Data Execution Prevention: IIS Worker Process

wrytat

unread,

Jun 3, 2007, 8:24:01 PM6/3/07

to

My server is running on MS Windows Server 2003 for Small Business Server
Service Pack 2. I found that every morning when I log in to the server using
the administrator account, I will be prompted with this "Data Execution
Prevention - Microsoft Windows" message. It reads,

"To help protect your computer, Windows has closed this program.
Name: IIS Worker Process
Publisher: Microsoft Corporation
[Change Settings] [Close Message]"

Usually I hit the Close Message button, as I don't know which settings to
change. Then I will be prompted with this "IIS Worker Process" message, which
reads,

"IIS Worker Process encountered a problem and needed to close.
This error occurred on xx/xx/2007 at 2:29:44 AM.
Please tell Microsoft about this problem.
We have created an error report that you can send to help us improve IIS
Worker Process. We will treat this report as confidential and anonymous.
To see what data this error report contains, click here.
[Send Error Report] [Don't Send]"

Sometimes I'll get these messages twice when I log in. Anyone has
encountered this before? Which settings should I change?

Terence Liu [MSFT]

unread,

Jun 4, 2007, 3:49:41 AM6/4/07

to

Hello Customer,

Thanks for posting here.

According to your description, I understand that you received this error
message "To help protect your computer, Windows has closed the program.
Name IIS Worker Process" on the SBS 2003 Server. If I have misunderstood
the problem, please don't hesitate to let me know.

Based on my research, this issue is due to DEP ( Data execution prevention
) feature of Windows 2003 SP1. When you install the Windows 2003 SP1 on
server DEP is getting enabled by default.
This feature is also Available in windows XP SP2.

How to identify the DEP is enabled in Windows 2003 and XP SP2 systems
=========================
Check the Boot.ini file in any of the OS listed above and check for
NoExecute Entry. This looks like follows

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows Server 2003, Enterprise"
/fastdetect /noexecute=OptOut

/noexecute Switch
================
The /noexecute parameter enables Data Execution Prevention (DEP), a set of
hardware and software technologies designed to prevent harmful code from
running in
protected memory locations
/noexecute={alwayson | optout | optin | alwaysoff}

Switch noexecute=OptOut
Enables DEP for the operating system and all processes, including the
Windows
kernel and drivers.
Switch noexecute=alwayson
Enables DEP for the operating system and all processes, including the
Windows
kernel and drivers. All attempts to disable DEP are ignored.
Switch noexecute=optin
Enables DEP only for operating system components, including the Windows
kernel and
drivers.
Switch noexecute=alwaysoff
Disables DEP. Attempts to enable DEP selectively are ignored. This
parameter also
disables physical address extension (PAE). To re-enable (PAE), use the /pae
parameter.

More information on DEP and Noexecute
================================
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memory/base
/data_execution_prevention.asp

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/
ddtools/bootini_aff45176-bd02-43cf-9895-c212fa392de2.xml.asp

Solution
======================
Workaround 1
-------------------
Use the noexecute=optin parameter in Boot.ini file. This is how we can set
it bootcfg /raw "/fastdetect /NoExecute=optin" /ID 1 (reboot of system is
needed
after this)

Note: To find the boot.ini, please perform the following steps:

1. Open Control Panel, double-click Folder Options.
2. Click the View tab, UNCHECK 'Hide protected operating system files
(Recommended)' check box.
3. Find the boot.ini under C:\.

Workaround 2
----------------------
let the noexecute=OptOut remain like that only in Boot.ini file and follow
below listed steps to allow W3WP.exe process to be run properly on server.

My Computer -- > Advanced --> Performance -- >Settings -- > Data
Execution Prevention --> 2nd radio button ( Turn on DEP for all programs
and services except
those I select) -- > Add W3WP.EXE process in exception list (no need for
reboot).

By doing this what we are doing is setting W3WP.exe in exception list of
DEP

Workaround 3
-----------------------
set noexecute=Alwaysoff in boot.ini file and that will turn off the DEP.
This is how we will set it up

bootcfg /raw "/fastdetect /NoExecute=AlwaysOff" /ID 1 (reboot of system
is needed
after this)
<<<< This is not recommended as this will turn of DEP Totally and there is
no fun of having Windows 2003 SP1 on your BOX

I appreciate your time and cooperation. If anything is unclear, please feel
free to let me know. I am looking forward to hearing from you.

Have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Les Connor [SBS MVP]

unread,

Jun 4, 2007, 11:53:02 AM6/4/07

to

Terence,

Why is DEP acting on this process? Is there an error in the application? If
there is an error, should it not be fixed?

--
Les Connor [SBS MVP]

"Terence Liu [MSFT]" <v-te...@online.microsoft.com> wrote in message
news:5vKCszn...@TK2MSFTNGHUB02.phx.gbl...

Terence Liu [MSFT]

unread,

Jun 5, 2007, 5:48:33 AM6/5/07

to

Hello Les,

Thank you for post here.

I am not sure why the Data Execution Prevention acted on IIS Worker
Process. Maybe there are some configuration compatibility issues between
the DEP IIS Worker Process. However, I'm sure there is no error for IIS
Worker Process, and we do not need to fix it. Please don't worry.

Hope the info help.

Thanks and have a nice day.

Best regards,

Terence Liu(MSFT)

Get Secure! - www.microsoft.com/security

--------------------
| From: "Les Connor [SBS MVP]" <les.c...@DEL.cfive.ca>
| References: <7DAABF6D-B5C0-489B...@microsoft.com>
<5vKCszn...@TK2MSFTNGHUB02.phx.gbl>
| In-Reply-To: <5vKCszn...@TK2MSFTNGHUB02.phx.gbl>
| Subject: Re: Data Execution Prevention: IIS Worker Process
| Date: Mon, 4 Jun 2007 10:53:02 -0500
| Lines: 212
| Message-ID: <78D2AD97-94CC-4209...@microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| format=flowed;
| charset="iso-8859-1";
| reply-type=original
| Content-Transfer-Encoding: 7bit
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
| X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
| X-MS-CommunityGroup-PostID: {78D2AD97-94CC-4209-A9FF-4D6C0B8B465A}
| X-MS-CommunityGroup-ThreadID: 7DAABF6D-B5C0-489B-A609-57502C7F6547
| X-MS-CommunityGroup-ParentID: 39BA932B-B0A4-4AA8-A5D0-F86FA2BF646B
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:41535
| NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
| X-Tomcat-NG: microsoft.public.windows.server.sbs

wrytat

unread,

Jun 6, 2007, 8:24:01 PM6/6/07

to

I tried Workaround 1,

"Use the noexecute=optin parameter in Boot.ini file. This is how we can set
it bootcfg /raw "/fastdetect /NoExecute=optin" /ID 1 (reboot of system is
needed
after this)"

But I'm still getting the error...

wrytat

unread,

Jun 6, 2007, 9:34:02 PM6/6/07

to

I tried Workaround #1, by running bootcfg /raw "/fastdetect /NoExecute=optin"
/ID 1. But I'm still getting the error...

wrytat

unread,

Jun 6, 2007, 9:35:00 PM6/6/07

to

I tried Workaround #1, by running bootcfg /raw "/fastdetect /NoExecute=optin"

/ID 1. But I'm still getting the error... Must I restart my server?

Terence Liu [MSFT]

unread,

Jun 7, 2007, 5:28:24 AM6/7/07

to

Hello Customer,

Thank you for kind update.

I suggest you continue to perform the workaround 2. Set W3WP.exe in
exception list of DEP.

If the issue reoccurs after workaround 2, please try to perform the
workaround 3, to test if we can resolve this issue.

If we can not resolve the issue after we perform the above steps, please
kindly help me collect the boot.ini file and send to me at
v-te...@microsoft.com for further investigation:

Hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Get Secure! - www.microsoft.com/security

| thread-index: Aceoo+3+3cIDjpFZQ7q231ZkNaAvuw==
| X-WBNR-Posting-Host: 207.46.19.197
| From: =?Utf-8?B?d3J5dGF0?= <wry...@discussions.microsoft.com>
| References: <7DAABF6D-B5C0-489B...@microsoft.com>
<5vKCszn...@TK2MSFTNGHUB02.phx.gbl>
| Subject: RE: Data Execution Prevention: IIS Worker Process
| Date: Wed, 6 Jun 2007 18:34:02 -0700
| Lines: 197
| Message-ID: <77E03B83-6AAA-4D5B...@microsoft.com>

| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:42281

wrytat

unread,

Jun 10, 2007, 9:20:00 PM6/10/07

to

Must I restart my OS after performing the workaround?

Terence Liu [MSFT]

unread,

Jun 11, 2007, 2:30:57 AM6/11/07

to

Hello Customer,

Thank you for kind update. I'm sorry for the delay response due to the
weekend.

Since this issue relates to the boot file, only restart the SBS we can make
the configuration carry out to the system. Therefore, I suggest you
schedule a down time to perform the workaround.

Thanks for your understanding.

Have a nice day.

Best regards,

Terence Liu(MSFT)

Get Secure! - www.microsoft.com/security

| thread-index: AcerxqHHGcq63xm9R9WXDdoEyDL2Ow==

| X-WBNR-Posting-Host: 207.46.192.207
| From: =?Utf-8?B?d3J5dGF0?= <wry...@discussions.microsoft.com>

| References: <7DAABF6D-B5C0-489B...@microsoft.com>
<5vKCszn...@TK2MSFTNGHUB02.phx.gbl>
<77E03B83-6AAA-4D5B...@microsoft.com>
<eKtS2YOq...@TK2MSFTNGHUB02.phx.gbl>

| Subject: RE: Data Execution Prevention: IIS Worker Process

| Date: Sun, 10 Jun 2007 18:20:00 -0700
| Lines: 304
| Message-ID: <7C0BA271-612C-4774...@microsoft.com>

| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:43006

wrytat

unread,

Jun 11, 2007, 3:04:01 AM6/11/07

to

In that case, it would be most ideal to restart during midnight. But do you
know of any script that can restart an OS?

Terence Liu [MSFT]

unread,

Jun 12, 2007, 4:24:53 AM6/12/07

to

Hello Customer,

Thank you for kind update.

We can create a scheduled task to run the command "shutdown -r" to restart
the SBS at scheduled time.

1. Open Control panel->Scheduled Tasks on SBS

2. Double click Add Scheduled Task

3. Click Next

4. Browse to c:\windows\system32\shutdown.exe

5. Select One time only, Click Next

6. Select the time you want to restart the SBS, Click Next

7. Input domain administrator user name and password twice, Click Next

8. Select Open advanced properties for this task when I click Finish, Click
Finish.

9. In the Run box, add " -r" behind the line, make it as
"c:\windows\system32\shutdown.exe -r", click OK

10. You will still ask to input domain administrator password twice. Input
twice, click OK

Best regards,

Terence Liu(MSFT)

Get Secure! - www.microsoft.com/security

| thread-index: Acer9rCEVZTULaWGTviEer/rp0pppw==

| X-WBNR-Posting-Host: 207.46.19.197
| From: =?Utf-8?B?d3J5dGF0?= <wry...@discussions.microsoft.com>
| References: <7DAABF6D-B5C0-489B...@microsoft.com>
<5vKCszn...@TK2MSFTNGHUB02.phx.gbl>

<77E03B83-6AAA-4D5B...@microsoft.com>
<eKtS2YOq...@TK2MSFTNGHUB02.phx.gbl>
<7C0BA271-612C-4774...@microsoft.com>
<pDmpdI$qHHA...@TK2MSFTNGHUB02.phx.gbl>

| Subject: RE: Data Execution Prevention: IIS Worker Process

| Date: Mon, 11 Jun 2007 00:04:01 -0700
| Lines: 305
| Message-ID: <91BABDBF-F0F4-423E...@microsoft.com>

| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:43031