asked on

Application pool using Network Service will not run, event ID 1009

I am pulling my hair out trying to find why an application pool using Network Service keeps failing with event code 1009. If I add Network Service to the local admins group, it works fine leading me to the assumption that it is a permissions issue some where. However there are no failures recorded in the security log.
Things I have done:
Reviewed and checked all items on KB 812614.
Installed and configured a crash capture using Debugging tools.
Installed and tried to use IISState
The problem I am having is that once I start the application pool and hit the website, w3wp.exe launches but within a second closes with the event id 1009 error message, so it is not running enough debugger to catch it.
If I set the application pool to use Local System it works fine. Of course, that is not the desired action.

Any one have a idea of what I can do to find the permissions problem?

souseran

What are the Source and Description on your 1009 Event?

John Tolmachoff

ASKER

Event Type:      Warning
Event Source:      W3SVC
Event Category:      None
Event ID:      1009
Date:            8/9/2007
Time:            3:37:30 PM
User:            N/A
Computer:      SRV9
Description:
A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '4428'. The process exit code was '0xffffffff'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

souseran

You didn't mention whether this is on a domain controller or not. However:

Error code: 0xffffffff - Per Microsoft: "This issue may occur if the server that is running Microsoft Internet Information Services (IIS) 6.0 is also a domain controller. The problem occurs because the Application pool is using the NT Authority\Network Service account, and the NT Authority\Network Service account may not have permissions to access the required folders".

If this is on a DC, this might help:

http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032245355&Culture=en-US

John Tolmachoff

ASKER

No, this is not on a DC, nor is Exchange installed nor is the server hosting anything to do with Sharepoint nor any PHP or CGI.

John Tolmachoff

ASKER

Bump.

souseran

This might help:

http://blogs.iis.net/brian-murphy-booth/archive/2007/03/22/how-to-troubleshoot-an-iis-event-id-1009-error.aspx

John Tolmachoff

ASKER

OK, went through that list. Using gflags.exe I was able to finally get a log of the process. I did find some exceptions but I am not sure how to resolve. If any one has ideas let me know.

===============================================================
[a78,9dc] LDR: Real INIT LIST for process c:\windows\system32\inetsrv\w3wp.exe pid 2680 0xa78
[a78,9dc] C:\WINDOWS\system32\OLEAUT32.dll init routine 77D0155C
[a78,9dc] C:\WINDOWS\system32\WS2HELP.dll init routine 71BF18F9
[a78,9dc] C:\WINDOWS\system32\WS2_32.dll init routine 71C02560
[a78,9dc] C:\WINDOWS\system32\WSOCK32.dll init routine 71BB1060
[a78,9dc] c:\windows\system32\inetsrv\W3TP.dll init routine 5A302ABE
[a78,9dc] c:\windows\system32\inetsrv\W3CACHE.dll init routine 5A403C4D
[a78,9dc] C:\WINDOWS\system32\SHLWAPI.dll init routine 77DB006D
[a78,9dc] C:\WINDOWS\system32\HTTPAPI.dll init routine 67154D50
[a78,9dc] c:\windows\system32\inetsrv\w3dt.dll init routine 5A368121
[a78,9dc] C:\WINDOWS\system32\strmfilt.dll init routine 5B64D198
[a78,9dc] c:\windows\system32\inetsrv\W3COMLOG.dll init routine 5A3F1F3C
[a78,9dc] C:\WINDOWS\system32\IisRTL.DLL init routine 647C3966
[a78,9dc] c:\windows\system32\inetsrv\LONSINT.dll init routine 62DA2A08
[a78,9dc] C:\WINDOWS\system32\NETAPI32.dll init routine 71C4803D
[a78,9dc] c:\windows\system32\inetsrv\wamreg.DLL init routine 60BAC427
[a78,9dc] C:\WINDOWS\system32\IISMAP.dll init routine 5A42918C
[a78,9dc] c:\windows\system32\inetsrv\w3core.dll init routine 5A3D6D99
[a78,9dc] LDR: OLEAUT32.dll loaded - Calling init routine at 77D0155C
[a78,9dc] LDR: WS2HELP.dll loaded - Calling init routine at 71BF18F9
[a78,9dc] LDR: WS2_32.dll loaded - Calling init routine at 71C02560
[a78,9dc] LDR: WSOCK32.dll loaded - Calling init routine at 71BB1060
LDR: LdrGetProcedureAddress by NAME - UnhandledExceptionFilter
==========================================================
LDR: LdrLoadDll, loading C:\WINDOWS\system32\rpcrt4.dll from c:\windows\system32\inetsrv;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\Paymentech\sdk\Windows\lib;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\ColumbiaSoft\Document Locator\Scan\
LDR: LdrpSearchPath - Looking for C:\WINDOWS\system32\rpcrt4.dll in c:\windows\system32\inetsrv;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\Paymentech\sdk\Windows\lib;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\ColumbiaSoft\Document Locator\Scan\
LDR: LdrpResolveFullName - Expanding full name of C:\WINDOWS\system32\rpcrt4.dll
LDR: LdrpResolveFullName - Expanded to C:\WINDOWS\system32\rpcrt4.dll
LDR: LdrpSearchPath - Returning CLDR: LdrGetProcedureAddress by NAME - RpcRaiseException
==============================================================
LDR: LdrpSearchPath - Returning C[a78,7d0] LDR: Real INIT LIST for process c:\windows\system32\inetsrv\w3wp.exe pid 2680 0xa78
(a78.7d0): C++ EH exception - code e06d7363 (first chance)
==========================================================
LDR: LdrLoadDll, loading C:\WINDOWS\system32\mscoree.dll from
LDR: LdrpSearchPath - Looking for C:\WINDOWS\system32\mscoree.dll in c:\windows\system32\inetsrv;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\Paymentech\sdk\Windows\lib;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\ColumbiaSoft\Document Locator\Scan\
LDR: LdrpResolveFullName - Expanding full name of C:\WINDOWS\system32\mscoree.dll
LDR: LdrpResolveFullName - Expanded to C:\WINDOWS\system32\mscoree.dll
LDR: LdrpSearchPath - Returning C[a78,7d0] LDR: Real INIT LIST for process c:\windows\system32\inetsrv\w3wp.exe pid 2680 0xa78
(a78.7d0): C++ EH exception - code e06d7363 (first chance)

ASKER CERTIFIED SOLUTION

John Tolmachoff

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial