| Event Id | 5127 |
| Source | Microsoft-Windows-WAS |
| Description | A worker process '%2' serving application pool '%1' is no longer trusted by the Windows Process Activation Service, based on ill-formed data the worker process sent to the service. The data field contains the error number. |
| Event Information | According to Microsoft : Cause : This event is logged when worker process serving application pool is no longer trusted by the Windows Process Activation Service, based on ill-formed data the worker process sent to the service. Resolution : Check an untrusted worker process A worker process has sent some data to the Windows Process Activation Service (WAS) that was not expected. User code may be trying to engage in malicious activity in the worker process and may have taken over the communication pipe. For example, user code may be sending a second process ID to WAS for the worker process, or be sending performance counter numbers that are not in the right form. This could be an attempt to create a buffer overrun in WAS. To resolve this issue, examine the worker process to see whether it contains suspect user code. Check the loaded modules. If ISAPI or third-party modules are running, contact the vendor of the modules for more information. Verify : To perform this procedure, you must have membership in Administrators , or you must have been delegated the appropriate authority. To verify that an application pool has started: 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) Manager and select Run as administrator . 3.In the Connections pane, expand the server node and select Application Pools . 4.In Features View , the Status column for the application pool will indicate Started if the application pool has started. |
| Reference Links | Event ID 5127 from Microsoft-Windows-WAS |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.