4

Something happened on my development workstation (Windows 8.1) in the last few weeks which require me to either run my App Pools with the "Load User Profile" setting at False or not run with the identity set to ApplicationPoolIdentity. If I were to create a new app pool, using ApplicationPoolIdentity as the identity and with loadUserProfile=true, the following happens when trying to load the application in a browser:

  • A number of errors in the Windows Event Log (both System and Application types):
    • Warning event 1509 - Windows cannot copy file \\?\C:\Users\Default\AppData\Local\Microsoft\VSCommon\12.0\SQM\sqmdata-7236-039-00000.sqm to location \\?\C:\Users\[Name of App Pool]\AppData\Local\Microsoft\VSCommon\12.0\SQM\sqmdata-7236-039-00000.sqm. This error may be caused by network problems or insufficient security rights.
    • Error event 1511 - Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.
    • Another 1509 warning
    • Error event 1500 - Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, and that your network is functioning correctly. DETAIL - Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
    • 5 x event 5022 warnings - The Windows Process Activation Service failed to create a worker process for the application pool '[App Pool Name]'. The data field contains the error number.
    • Finally an error 5002 - Application pool '[App Pool Name]' is being automatically disabled due to a series of failures in the process(es) serving that application pool.
  • The App Pool is shut down, as the error 5002 said
  • "HTTP Error 503. The service is unavailable." is then seen in the browser. Any further requests are met with the same (which makes sense since the app pool is shut off).

I've seen a common "fix" for this here and here which basically say to turn off profile loading. Yes it makes the problem go away, but this doesn't get to the root cause. I know that it is possible to run with this configuration as a I have a Windows 2012 machine which supports the configuration just fine. In this case, hitting an app with a new app pool set to ApplicationPoolIdentity and loadUserProfile=true actually creates the new user profile (I can watch as the profiles folder is created in C:\Users) and the app runs merrily. What's worse is I know this configuration worked on the problem machine just a few weeks ago. I have a number of App Pools I created which have their own profiles and folder under the C:\Users folder. These app pools work just fine NOW with the ApplicationPoolIdentity and loadUserProfile=true settings. It's just that NEW app pools refuse to run and load a user profile.

Does anyone have any insight to what might be going on?

Edit: I read the bottom of this recent article. It's a bit contradictory in saying that the setting can be turned on, but also says:

Only the standard application pools (DefaultAppPool and Classic .NET AppPool) have user profiles on disk. No user profile is created if the Administrator creates a new application pool.

However, if you want, you can configure IIS application pools to load the user profile by setting the LoadUserProfile attribute to "true".

I'm very confused.

Community
  • 1
  • 1
Chris Simmons
  • 6,924
  • 5
  • 31
  • 47
  • I'm experiencing exactly the same thing. At least now I don't have to type it all out now, so thanks. I haven't created a new AppPool for a couple weeks, but I suspect the large batch of security updates that recently came through may have something to do with it. – ulty4life Apr 16 '14 at 03:18
  • @ulty4life, this was my thought too re: recent security updates, given that the behavior seems to have just cropped up recently. – Chris Simmons Apr 16 '14 at 20:26

1 Answers1

4

The SQM file listed in the event log warning was created by a Windows or Visual Studio update. When the user profile service or application pool runs and tries to create a new profile, it tries to copy the file to the profile. The SQM file requires administrator permissions to copy. The user profile service or application pool does not have sufficient permissions to copy the file, an error is generated, and the user profile is not created. Without a user profile, the application pool cannot run because it doesn't have an isolated secure place to store data.

Remove or delete the SQM file from the source directory, and the user profile will be created successfully when the app pool is initialized. You can also change the permissions on the SQM file, but I'm not sure what the appropriate permissions should be. The user profile service runs as "LocalSystem Account". See its documentation for permission info. It's unclear to me whether the application pool identity itself is being used to perform the copy operation, or the local system account.

If you remove the file from the source directory, you could also manually copy the file where it was trying to go as well.

After a very brief search about what SQM is, it seems like it is traditionally used as "service quality management". Usually it would contain information to send back to the program authors with metrics, logs, or somesuch. I don't know if this is the case with this file or not. So it doesn't seem like it's important to include it in the new profile.

I can't take 100% credit for this answer, as I was tipped off by a comment attached to an answer on some other question. I can't find the link to it in the 50 browser tabs open for troubleshooting this. That guy deserves a thank you, because I believe this is a much better solution than compromising the security of a server by pooling all the resources together like in IIS 6.

P.S. As noted in your comment, a bug report has been filed.

ulty4life
  • 2,972
  • 1
  • 25
  • 31
  • I appreciate your answer, but my concern isn't too much with the SQM stuff, but more the underlying problem that no user profile can be created for the App Pool user if it doesn't already exist. – Chris Simmons Apr 16 '14 at 20:27
  • When a new application pool is created with a virtual identity, the user profile doesn't get created until the app pool gets initialized for the first time. Usually this means attaching an application to it and initializing the application. The permission denied on the SQM file copy operation prevents the profile from being created because it causes an error. I may not be understanding what you're getting at with "can't be created if it doesn't already exist." – ulty4life Apr 17 '14 at 01:56
  • I was just coming at it from the wrong direction. I thought the SQM file was a symptom of the issue, but now I see it is the cause. It's permissions on the file itself that just need to be fixed. See [this](http://social.technet.microsoft.com/Forums/windows/en-US/43cb5946-9d82-4973-b8a1-4053aa688ba8/user-profile-service-failed-the-signin-user-profile-cannot-be-loaded-for-any-new-accounts?forum=w8itprogeneral). If you agree, edit your answer and I'll accept. – Chris Simmons Apr 17 '14 at 04:07
  • There's a [bug report](https://connect.microsoft.com/VisualStudio/feedback/details/838232/update-kb2932965-creates-sqm-files-in-the-default-user-profile-that-prevent-new-local-user-accounts-to-login-to-windows), referencing the suspected [causal KB article update](http://support.microsoft.com/kb/2932965), a recent VS 2013 update. – Chris Simmons Apr 17 '14 at 04:11
  • I've updated my answer to clarify the cause of the issue and added some more detail. – ulty4life Apr 17 '14 at 20:01