Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a virtualized (ESXi 4.1) Windows Server 2008 SP2 32-bit machine which is used as a terminal server, I occasionally (approximately 1-3 event log entries a day) see applications fail with an 0xc0000005 error - apparently a memory access violation.

The problem seems quite random and only badly reproducable - applications may run for hours, fail with 0xc0000005 and restart quite fine or just throw the access violation at startup and start flawlessly at the second attempt.

The names of executables, modules and offset addresses vary, although a single executable tends to fail with same modules and the same memory offset addresses (like "OUTLOOK.EXE" repeatedly failing on module "olmapi32.dll" with the offset "0x00044b7a") - even across multiple user's logons and with several days passing without a single failure inbetween. The offset addresses seem to change across reboots, however. Only selective executables seem affected by the problem, although I may simply not be seeing a sufficient number of application runs from the other ones.

I first suspected a possible problem with the physical machine's RAM, but ruled this out as a rather unlikely cause - the memory comes with ECC and I've already moved the virtual machine across several times, without any perceptable change.

I've seen that DEP was enabled in "OptOut" mode on this machine:

C:\Users\administrator>wmic OS Get DataExecutionPrevention_SupportPolicy
DataExecutionPrevention_SupportPolicy
3

and tried changing the policy to OptIn via startup options:

bcdedit.exe /set {current} nx OptIn

but have yet to see any effect - I also would expect Outlook 12 or Adobe Reader 9 (both affected applications) to play well with DEP.

Any other ideas why the apps may be failing?

share|improve this question
add comment

2 Answers

Every time I've had problems with 0xc0000005 errors on a Terminal Server, it turned out to be a problem with DEP.

Have you tried setting the DEP mode back to "OptOut", then explicitly list all of the binaries that are giving you trouble?

share|improve this answer
    
Currently it is set to AlwaysOff - and yet the faults occured 6 times within the last week. –  the-wabbit Nov 27 '11 at 7:03
add comment

Sounds like a bad pointer or some sort of memory overlap in the code of the application to me. Have you checked to see if this is a known bug with outlook and/or adobe?

share|improve this answer
    
Mh, yes - I could not find anything that would back the theory. And in the meantime there were updates to both Office and Adobe Reader packages - the memory violations still occur. –  the-wabbit Oct 12 '11 at 10:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.