2

I have a Windows 2012 R2 server that was configured with IIS, websites, and other supporting software while not connected to a domain. After the server was joined to a domain IIS AppPools crash when the a website is requested.

The problem I'm seeing is that any time I test a webpage I'm getting a 503 Service Unavailable error. For example, if I go to "http://localhost/dc/" I receive this error message:

Service Unavailable

I have found that the ApplicationPools are crashing when a webpage is requested. For example, the Default Web Site uses the application pool DefaultAppPool. If I make sure this is started and then request a webpage the DefaultAppPool is stopped.

Looking in the event viewer I can see this message: "The worker process failed to initialize correctly and therefore could not be started. The data is the error."

The data in the error is "80070005". Using MS's err.exe tool I looked this up and got this information back:

C:\Users\dhughes.figleaf\Desktop\Err>err.exe 80070005
# for hex 0x80070005 / decimal -2147024891 :
  COR_E_UNAUTHORIZEDACCESS                                      corerror.h
# MessageText:
# Access is denied.
  DIERR_OTHERAPPHASPRIO                                         dinput.h
  DIERR_READONLY                                                dinput.h
  DIERR_HANDLEEXISTS                                            dinput.h
  DSERR_ACCESSDENIED                                            dsound.h
  ecAccessDenied                                                ec.h
  ecPropSecurityViolation                                       ec.h
  MAPI_E_NO_ACCESS                                              mapicode.h
  STIERR_READONLY                                               stierr.h
  STIERR_NOTINITIALIZED                                         stierr.h
  E_ACCESSDENIED                                                winerror.h
# General access denied error
# 11 matches found for "80070005"

All I can tell from this is that this appears to be an access denied error. But I'm not sure what's being denied. I've made sure that the permissions on the inetpub directory are correct, but that didn't make a difference. I also added in the IIS Failed Request Tracing module and that didn't log anything at all.

I used process explorer to watch the w3svc process and saw that when I tried to access a webpage that the process would attempt to access configuration information under the windows directory but was denied access.

I've tried fiddling with permissions on the IIS config directory but I'm unable to make changes there and, frankly, it just feels wrong to have to do that.

Does anyone know where this error might be coming from or how I could further research it?

I've also tried:

  • Removing the server from the domain does resolve the IIS AppPool crashing problem, but the server needs to be connected to the domain.
  • I've tried uninstalling and reinstalling IIS. The problem persists.

Of possible relevance: This is a VM that was cloned from another VM.

Any help or suggestions would be greatly appreciated.

5
  • When you remove and re-add the IIS, did you erased the inetpub folder too ? I suspect a NTFS's permission error there.
    – yagmoth555
    Sep 11 '15 at 0:43
  • I did not. However, we destroyed the cloned VM and created an entirely new VM (not cloned). I assumed it work work and installed our software on it only to find the exact same problem! It's now appears to be a domain permissions configuration issue or something caused by our installed software that we've never seen before. Sep 12 '15 at 12:10
  • We have the same issue; I also noticed a number of CAPI and ESENT issues in the Application event log. Those are now resolved (ensuring the "nt service\cryptsvc" had access to the "c:\windows\system32\catroot" and "c:\windows\system32\catroot2" directories & subfolders, then running the esentutl tool on the catdb files. Still investigating the main app pool issue though.
    – JohnLBevan
    Sep 7 '16 at 10:40
  • FYI: Resolved with a hack. I added the "Network Service" account to the "Administrators" group, then restarted any app pools stopped by the error. I've yet to uncover what permission was missing to get a clean fix; this current fix is bad practice, so just being used as a workaround (in our test system) whilst I continue to investigate.
    – JohnLBevan
    Sep 7 '16 at 11:39
  • ps. my app pool is running as network service; it could be that you need to make whichever account your app pools run under a member of admins should your setup be different.
    – JohnLBevan
    Sep 7 '16 at 11:55
0

I found this problem happening on a newly installed system, with a newly installed IIS, and a default app pool with pages in the default site.

We found that the only (seeming) solution (in IIS) was to change the app pool's identity (in the app pool's "Advanced Settings") from the default of applicationpoolidentity to either of the 3 other options: localservice, localsystem, or networkservice. (Don't forget to start the app pool after making the change.)

As for why this worked, and what the implications are (running the app pool that way, or why the default did not work), we did not get a chance to explore.

I do think that this server in question was indeed join to an AD, as Doug notes in his original post (long time, no talk, Doug). So that seems to be where the problem is. And I suspect there may be a better solution than what we did. I'll look forward to seeing if others ever elaborate on this.

But since others are raising this issue here and elsewhere, and this is among the first google search results where the thread is not closed and I can offer this reply, I hope at least this workaround may help someone.

0

It's possible that a GPO is affecting the server when it's joined to the domain, in a way that doesn't allow the app pool identity to work properly.

You should look out for GPOs that affect user rights; the most likely culprits are those ones that restrict the "log on as a service" right, or that manipulate local group membership.

gpresult allows you to examine which GPOs are applied to the computer and which settings do they apply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.