DEP (Microsofts Data Execution Prevention) stopps sometimes some apps and kills it out of memory. As an administrator, may i see such events in a log and if which one?

My experience is that there is no user information as written in Help about DEP, user reported only that the desired app disappears from their screens. This happens on a Citrix-Server running on a windows-2003 R2 64-Bit Server.


yes I'm pretty sure you'll see and application error in the application log!

  • No, i cannot find any entry in any log. Sorry. – Ice Apr 9 '10 at 19:53
  • wierd if I force a DEP issue it writes to the app log! So I don't know why your not seeing the entries other then r u sure that DEP is killing the application – tony roth Apr 16 '10 at 4:16

Yes, the Application event log will show an Error entry with Event ID = 1000.

In my experience, events with exception ID 0xc0000005 (STATUS_ACCESS_VIOLATION) are often indicative that the application is not compatible with DEP.

Application developers should be aware of DEP behavior in user mode. A user-mode DEP exception results in a STATUS_ACCESS_VIOLATION (0xc0000005) on Windows systems. The first parameter of ExceptionInformation that is located inside the EXCEPTION_RECORD structure contains the type of access violation that occurred. A value of 8 for ExceptionInformation[0] indicates the access violation was an execution violation.

Source: http://technet.microsoft.com/en-us/library/cc738483(WS.10).aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.