have reproduced the error? Is anyone aware of anything that it may have only had to do once?
Beyond just that, any ideas on why the described events occured the way they did?
Lastly, once the error occured it did not keep reoccuring during the same session, meaning I had no problem starting ASP.NET web applications or ASP apps, and they all ran fine. This error only occured on startup.
Oh, and at the moment I do not have the ability to install IIS Diags or IIS State.
Any ideas / help would be appreciated.
The following is the generic crash error logged in the Application Event Log:
Event Type:Information
Event Source:Application Error
Event Category:(100)
Event ID:1004
Date:3/29/2007
Time:9:09:55 AM
User:N/A
Computer:ROUGE
Description:
Reporting queued error: faulting application w3wp.exe, version 6.0.3790.1830, faulting module unknown, version 0.0.0.0, fault address 0x001f0001.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
ASKER
Thanks rbivilbiss for responding,
First, I have read David Wang's famous blog entry before, and as I said, I cannot use (at the moment) the IIS State or IIS Diagnostics Toolkit because for the moment we are not allowed to install anything on the production test servers.
Second, I did search this group before I posted my question, I did not see any topics closely related to my problem. Could you direct me to the topics you felt were similar to my problem? and I just searched for the RPC proxy topic you mentioned and I could find no topic closely related to my problem. It is possible I searched poorly...
If you have any further thoughts or ideas rbivilbiss please feel free to post, and of course that goes for anyone else peeking in at this topic, please feel free to post your thoughts..
First, I have read David Wang's famous blog entry before, and as I said, I cannot use (at the moment) the IIS State or IIS Diagnostics Toolkit because for the moment we are not allowed to install anything on the production test servers.
Second, I did search this group before I posted my question, I did not see any topics closely related to my problem. Could you direct me to the topics you felt were similar to my problem? and I just searched for the RPC proxy topic you mentioned and I could find no topic closely related to my problem. It is possible I searched poorly...
If you have any further thoughts or ideas rbivilbiss please feel free to post, and of course that goes for anyone else peeking in at this topic, please feel free to post your thoughts..
Search here for "faulting application w3wp.exe"
ASKER
I think maybe my topic was to convoluted. Those topics that came up with the search you posted were only related as so far as it concerned w3wp.exe crashing which can be caused by many many different reasons, and most the topics basically had nothing in common with my topic other than the crash.
My primary question is:
After changing the Default Application Pool to Local_System from Network_Service w3wp.exe stopped crashing on startup. That was all I changed, so I assumed when I changed it back to its original Identity setting Network_Service the w3wp.exe would start crashing again on reboot. It did not, why?
I realise no one will probably be able to tell me exactly why, but I am hoping for some good ideas to send me off looking in the right direction.
My primary question is:
After changing the Default Application Pool to Local_System from Network_Service w3wp.exe stopped crashing on startup. That was all I changed, so I assumed when I changed it back to its original Identity setting Network_Service the w3wp.exe would start crashing again on reboot. It did not, why?
I realise no one will probably be able to tell me exactly why, but I am hoping for some good ideas to send me off looking in the right direction.
That indeed is a much better question, to which I'm afraid I have no valuable contribution.
I have been having this problem (after reboot, w3wp.exe crashes)
I have resolved the problem, as far as I can tell that is, as it may have related to PAE. This is a VM, and though attempted to set VMWare Workstation vmx file to "off" for the PAE, this did not disable the PAE.
I instead then followed instructions to change the boot.ini to include /NoExecute=alwaysoff for PAE enabled but this disables DEP
http://support.microsoft.com/kb/886348
After subsequent reboots, the w3wp.exe process stopped crashing.
I have resolved the problem, as far as I can tell that is, as it may have related to PAE. This is a VM, and though attempted to set VMWare Workstation vmx file to "off" for the PAE, this did not disable the PAE.
I instead then followed instructions to change the boot.ini to include /NoExecute=alwaysoff for PAE enabled but this disables DEP
http://support.microsoft.com/kb/886348
After subsequent reboots, the w3wp.exe process stopped crashing.
ASKER
The Solution:
The crash appears to be a consequence of an earlier failure to read this
registry key:
HKEY_LOCAL_MACHINE\SYSTEM\
When ASP.NET 2.0 is installed the local group IIS_WPG is given special
permissions on this key. When the server is a domain controller the IIS_WPG
group becomes a domain group (there are no local groups on domain
controllers) and the NETWORK SERVICE account cannot be a member of it as it
is a BUILTIN account.
What you will need to do is give the NETWORK SERVICE account specific
permissions to that key.
Start Regedit and navigate to that key.
Right-click "Names" and select Permissions on the context menu.
Click Add and enter NETWORK SERVICE, click "Check Names" and click Ok.
With NETWORK SERVICE highlighed in the "Groups or User Names" list click
"Advanced"
On the "Advanced Security Settings for Names" dialogue highlight NETWORK
SERVICE and click "Edit"
In the "Permission entry for Names" dialogue check the "Name" box is showing
"NETWORK SERVICE" and put check marks against "Query Value", "Set Value",
"Create Subkey", "Enumerate Subkeys", "Notify" and "Read Control".
Click Ok on all the dialogues and close regedit.
Ensure your application pools are reconfigured to run as NETWORK SERVICE (or
at least all the ones you want to be) and restart them.
On subsequent restarts the w3wp.exe crash should not occur.
You'll probably want to repeat the above for LOCAL SERVICE as well.
++++++++++++++++++++++++++
This solution was obtained from:
http://www.issociate.de/board/goto/1239431/w3wp.exe_Problem.html
The crash appears to be a consequence of an earlier failure to read this
registry key:
HKEY_LOCAL_MACHINE\SYSTEM\
When ASP.NET 2.0 is installed the local group IIS_WPG is given special
permissions on this key. When the server is a domain controller the IIS_WPG
group becomes a domain group (there are no local groups on domain
controllers) and the NETWORK SERVICE account cannot be a member of it as it
is a BUILTIN account.
What you will need to do is give the NETWORK SERVICE account specific
permissions to that key.
Start Regedit and navigate to that key.
Right-click "Names" and select Permissions on the context menu.
Click Add and enter NETWORK SERVICE, click "Check Names" and click Ok.
With NETWORK SERVICE highlighed in the "Groups or User Names" list click
"Advanced"
On the "Advanced Security Settings for Names" dialogue highlight NETWORK
SERVICE and click "Edit"
In the "Permission entry for Names" dialogue check the "Name" box is showing
"NETWORK SERVICE" and put check marks against "Query Value", "Set Value",
"Create Subkey", "Enumerate Subkeys", "Notify" and "Read Control".
Click Ok on all the dialogues and close regedit.
Ensure your application pools are reconfigured to run as NETWORK SERVICE (or
at least all the ones you want to be) and restart them.
On subsequent restarts the w3wp.exe crash should not occur.
You'll probably want to repeat the above for LOCAL SERVICE as well.
++++++++++++++++++++++++++
This solution was obtained from:
http://www.issociate.de/board/goto/1239431/w3wp.exe_Problem.html
Recommend close but not deleted for the solution, with point refunded.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
From looking at other EE members who have had this problem there was discussion of a hotfix for .NET 2.0
Also one member said: I think I have resolved the problem. I went in to the IIS manager and restarted each of the application pools. After I did that, I got the following message in the event viewer: RPC Proxy successfully loaded in Internet Information Services (IIS) mode 6.0.