Results 1 to 4 of 4
  1. #1
    Lurker
    Join Date
    Aug 2015
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Application Crash after inactivity Application Event ID: 1026, 1000, 1005, 1001. Security Event ID:

    For several months now i have problem with my 3rd party application. After some inactivity on application, application crash.

    What I checked. 1. Network. 2. Updates (without servers, on PC and server i install latest updates).
    Locally application works ok (the same environment as the server application). The problem must be on the server-side (in the logs nothing). I have no idea what is wrong.
    Work environment:
    Domain WS2003 Forest WS2003 SQL2012 IIS7 (application pool .net 4.0)
    Users environment: .net 4.5.2 eset 5 no FW.
    All updates.
    Windows 7 all works fine Windows 8.1 randomly crash Windows 10 randomly crash


    Security event


    Code:
    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          8/22/2015 2:01:52 PM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Cryptographic operation.
    
    Subject:
        Security ID:        SYSTEM
        Account Name:       IT$
        Account Domain:     DOMAIN
        Logon ID:       0x3E7
    
    Cryptographic Parameters:
        Provider Name:  Microsoft Software Key Storage Provider
        Algorithm Name: RSA
        Key Name:   51a92691-66f1-280f-d0db-59fad4f73491
        Key Type:   User key.
    
    Cryptographic Operation:
        Operation:  Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:01:52.261719800Z" />
        <EventRecordID>5765</EventRecordID>
        <Correlation ActivityID="{FBE3EEFF-DCC3-0003-00EF-E3FBC3DCD001}" />
        <Execution ProcessID="840" ThreadID="836" />
        <Channel>Security</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-18</Data>
        <Data Name="SubjectUserName">IT$</Data>
        <Data Name="SubjectDomainName">DOMAIN</Data>
        <Data Name="SubjectLogonId">0x3e7</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">RSA</Data>
        <Data Name="KeyName">51a92691-66f1-280f-d0db-59fad4f73491</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>
    
    
    ----------------
    
    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          8/22/2015 2:01:52 PM
    Event ID:      5058
    Task Category: Other System Events
    Level:         Information
    Keywords:      Audit Success
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Key file operation.
    
    Subject:
        Security ID:        SYSTEM
        Account Name:       IT$
        Account Domain:     DOMAIN
        Logon ID:       0x3E7
    
    Cryptographic Parameters:
        Provider Name:  Microsoft Software Key Storage Provider
        Algorithm Name: UNKNOWN
        Key Name:   51a92691-66f1-280f-d0db-59fad4f73491
        Key Type:   User key.
    
    Key File Operation Information:
        File Path:  C:\ProgramData\Microsoft\Crypto\SystemKeys\6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848
        Operation:  Read persisted key from file.
        Return Code:    0x0
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5058</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12292</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8020000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:01:52.627921200Z" />
        <EventRecordID>5766</EventRecordID>
        <Correlation ActivityID="{FBE3EEFF-DCC3-0003-00EF-E3FBC3DCD001}" />
        <Execution ProcessID="840" ThreadID="836" />
        <Channel>Security</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-18</Data>
        <Data Name="SubjectUserName">IT$</Data>
        <Data Name="SubjectDomainName">DOMAIN</Data>
        <Data Name="SubjectLogonId">0x3e7</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">UNKNOWN</Data>
        <Data Name="KeyName">51a92691-66f1-280f-d0db-59fad4f73491</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="KeyFilePath">C:\ProgramData\Microsoft\Crypto\SystemKeys\6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848</Data>
        <Data Name="Operation">%%2458</Data>
        <Data Name="ReturnCode">0x0</Data>
      </EventData>
    </Event>
    
    
    
    ---------------------
    
    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          8/22/2015 2:01:52 PM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Cryptographic operation.
    
    Subject:
        Security ID:        SYSTEM
        Account Name:       IT$
        Account Domain:     DOMAIN
        Logon ID:       0x3E7
    
    Cryptographic Parameters:
        Provider Name:  Microsoft Software Key Storage Provider
        Algorithm Name: RSA
        Key Name:   51a92691-66f1-280f-d0db-59fad4f73491
        Key Type:   User key.
    
    Cryptographic Operation:
        Operation:  Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:01:52.629536500Z" />
        <EventRecordID>5767</EventRecordID>
        <Correlation ActivityID="{FBE3EEFF-DCC3-0003-00EF-E3FBC3DCD001}" />
        <Execution ProcessID="840" ThreadID="836" />
        <Channel>Security</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-18</Data>
        <Data Name="SubjectUserName">IT$</Data>
        <Data Name="SubjectDomainName">DOMAIN</Data>
        <Data Name="SubjectLogonId">0x3e7</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">RSA</Data>
        <Data Name="KeyName">51a92691-66f1-280f-d0db-59fad4f73491</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>

    Application event


    Code:
    Log Name:      Application
    Source:        .NET Runtime
    Date:          8/22/2015 2:01:48 PM
    Event ID:      1026
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Application: QAPP.exe
    Framework Version: v4.0.30319
    Description: The process was terminated due to an unhandled exception.
    Exception Info: System.Runtime.InteropServices.SEHException
    Stack:
    
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name=".NET Runtime" />
        <EventID Qualifiers="0">1026</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:01:48.000000000Z" />
        <EventRecordID>1752</EventRecordID>
        <Channel>Application</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>Application: QAPP.exe
    Framework Version: v4.0.30319
    Description: The process was terminated due to an unhandled exception.
    Exception Info: System.Runtime.InteropServices.SEHException
    Stack:
    </Data>
      </EventData>
    </Event>
    
    
    ----------------------------
    
    Log Name:      Application
    Source:        Application Error
    Date:          8/22/2015 2:01:50 PM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Faulting application name: QAPP.exe, version: 2.7.0.0, time stamp: 0x55d38ea8
    Faulting module name: MSVCR120_CLR0400.dll, version: 12.0.52512.0, time stamp: 0x5525ef9d
    Exception code: 0xc0000006
    Fault offset: 0x0006c91c
    Faulting process id: 0x15c0
    Faulting application start time: 0x01d0dcc4d8990a40
    Faulting application path: Y:\QAPP.exe
    Faulting module path: C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll
    Report Id: a1e7085b-5596-4180-ad49-e8c753412422
    Faulting package full name: 
    Faulting package-relative application ID: 
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:01:50.000000000Z" />
        <EventRecordID>1753</EventRecordID>
        <Channel>Application</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>QAPP.exe</Data>
        <Data>2.7.0.0</Data>
        <Data>55d38ea8</Data>
        <Data>MSVCR120_CLR0400.dll</Data>
        <Data>12.0.52512.0</Data>
        <Data>5525ef9d</Data>
        <Data>c0000006</Data>
        <Data>0006c91c</Data>
        <Data>15c0</Data>
        <Data>01d0dcc4d8990a40</Data>
        <Data>Y:\QAPP.exe</Data>
        <Data>C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll</Data>
        <Data>a1e7085b-5596-4180-ad49-e8c753412422</Data>
        <Data>
        </Data>
        <Data>
        </Data>
      </EventData>
    </Event>
    
    ----------------
    
    Log Name:      Application
    Source:        Application Error
    Date:          8/22/2015 2:01:50 PM
    Event ID:      1005
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Windows cannot access the file  for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program QAPP 2 because of this error.
    
    Program: QAPP 2
    File: 
    
    The error value is listed in the Additional Data section.
    User Action
    1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again.
    2. If the file still cannot be accessed and
        - It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted.
        - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
    3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
    4. If the problem persists, restore the file from a backup copy.
    5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance.
    
    Additional Data
    Error value: C00000C4
    Disk type: 0
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="49152">1005</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:01:50.000000000Z" />
        <EventRecordID>1754</EventRecordID>
        <Channel>Application</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>
        </Data>
        <Data>QAPP 2</Data>
        <Data>C00000C4</Data>
        <Data>0</Data>
      </EventData>
    </Event>
    
    ---------------------
    
    Log Name:      Application
    Source:        Windows Error Reporting
    Date:          8/22/2015 2:02:01 PM
    Event ID:      1001
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      IT.DOMAIN.com
    Description:
    Fault bucket 107544006236, type 1
    Event Name: APPCRASH
    Response: Not available
    Cab Id: 107391889015
    
    Problem signature:
    P1: QAPP.exe
    P2: 2.7.0.0
    P3: 55d38ea8
    P4: MSVCR120_CLR0400.dll
    P5: 12.0.52512.0
    P6: 5525ef9d
    P7: c0000006
    P8: 0006c91c
    P9: 
    P10: 
    
    Attached files:
    C:\Users\ROOT\AppData\Local\Temp\WER67E.tmp.WERInternalMetadata.xml
    C:\Users\ROOT\AppData\Local\Temp\WER11F9.tmp.appcompat.txt
    C:\ProgramData\Microsoft\Windows\WER\Temp\WER12C5.tmp.dmp
    C:\Users\ROOT\AppData\Local\Temp\WER212E.tmp.WERDataCollectionFailure.txt
    
    These files may be available here:
    C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_QAPP.exe_71de09a9e46ad1dd81f8c48d7a5f5da8a7ba4a5_6fca7ca7_cab_10562bd9
    
    Analysis symbol: 
    Rechecking for solution: 0
    Report Id: a1e7085b-5596-4180-ad49-e8c753412422
    Report Status: 9
    Hashed bucket: a393badea96984e78b0be346905441d0
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Windows Error Reporting" />
        <EventID Qualifiers="0">1001</EventID>
        <Level>4</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:02:01.000000000Z" />
        <EventRecordID>1755</EventRecordID>
        <Channel>Application</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>107544006236</Data>
        <Data>1</Data>
        <Data>APPCRASH</Data>
        <Data>Not available</Data>
        <Data>107391889015</Data>
        <Data>QAPP.exe</Data>
        <Data>2.7.0.0</Data>
        <Data>55d38ea8</Data>
        <Data>MSVCR120_CLR0400.dll</Data>
        <Data>12.0.52512.0</Data>
        <Data>5525ef9d</Data>
        <Data>c0000006</Data>
        <Data>0006c91c</Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>
    C:\Users\ROOT\AppData\Local\Temp\WER67E.tmp.WERInternalMetadata.xml
    C:\Users\ROOT\AppData\Local\Temp\WER11F9.tmp.appcompat.txt
    C:\ProgramData\Microsoft\Windows\WER\Temp\WER12C5.tmp.dmp
    C:\Users\ROOT\AppData\Local\Temp\WER212E.tmp.WERDataCollectionFailure.txt</Data>
        <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_QAPP.exe_71de09a9e46ad1dd81f8c48d7a5f5da8a7ba4a5_6fca7ca7_cab_10562bd9</Data>
        <Data>
        </Data>
        <Data>0</Data>
        <Data>a1e7085b-5596-4180-ad49-e8c753412422</Data>
        <Data>9</Data>
        <Data>a393badea96984e78b0be346905441d0</Data>
      </EventData>
    </Event>
    
    ------------------
    
    Log Name:      Application
    Source:        Microsoft-Windows-LoadPerf
    Date:          8/22/2015 2:04:48 PM
    Event ID:      1001
    Task Category: None
    Level:         Information
    Keywords:      
    User:          SYSTEM
    Computer:      IT.DOMAIN.com
    Description:
    Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-LoadPerf" Guid="{122EE297-BB47-41AE-B265-1CA8D1886D40}" />
        <EventID>1001</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2015-08-22T12:04:48.067453300Z" />
        <EventRecordID>1756</EventRecordID>
        <Correlation />
        <Execution ProcessID="6020" ThreadID="3296" />
        <Channel>Application</Channel>
        <Computer>IT.DOMAIN.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <EventXML xmlns="LoadPerf">
          <param1>WmiApRpl</param1>
          <param2>WmiApRpl</param2>
          <binaryDataSize>12</binaryDataSize>
          <binaryData>B02B0000B12B0000D6050000</binaryData>
        </EventXML>
      </UserData>
    </Event>

  2. #2

  3. #3
    Silver Lounger wavy's Avatar
    Join Date
    Dec 2009
    Location
    ny
    Posts
    2,373
    Thanks
    235
    Thanked 147 Times in 136 Posts
    Bruce how do you have the time to follow all of those I am barely keeping up w/ WS.


    David

    Just because you don't know where you are going doesn't mean any road will get you there.

  4. #4
    WS Lounge VIP access-mdb's Avatar
    Join Date
    Dec 2009
    Location
    Oxfordshire, UK
    Posts
    1,723
    Thanks
    146
    Thanked 156 Times in 149 Posts
    I suspect that Google is Bruce's friend

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •