Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

DEP (Microsofts Data Execution Prevention) stopps sometimes some apps and kills it out of memory. As an administrator, may i see such events in a log and if which one?

My experience is that there is no user information as written in Help about DEP, user reported only that the desired app disappears from their screens. This happens on a Citrix-Server running on a windows-2003 R2 64-Bit Server.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

yes I'm pretty sure you'll see and application error in the application log!

share|improve this answer
    
No, i cannot find any entry in any log. Sorry. –  Ice Apr 9 '10 at 19:53
    
wierd if I force a DEP issue it writes to the app log! So I don't know why your not seeing the entries other then r u sure that DEP is killing the application –  tony roth Apr 16 '10 at 4:16

Yes, the Application event log will show an Error entry with Event ID = 1000.

In my experience, events with exception ID 0xc0000005 (STATUS_ACCESS_VIOLATION) are often indicative that the application is not compatible with DEP.

Application developers should be aware of DEP behavior in user mode. A user-mode DEP exception results in a STATUS_ACCESS_VIOLATION (0xc0000005) on Windows systems. The first parameter of ExceptionInformation that is located inside the EXCEPTION_RECORD structure contains the type of access violation that occurred. A value of 8 for ExceptionInformation[0] indicates the access violation was an execution violation.

Source: http://technet.microsoft.com/en-us/library/cc738483(WS.10).aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.