From: msdnbuddy on
Hi,
I am getting the following error on Windows Server 2003 machine.

A process serving application pool 'DefaultAppPool' terminated unexpectedly.
The process id was '2468'. The process exit code was '0xffffffff'.

After this the WWW service shuts down and I get the 'Service Unavailable'
message. Restarting IIS does not help as it shuts down the services again.

Any light to resolve this issue would be highly appreciated.

TIA
From: Wei-Dong XU [MSFT] on
Hi,

For this error message, normally speaking, we should perform several
troubleshooting steps as below:
*Make sure "Network Service" and "IWAM_MACHINE" are members of IIS_WPG
*If a custom identity is being used for the app pool ensure it is in
IIS_WPG
*Make sure that IIS_WPG is included somehow in the 4 general User Rights
assignments (example: Everyone group includes IIS_WPG so that is sufficient)
a. Access this computer from network
b. Log on locally
c. Log on as batch job
d. Bypass traverse checking
*Ensure that IIS_WPG or members of that group are not in any of the
corresponding "Deny" User Rights
*Ensure that "NT AUTHORITY\Authenticated Users" and "NT
AUTHORITY\Interactive" are part of the "Users" group.
*Use FileMon.exe and RegMon.exe to monitor your IIS process and the
w3wp.exe process for ACCESS DENIED messages, which should give us the
information about what caused this issue
FileMon and RegMon are available from:
http://www.sysinternals.com/Utilities/Filemon.html
http://www.sysinternals.com/Utilities/Regmon.html
*If your IIS has more than ~60 app pools with unique identities set the
following key:

HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\UseSharedWPDesktop
(REG_DWORD with value of 1)

Please feel free to let me know if you have any further question on this
matter.

Best Regards,
Wei-Dong XU
Microsoft Product Support Services
This posting is provided "AS IS" with no warranties, and confers no rights.
It is my pleasure to be of assistance.

From: msdnbuddy on
Thank you for the information.
I have checked all of the steps outlined below except running the FileMon
and RegMon utilities.

I still continue to get the error. I will post the results of the RegMon
utility.

Thanks for your help.





"Wei-Dong XU [MSFT]" wrote:

> Hi,
>
> For this error message, normally speaking, we should perform several
> troubleshooting steps as below:
> *Make sure "Network Service" and "IWAM_MACHINE" are members of IIS_WPG
> *If a custom identity is being used for the app pool ensure it is in
> IIS_WPG
> *Make sure that IIS_WPG is included somehow in the 4 general User Rights
> assignments (example: Everyone group includes IIS_WPG so that is sufficient)
> a. Access this computer from network
> b. Log on locally
> c. Log on as batch job
> d. Bypass traverse checking
> *Ensure that IIS_WPG or members of that group are not in any of the
> corresponding "Deny" User Rights
> *Ensure that "NT AUTHORITY\Authenticated Users" and "NT
> AUTHORITY\Interactive" are part of the "Users" group.
> *Use FileMon.exe and RegMon.exe to monitor your IIS process and the
> w3wp.exe process for ACCESS DENIED messages, which should give us the
> information about what caused this issue
> FileMon and RegMon are available from:
> http://www.sysinternals.com/Utilities/Filemon.html
> http://www.sysinternals.com/Utilities/Regmon.html
> *If your IIS has more than ~60 app pools with unique identities set the
> following key:
>
> HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\UseSharedWPDesktop
> (REG_DWORD with value of 1)
>
> Please feel free to let me know if you have any further question on this
> matter.
>
> Best Regards,
> Wei-Dong XU
> Microsoft Product Support Services
> This posting is provided "AS IS" with no warranties, and confers no rights.
> It is my pleasure to be of assistance.
>
>
From: msdnbuddy on
After running RegMon I found Access Denied messages for
HKEY_CLASSES_ROOT\CLSID\{7007ACC1-3202-11D1-AAD2-00805FC1270E}


In RegMon, the other column has an entry for NT Authority\Network Service
next to the Access Denied message.

Please let me what should be done next.

TIA.



"Wei-Dong XU [MSFT]" wrote:

> Hi,
>
> For this error message, normally speaking, we should perform several
> troubleshooting steps as below:
> *Make sure "Network Service" and "IWAM_MACHINE" are members of IIS_WPG
> *If a custom identity is being used for the app pool ensure it is in
> IIS_WPG
> *Make sure that IIS_WPG is included somehow in the 4 general User Rights
> assignments (example: Everyone group includes IIS_WPG so that is sufficient)
> a. Access this computer from network
> b. Log on locally
> c. Log on as batch job
> d. Bypass traverse checking
> *Ensure that IIS_WPG or members of that group are not in any of the
> corresponding "Deny" User Rights
> *Ensure that "NT AUTHORITY\Authenticated Users" and "NT
> AUTHORITY\Interactive" are part of the "Users" group.
> *Use FileMon.exe and RegMon.exe to monitor your IIS process and the
> w3wp.exe process for ACCESS DENIED messages, which should give us the
> information about what caused this issue
> FileMon and RegMon are available from:
> http://www.sysinternals.com/Utilities/Filemon.html
> http://www.sysinternals.com/Utilities/Regmon.html
> *If your IIS has more than ~60 app pools with unique identities set the
> following key:
>
> HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\UseSharedWPDesktop
> (REG_DWORD with value of 1)
>
> Please feel free to let me know if you have any further question on this
> matter.
>
> Best Regards,
> Wei-Dong XU
> Microsoft Product Support Services
> This posting is provided "AS IS" with no warranties, and confers no rights.
> It is my pleasure to be of assistance.
>
>
From: msdnbuddy on
Also, the event viewer messages have changed to

A process serving application pool 'DefaultAppPool' reported a failure. The
process id was '2556'. The data field contains the error number.



"msdnbuddy" wrote:

> After running RegMon I found Access Denied messages for
> HKEY_CLASSES_ROOT\CLSID\{7007ACC1-3202-11D1-AAD2-00805FC1270E}
>
>
> In RegMon, the other column has an entry for NT Authority\Network Service
> next to the Access Denied message.
>
> Please let me what should be done next.
>
> TIA.
>
>
>
> "Wei-Dong XU [MSFT]" wrote:
>
> > Hi,
> >
> > For this error message, normally speaking, we should perform several
> > troubleshooting steps as below:
> > *Make sure "Network Service" and "IWAM_MACHINE" are members of IIS_WPG
> > *If a custom identity is being used for the app pool ensure it is in
> > IIS_WPG
> > *Make sure that IIS_WPG is included somehow in the 4 general User Rights
> > assignments (example: Everyone group includes IIS_WPG so that is sufficient)
> > a. Access this computer from network
> > b. Log on locally
> > c. Log on as batch job
> > d. Bypass traverse checking
> > *Ensure that IIS_WPG or members of that group are not in any of the
> > corresponding "Deny" User Rights
> > *Ensure that "NT AUTHORITY\Authenticated Users" and "NT
> > AUTHORITY\Interactive" are part of the "Users" group.
> > *Use FileMon.exe and RegMon.exe to monitor your IIS process and the
> > w3wp.exe process for ACCESS DENIED messages, which should give us the
> > information about what caused this issue
> > FileMon and RegMon are available from:
> > http://www.sysinternals.com/Utilities/Filemon.html
> > http://www.sysinternals.com/Utilities/Regmon.html
> > *If your IIS has more than ~60 app pools with unique identities set the
> > following key:
> >
> > HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\UseSharedWPDesktop
> > (REG_DWORD with value of 1)
> >
> > Please feel free to let me know if you have any further question on this
> > matter.
> >
> > Best Regards,
> > Wei-Dong XU
> > Microsoft Product Support Services
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> > It is my pleasure to be of assistance.
> >
> >