Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2276 Source: Microsoft-Windows-IIS-WMSVC

Level
Description
The worker process failed to initialize correctly and therefore could not be started. The data is the error.
Comments
 
Issue:
===============
Application pool doesn't start after a reboot of the serve which is windows 2008 R2 sp1. Event logs would show an event id 2276 and description "the worker process failed to initialize correctly".

Resolution:
===============
According to ME981949 the following users/groups should have permissions to “Bypass Traverse Checking” local security policy as default users rights and permissions.

Everyone
LOCAL SERVICE
NETWORK SERVICE
Administrators
Users
Backup Operators

We found these privileges were missing and granting this privilege to these users/groups (especially Everyone group) fixed the issue.
T734972 suggests the following resolutions:
- If the module is third-party, contact the module vendor. The vendor should have more specific knowledge about the module's features and behavior.
- If the module failed to load because of a processor mismatch, see ME894435.
- Check the event log message for a specific error number that may provide more information. This error number will be different from the Event ID (See the article on how to do this).

The XML portion of the event includes the "Data". For example:
  <EventData>
    <Binary>05000780</Binary>
  </EventData>

The 05000780 binary data corresponds to an "Access denied" error (see Error code 0x80070005).
The 02000780 corresponds to a "Missing files" error (see Error code 0x80070002)

One user that was getting this event with the Data recorded as "02000780" resolved this by uninstalling IIS7 and then re-installing.
From a support forum:
I was trying to get a basic site working with Windows 7 after doing a Visual Studio 2010 install. But the site was generating the "HTTP Error 503. The service is unavailable." error message and in the event log I got event id 2294 ("The worker process failed to pre-load .Net Runtime version v4.0.303.") followed by event id 2276 . In my troubleshooting I have done the following:
- I found I needed to run (from the C:\Windows\Microsoft.NET\Framework64\v4.0.30319 directory) aspnet_regiis- i
- I opened the port on the router and the firewall.

I found a file called V4.0.0.303 (of size 0 bytes) that was sitting in the directory (C:\Windows\Microsoft.NET\Framework64) and once I removed it, the problem went away.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...