Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 36 Source: W3SVC

The server failed to load application <application>. The error was '<error description>'.
- Application: /LM/W3SVC/3/Root, error: "The server process could not be started because the configured identity is incorrect. Check the username and password" - See the link to "Smartax Support Article ID: 000092".
- Application: /LM/W3SVC/1/ROOT, error: "Server execution failed" - See ME909444.
- Application: /LM/W3SVC/8/Root, error: "c000003b" - See ME812485.
- Error: "The server process could not be started because the configured identity is incorrect" - See ME321448 and ME922739.
- Error: "The specified metadata was not found" - See ME922741.

See ME257267 for additional information on this event.
- Error: "Class not registered" - Try the following to resolve this problem:

1. Delete IIS related package in Component Services MMC
- IIS In-Process Applications.
- IIS Out-of-Process Pooled Applications.
- IIS Utilities.
If you get ''Item cannot be deleted'' go into the Properties, Advanced, and clear the ''Disable deletion'' tickbox.
2. Open command prompt, navigate to %windir%\system32\inetsrv folder, and enter (case sensitive):
c:\winnt\system32\inetsrv\>rundll32 wamreg.dll, CreateIISPackage
c:\winnt\system32\inetsrv\>regsvr32 asptxn.dll

3. Enter IISRESET at the command prompt to restart IIS services, and then re-open Component Services MMC to verify that the IIS packages are recreated.

See the link to "The famous Class not registered" for the original post.
In one case, this Event ID started for the IWAM_MachineName account on a domain controller when the Kerberos settings were put right in the Default Domain Controllers Policy. They had previously been set to Not defined. This Event ID was accompanied by Event ID 529, Source Security and Event ID 675, Source Security. The password for the IWAM_MachineName account was mismatched between the Windows Active Directory and the IIS metabase. See Event ID 101, Source IISADMIN.
- Error: "No such interface supported" - This behavior may occur because, during the installation of Crystal Reports 8, permissions for the registry subkeys and their lower-level subkeys are modified. See ME286814 to find out how you can fix this problem.
- Error: "The server process could not be started because the configured identity is incorrect" - See ME298119.

This issue may also occur if the permissions are not correctly configured for the IWAM_ComputerName account or the IUSR_ComputerName account. See ME822699 for more details.

As per Microsoft: "The corresponding Web application does not have a name specified or does not have the Script permission enabled". See ME200514 for more details.

If this problem appears when you attempt to access the user interface (UI) for Symantec AntiVirus/Filtering 3.0 for Microsoft Exchange (AV/F for Exchange) or Symantec Mail Security 4.0 for Microsoft Exchange (SMS for Exchange), then see “Symantec Support Document ID:2002030113174254” for details on this issue.
- Error: "No such interface supported" - See ME286814.

- Application: /LM/W3SVC/1/ROOT, error: "General access denied error" - See ME842329 to resolve this problem.
For us this event was triggered when Outlook Web Access (2003) users clicked the "Log Off" shortcut. The OWA user would receive the following message when logging off: "The page cannot be displayed. There is a problem with the page you are trying to reach and it cannot be displayed". I found information in the microsoft.public.exchange2000.connectivity newsgroup, which fixed our problem. See the link to “Google Thread” to read the thread.
The problem may be due to incorrect NTFS permissions for the IUSR_<machine name> and IWAM_<machine name> accounts. Work through MS ME271071 and verify that everything is correct. Note, you will need to turn off Simple File Sharing in XP to do this. Also, run FileMon (see EV100014) to find out what something is trying to access, but does not have permission to access. Look for access denied under dllhost.exe. Put the IWAM__<machine name> in the Administrator group and restart the machine.
We used IISExport utility to migrate the whole server. One of the sites configured in IIS had the redirection set. The whole site should have been redirected to another URL. For some reason this setting was not migrated so the site was configured as a path to the local directory on the box. Obviously, no application was created for this site. Changing this setting to redirect fixed the problem.
This event occurs when there is no application defined for the website (hence no metadata for it in the metabase). Resolution: in the website properties, "Home Directory" tab, click the "Create" button in the "Application settings" section, and specify the proper settings for the application, or just leave the defaults. Click "OK" to save the settings.
This error usually indicates a problem with the IIS server. One reported solution is to change the settings for AV/F for Exchange or SMS for Exchange, Home directory application protection from Medium (Pooled) to Low (IIS Process). To change the settings for IIS 5.0 server do the following:
Open IIS 5.0, double-click <server name> to expand. Right-click Symantec Antivirus/Filtering for Microsoft Exchange 2000 and click Properties. Click the "Home Directory" tab. Click the Application Protection drop-down list. Click Low (IIS Process). Click Apply and OK.
Error "The server process could not be started because the configured identity is incorrect. Check the username and password." - I fixed this issue by running "adsutil.vbs" in the \inetpub\adminscript directory to enumerate the password. See ME297989.
Error: "The specified metadata was not found." - This error occurred after installing Exchange and then trying to use the logoff button through Outlook Web Access. When the button is used, an error page with a 500 server error would appear, instead of the logoff page. There was no metadata corruption. Putting IWAM and IUSR in the administrators group did not work. Running synciwam.vbs did not help. Changing various directory permissions did not work either. What did work were the steps in article ME318239. After following the steps, the logoff page worked and I would not receive the error in the event log.
Error: "The specified metadata was not found.". The Metabase was not corrupted, the problem I've found was that the IIS Web Site Root did not have any Default Application created.

When you upgrade your computer to Microsoft Windows 2000, you may find problems when starting the Component Services snap-in from Administrative tools, or you may notice problems when trying to run ASP pages. See ME246499.
Error: "The server process could not be started because the configured identity is incorrect. Check the username and password." - We encountered this error when the IWAM_machine account went out-of-sync, usually after a server reboot. This can be fixed by running the Synciwam.vbs from \Inetpub\AdminScripts directory. See ME255770.

See also the articles about this error at
Error - "The server failed to load application '/LM/W3SVC/1/ROOT'. The error was 'Server execution failed "." - See ME282073
Error: "The server process could not be started because the configured identity is incorrect. Check the username and password". As per Microsoft this error could be resolved using Local Security Policy setting in User Rights Assignment. See ME297519.
On checking the status of the com+applications under componant services I discovered that IIS Out-Of-Process Pooled Applications was gone.
Removing and uninstalling either IIS or MSDTC did not fix the issue of reinstalling this com+ application.
With some tinkering I managed to export it from another server as an MSI/CAB com+ application and re-installed it on the problematic server with the COM Application install wizard.
At this stage I resynchronised the IWAM_machinename account password and finished off with removing IIS and reinstalling it.
After all this was completed I was able to re-access both the default and administration website in IIS.
Description:  The server failed to load application ‘/LM/W3SVC/x/ROOT’.  The error was ‘8007053d’.  According to the following knowledgebase article, this indicates the metabase may be corrupted.  See ME238665 for additional information.
- Error: "The server failed to load application '/LM/W3SVC/1/ROOT'. The error was 'No such interface supported'". It could be a result of CodeRed or Nimda attacks.
Error: "The specified metadata was not found." - According to a newsgroup post the matabase might be corrupted. Try enumerate your metabase:
1. Open a command prompt and change to the C:\Inetpub\Adminscripts folder.
2. At the command line, type "cscript adsutil.vbs enum" (without the quotation marks). If this command is successful, it enumerates the settings in the metabase. If the command is not successful, you receive the -2146893792 (0x80090020) error code.

If you get error, try to restore from backup if you have one. If you don't have metabase backup, try to follow the instructions in the article ME234429.

From another newsgroup post the solution was to put the IUSR and IWAM accounts in the local Administrators group first, and then run Synciwam.vbs at the command line as follows: D:\Inetpub\AdminScripts>cscript synciwam.vbs /v

Error: "Server execution failed." - Related to ASP in IIS 5.0. See ME309051.
Error: "Server execution failed." Can be caused if NT Authority\Authenticated Users or NT Authority\Interactive have been removed from the "Users" built-in group on the server. See ME327153.

This problem was encountered for the first time after a server crash ("Security Event Log full", even though the "overwrite events as needed" option was active). Other crashes had never caused this Trying to access the web site via internet resulted to the "HTTP 500 - Internal Server Error" error.Running synciwam.vbs fixed the problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.