Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Prolific number of Windows error reports pertaining to 2008 R2 certificate services.

$
0
0
Hi,
 
We've recently added our domain enterprise certificate authority to SCOM, and it's come to light there are a significant number of Application Error and Windows Error Reporting events coming from the CA web application pool.
 
Samples of the two events are below, but I'm out of my depth in trying to understand this, other than the error code makes it look as though there's an access issue (0xc0000005).
 
Has anyone come across this issue and been able to resolve it?
 
Cheers,
Lain
 
 
 

Log Name:      Application
 Source:        Windows Error Reporting
 Date:          30/04/2011 8:54:44 AM
 Event ID:      1001
 Task Category: None
 Level:         Information
 Keywords:      Classic
 User:          N/A
 Computer:      ca.domain.edu.au
 Description:
 Fault bucket , type 0
 Event Name: BEX64
 Response: Not available
 Cab Id: 0
 
Problem signature:
 P1: w3wp.exe
 P2: 7.5.7601.17514
 P3: 4ce7afa2
 P4: scrdenrl.dll_unloaded
 P5: 0.0.0.0
 P6: 4a5bc7f2
 P7: 000007fefa982594
 P8: c0000005
 P9: 0000000000000008
 P10:
 
Attached files:
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96BE.tmp.appcompat.txt
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EE.tmp.WERInternalMetadata.xml
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EF.tmp.hdmp
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER975E.tmp.mdmp
 
These files may be available here:
 C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_79ba0d5f6ccd55db47d6647c38815842357f45e_cab_018697a9
 
Analysis symbol:
Rechecking for solution: 0
 Report Id: 6f7098e5-72c4-11e0-b71a-005056820004
 Report Status: 0
 Event Xml:
 <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   <System>
     <Provider Name="Windows Error Reporting" />
     <EventID Qualifiers="0">1001</EventID>
     <Level>4</Level>
     <Task>0</Task>
     <Keywords>0x80000000000000</Keywords>
     <TimeCreated SystemTime="2011-04-30T00:54:44.000000000Z" />
     <EventRecordID>8262</EventRecordID>
     <Channel>Application</Channel>
     <Computer>ca.domain.edu.au</Computer>
     <Security />
   </System>
   <EventData>
     <Data>
     </Data>
     <Data>0</Data>
     <Data>BEX64</Data>
     <Data>Not available</Data>
     <Data>0</Data>
     <Data>w3wp.exe</Data>
     <Data>7.5.7601.17514</Data>
     <Data>4ce7afa2</Data>
     <Data>scrdenrl.dll_unloaded</Data>
     <Data>0.0.0.0</Data>
     <Data>4a5bc7f2</Data>
     <Data>000007fefa982594</Data>
     <Data>c0000005</Data>
     <Data>0000000000000008</Data>
     <Data>
     </Data>
     <Data>
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96BE.tmp.appcompat.txt
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EE.tmp.WERInternalMetadata.xml
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EF.tmp.hdmp
 C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER975E.tmp.mdmp</Data>
     <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_79ba0d5f6ccd55db47d6647c38815842357f45e_cab_018697a9</Data>
     <Data>
     </Data>
     <Data>0</Data>
     <Data>6f7098e5-72c4-11e0-b71a-005056820004</Data>
     <Data>0</Data>
   </EventData>
 </Event>
 


Log Name:      Application
 Source:        Application Error
 Date:          30/04/2011 8:54:43 AM
 Event ID:      1000
 Task Category: (100)
 Level:         Error
 Keywords:      Classic
 User:          N/A
 Computer:      ca.domain.edu.au
 Description:
 Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp: 0x4ce7afa2
 Faulting module name: scrdenrl.dll_unloaded, version: 0.0.0.0, time stamp: 0x4a5bc7f2
 Exception code: 0xc0000005
 Fault offset: 0x000007fefa982594
 Faulting process id: 0xf2c
 Faulting application start time: 0x01cc06cfcb05cd54
 Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
 Faulting module path: scrdenrl.dll
 Report Id: 6f7098e5-72c4-11e0-b71a-005056820004
 Event Xml:
 <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   <System>
     <Provider Name="Application Error" />
     <EventID Qualifiers="0">1000</EventID>
     <Level>2</Level>
     <Task>100</Task>
     <Keywords>0x80000000000000</Keywords>
     <TimeCreated SystemTime="2011-04-30T00:54:43.000000000Z" />
     <EventRecordID>8260</EventRecordID>
     <Channel>Application</Channel>
     <Computer>ca.domain.edu.au</Computer>
     <Security />
   </System>
   <EventData>
     <Data>w3wp.exe</Data>
     <Data>7.5.7601.17514</Data>
     <Data>4ce7afa2</Data>
     <Data>scrdenrl.dll_unloaded</Data>
     <Data>0.0.0.0</Data>
     <Data>4a5bc7f2</Data>
     <Data>c0000005</Data>
     <Data>000007fefa982594</Data>
     <Data>f2c</Data>
     <Data>01cc06cfcb05cd54</Data>
     <Data>c:\windows\system32\inetsrv\w3wp.exe</Data>
     <Data>scrdenrl.dll</Data>
     <Data>6f7098e5-72c4-11e0-b71a-005056820004</Data>
   </EventData>
 </Event>
 

Viewing all articles
Browse latest Browse all 12072

Trending Articles