IIS crashing when user logs in via RDP?

[Mason G. Zhwiti]

Hello everyone,

I've been the only one managing our servers via RDP at the office, for
the longest time. Recently we added a new guy to help me, and we set
him up with an Active Directory domain account, similar to mine.

When he logs into the servers, he regularly (but not always) receives
a popup error indicating that w3wp.exe has crashed. It has "Send" and
"Don't Send" buttons on it to report the error. If he clicks "Don't
Send," it will continuously crash and popup a new error. If he clicks
"Send," it just crashes that one time and then stops! Has anyone ever
seen w3wp.exe crash regularly on RDP login? And why on Earth would
"Don't Send" cause it to continuously crash until we Send the report?
Any ideas?

Here are the errors that show up at this time in event log:

Date/Time: 7/17/2007 8:31:27 AM
Log Type: Application
Source: Application Error
Type Of Event: Information
Category: None
EventID: 1004
Account: None
Computer: OURSERVER
Description: Reporting queued error: faulting application w3wp.exe,
version 6.0.3790.1830, faulting module ntdll.dll, version
5.2.3790.1830, fault address 0x000327f9.


Date/Time: 7/17/2007 8:32:07 AM
Log Type: Application
Source: Application Error
Type Of Event: Information
Category: None
EventID: 1004
Account: None
Computer: OURSERVER
Description: Reporting queued error: faulting application w3wp.exe,
version 6.0.3790.1830, faulting module ntdll.dll, version
5.2.3790.1830, fault address 0x000327f9.


Date/Time: 7/17/2007 8:33:03 AM
Log Type: Application
Source: Application Error
Type Of Event: Error
Category: None
EventID: 1001
Account: None
Computer: OURSERVER
Description: Fault bucket 184707617.


Thanks!

MGZ

 

[Steve Schofield]

I would isolate the requests on each machine and see if you can determine
which box is causing the problem. Are there any errors in the event log.
Do you happen to run ISA server in front of these boxes? Do you have some
type of proxy server? Do you see the actual requests from multiple machines
logged in the WWW logs?

I usually turn off the Error Reporting Service and the Error Reporting
options in the System > Advanced Tab > Error Reporting Button. I normally
have the two top checkboxes selected. Hope that helps.

--

Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield

http://www.IISLogs.com
Log archival solution.
Install, Configure, Forget

"Mason G. Zhwiti" <mason.g.zhwiti@gmail.com> wrote in message
news:1184687090.775209.231580@e16g2000pri.googlegroups.com...
> Hello everyone,
>
> I've been the only one managing our servers via RDP at the office, for
> the longest time. Recently we added a new guy to help me, and we set
> him up with an Active Directory domain account, similar to mine.
>
> When he logs into the servers, he regularly (but not always) receives
> a popup error indicating that w3wp.exe has crashed. It has "Send" and
> "Don't Send" buttons on it to report the error. If he clicks "Don't
> Send," it will continuously crash and popup a new error. If he clicks
> "Send," it just crashes that one time and then stops! Has anyone ever
> seen w3wp.exe crash regularly on RDP login? And why on Earth would
> "Don't Send" cause it to continuously crash until we Send the report?
> Any ideas?
>
> Here are the errors that show up at this time in event log:
>
> Date/Time: 7/17/2007 8:31:27 AM
> Log Type: Application
> Source: Application Error
> Type Of Event: Information
> Category: None
> EventID: 1004
> Account: None
> Computer: OURSERVER
> Description: Reporting queued error: faulting application w3wp.exe,
> version 6.0.3790.1830, faulting module ntdll.dll, version
> 5.2.3790.1830, fault address 0x000327f9.
>
>
> Date/Time: 7/17/2007 8:32:07 AM
> Log Type: Application
> Source: Application Error
> Type Of Event: Information
> Category: None
> EventID: 1004
> Account: None
> Computer: OURSERVER
> Description: Reporting queued error: faulting application w3wp.exe,
> version 6.0.3790.1830, faulting module ntdll.dll, version
> 5.2.3790.1830, fault address 0x000327f9.
>
>
> Date/Time: 7/17/2007 8:33:03 AM
> Log Type: Application
> Source: Application Error
> Type Of Event: Error
> Category: None
> EventID: 1001
> Account: None
> Computer: OURSERVER
> Description: Fault bucket 184707617.
>
>
> Thanks!
>
> MGZ
>

 

[Steve Schofield]

Well, if I would have looked down, you provided event log messages. here is
an article by David Wang.

http://blogs.msdn.com/david.wang/ar...Understand_and_Diagnose_an_AppPool_Crash.aspx

--

Best regards,

Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield

http://www.IISLogs.com
Log archival solution.
Install, Configure, Forget

"Mason G. Zhwiti" <mason.g.zhwiti@gmail.com> wrote in message
news:1184687090.775209.231580@e16g2000pri.googlegroups.com...
> Hello everyone,
>
> I've been the only one managing our servers via RDP at the office, for
> the longest time. Recently we added a new guy to help me, and we set
> him up with an Active Directory domain account, similar to mine.
>
> When he logs into the servers, he regularly (but not always) receives
> a popup error indicating that w3wp.exe has crashed. It has "Send" and
> "Don't Send" buttons on it to report the error. If he clicks "Don't
> Send," it will continuously crash and popup a new error. If he clicks
> "Send," it just crashes that one time and then stops! Has anyone ever
> seen w3wp.exe crash regularly on RDP login? And why on Earth would
> "Don't Send" cause it to continuously crash until we Send the report?
> Any ideas?
>
> Here are the errors that show up at this time in event log:
>
> Date/Time: 7/17/2007 8:31:27 AM
> Log Type: Application
> Source: Application Error
> Type Of Event: Information
> Category: None
> EventID: 1004
> Account: None
> Computer: OURSERVER
> Description: Reporting queued error: faulting application w3wp.exe,
> version 6.0.3790.1830, faulting module ntdll.dll, version
> 5.2.3790.1830, fault address 0x000327f9.
>
>
> Date/Time: 7/17/2007 8:32:07 AM
> Log Type: Application
> Source: Application Error
> Type Of Event: Information
> Category: None
> EventID: 1004
> Account: None
> Computer: OURSERVER
> Description: Reporting queued error: faulting application w3wp.exe,
> version 6.0.3790.1830, faulting module ntdll.dll, version
> 5.2.3790.1830, fault address 0x000327f9.
>
>
> Date/Time: 7/17/2007 8:33:03 AM
> Log Type: Application
> Source: Application Error
> Type Of Event: Error
> Category: None
> EventID: 1001
> Account: None
> Computer: OURSERVER
> Description: Fault bucket 184707617.
>
>
> Thanks!
>
> MGZ
>