Lubo Blagoev's Blog

Like every windows developer I installed Vista SP1 as soon as it came out on MSDN Subscriptions. I was happy and confident to know that the most of the glitches that bugged me till today will be gone. Service Pack 1 installed without any issues. (I even installed it on my work PC over remote desktop, so the next morning I come to work I wont have to wait for it. Pretty cool).

It was just when I tried to open my blog that I realized it is not working. I got Error 503 Service Unavailable response from the server. A quick look showed that the Application Pool for my blog was failing to serve the first request and logs the following error in Event log.

The worker process failed to initialize correctly and therefore could not be started. The data is the error.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
   <Provider Name="Microsoft-Windows-IIS-W3SVC-WP" Guid="{670080D9-742A-4187-8D16-41143D1290BD}" EventSourceName="W3SVC-WP"/>
   <EventID Qualifiers="49152">2276</EventID>
   <Version>0</Version>
   <Level>2</Level>
   <Task>0</Task>
   <Opcode>0</Opcode>
   <Keywords>0x80000000000000</Keywords>
   <TimeCreated SystemTime="2008-02-21T21:43:34.000Z"/>
   <EventRecordID>36822</EventRecordID>
   <Correlation/>
   <Execution ProcessID="0" ThreadID="0"/>
   <Channel>Application</Channel>
   <Computer>CONROE</Computer>
   <Security/>
 </System>
 <EventData>
   <Binary>05000780</Binary>
 </EventData>
</Event>

So the data is the error. This error in words is 80070005. I was one Windows SDK start away from finding out what that means. I searched for this number in the SDK and found out that this is a Standard COM error "E_ACCESSDENIED 80070005 General access denied error." So I realize I am dealing with a security issue. What was the exact resource that my App Pool was trying to connect and failed? Like Mark Russinovich would do I started Process Monitor to look for more detailed information since the report was totally non comprehensive. Working with Process Monitor is very easy just watch TechEd IT Forum 2007: The Case of the Unexplained... movie where Mark shows some more stuff. The most important rule for Process Monitor is know what you are looking for. In my case that was an Access Denied operation result in the Result column. This would be on a process with credentials that my app pool was configured to work with. So I highlighted all processes that have this user credentials. After that it was easy to identify the operation that failed - the selected row on the screenshot.

The process's that runs my blog had no read access to C:\Windows\System32\inetsrv\config\schema directory. This directory is used by IIS to save its settings. So I changed the security settings to allow my user credentials to read from that directory and voila my blog is up again.

By the way if you watch the The Case of the Unexplained movie you will hear Mark Russinovich say that he strives to remove all hexadecimal error message from user space. I guess Mark and Microsoft as a whole must treat Event log messages the same as user level MessageBoxes. The event log message was not detailed at all and whoever wrote that COM logging should add the event error description not just writing a simple error code to the log.