OS: Windows Server 2008 R2

IIS: 7.5

No Managed Code

I am trying to nail down the issue here. I am not sure if it was precipitated by some change from a group policy (I don't have any control over that) or from installing some Windows Update.

All of a sudden after a reboot, none of my sites would work, they all respond with HTTP Error 503. The service is unavailable. The app pools were stopped and there are 5 warnings (EventID 5009, EventSourceName WAS) and 1 error (EventID 5002, EventSourceName WAS) in the System event logs and 5 errors (EventID 2276, EventSourceName W3SVC-WP) in the Appliation event logs (per app pool).

I switched all my sites to a single app pool and change the identity to NetworkService and they all work. This however seems like a security/scale issue?

I downloaded DebugDiag 2 and tried to get a dump, however it never seemed to trigger. I also try to find the process in Process Explorer, but any app pool not using the NetworkService identity doesn't show up.

I don't know how else to look for the root cause.

EDIT @Lex Li

Checked my Debug Tool log and found this

[7/19/2018 3:29:02 PM] New process found: Process Name - w3wp.exe Process ID - 4652 Process Identity - IIS APPPOOL\Test Pool Web application pool name - Test Pool
[7/19/2018 3:29:02 PM] Attach Debugger: Process Name - w3wp.exe Process ID - 4652 Control Script - C:\Program Files\DebugDiag\Scripts\CrashRule_WebAppPool_Test Pool.vbs
Script Error
Error Code - 0x80070002
Error Source [DbgSvc.Controller.1]
Error Description []
Line 93, Column 2
[7/19/2018 3:29:03 PM] Process Exited: Process Name - w3wp.exe Process ID - 4652 Web application pool name - Test Pool

However that only shows up once, and can't reproduce it.

  • Even if no dumps are created, Debug Diag does write to its log files what happened. You might take a look there first.
    – Lex Li
    Jul 20, 2018 at 1:25
  • Very likely you need to try other approaches (procdump, or other tools). Open a support case via support.microsoft.com if you can. You hit a non-trivial case, which might indicate your server has been modified in an unexpected way.
    – Lex Li
    Jul 21, 2018 at 22:44


You must log in to answer this question.

Browse other questions tagged .