| Event Id | 1026 |
| Source | Microsoft-Windows-IIS-W3SVC |
| Description | The World Wide Web Publishing Service (WWW Service) encountered an error when it tried to secure the handle of application pool %1 from HTTP.sys. Edit the identification information for the application pool so that the WWW Service can secure the handle of the application pool again. The data field contains the error number. |
| Event Information | " According to Microsoft : Cause : This event is logged when World Wide Web Publishing Service (WWW Service) encountered an error when it tried to secure the handle of application pool from HTTP.sys. Resolution : Set the application pool identity and restart the application pool The application pool identity must be set to a valid account for the application pool to function. There are two types of Identity for the application pools: Built-in and Custom . The built-in accounts are NetworkService , LocalService , and LocalSystem . The default (recommended) is NetworkService . If you set the application pool identity to a custom account, you will have to ensure that the user credentials are valid and that the user is a member of the IIS_USRS group. The following procedures describe how to set the application pool identity and then restart the application pool. To perform these procedures, you must have membership in Administrators , or you must have been delegated the appropriate authority. To set the application pool identity: 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) Manager and select Run as administrator . 3.In the Connections pane on the left, expand the computer, then select the Application Pools folder underneath the computer name. 4.In Features View , select the application pool. In the Actions pane, select Advanced Settings... 5.Under Process Model , verify the Identity type. The default is NetworkService . 6.If the identity type is set to a specific user (not one of the built-in accounts), click the … button to the right of the identity name, and click Set to specify the custom account credentials. 7.If you specified a custom user, continue with the next step; otherwise, skip to the procedure for stopping and restarting the application pool. If the application pool identity is set to a custom user, you have to add the user to the IIS_USRS group on the computer. To add a specific user (custom account) to the IIS_USRS group: 1.Click Start, Administrative Tools, Computer Management . 2.In the left pane, expand Local Users and Groups . 3.Select Groups , then double-click IIS_USRS. 4.Add the custom user that you specified earlier for the process model identity. 5.Stop and restart the Web services by using the steps in the next procedure. Note : After you add a user to the IIS_USRS group, the Web services must be stopped and restarted for the new logon rights to take effect. This will stop all Web traffic to the server. If you did not add an identity to the IIS_USRS group, continue to the steps to stop and restart the application pool. To stop and restart the Web services: 1.Open an elevated Command Prompt window. Click Start , point to All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator . 2.Type net stop was /y and press ENTER. 3.Type net start was and press ENTER. 4.Type net start w3svc and press ENTER. To stop and restart the application pool: 1.Open IIS Manager. In the Connections pane, expand the server node and click Application Pools . 2.In Features View , select the application pool you want to stop and restart. 3.In the Actions pane , click Stop to stop the application pool, then Start to restart the application pool. Verify : To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To verify that an application pool has started: 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) Manager and select Run as administrator . 3.In the Connections pane, expand the server node and select Application Pools . 4.In Features View , the Status column for the application pool will indicate Started if the application pool has started. " |
| Reference Links | Event ID 1026 from Microsoft-Windows-IIS-W3SVC |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.