DefaultAppPool is being automatically disabled due to a series of failures in the process(es) serving that application pool

Question

DefaultAppPool is being automatically disabled due to a series of failures in the process(es) serving that application pool

Brown, Matt 146

We are running into this issue. I installed the Debug Diagnostic Tool. Here's the initial output from the debug. Tis has been an issue across multiple websites, but it is currently an issue across two them.

In w3wp__DefaultAppPool__PID__344__Date__10_03_2025__Time_07_21_50AM__792__Second_Chance_Exception_C0000374.dmp the assembly instruction at ntdll!RtlpNtMakeTemporaryKey+113 in C:\Windows\System32\ntdll.dll from Microsoft Corporation has caused a corrupted heap exception (0xC0000374) when trying to perform an unknown operation on memory location 0x00000000 on thread 4

Clicking on the number 4 for the thread shows this.

Thread 4 - System ID 8196

2 answers

Your answer

Answer 1

Hi @Brown, Matt ,

Sorry for the late reply and thanks for sharing the details!

Based on the error, the application pool is being disabled because IIS Rapid-Fail Protection detected repeated crashes of the worker process (w3wp.exe). The dump shows a heap corruption exception (0xC0000374) occurring in ntdll.dll, which typically indicates an issue with native code or unmanaged components rather than IIS itself. Especially when multiple sites share DefaultAppPool.

References:

Rapid‑Fail Protection settings

Common causes are:

Rapid‑Fail Protection (RFP):

IIS automatically takes an app pool out of service when too many failures occur within a time window (e.g., 5 crashes in 5 minutes by default). This protects overall server stability.
See the programmatic setting: RapidFailProtection property

Heap corruption (0xC0000374):

This class of crash is typically caused by native code writing past buffers, double frees, or allocator mismatches. It’s common for the fault site to appear as a Microsoft DLL (e.g., ntdll.dll), even though the root cause is a third‑party/native component loaded in the process.
See Microsoft’s PageHeap/GFlags approach to catch heap corrupters earlier in the call flow: GFlags & PageHeap, Enable Page Heap

Recommended approaches

1. Isolate each site into its own application pool

If several sites share DefaultAppPool, one problematic site or a global module can take them all down. Move each site to a dedicated pool to narrow the scope and limit impact.
Reference: IIS application pool basics & isolation, and Microsoft’s crash guide (recommendation to split apps into separate pools): Process crash guidance

2. Inventory and temporarily disable non‑Microsoft modules/filters

From an elevated console:

%windir%\system32\inetsrv\appcmd list module
%windir%\system32\inetsrv\appcmd list config /section:isapifilter
%windir%\system32\inetsrv\appcmd list config /section=handlers

Look for third‑party or custom modules. Temporarily disable them (off‑hours) and re‑test.

Reference:

3. Collect targeted crash dumps with DebugDiag (Crash Rule)

Configure a Crash rule for the affected app pool and capture full user dumps on first/second‑chance exceptions. This gives a reliable call stack and loaded‑module list to identify the culprit DLL.
(Optional) Older step‑by‑step for DebugDiag: Microsoft Support article

4. Use PageHeap to catch the actual corrupter earlier (test or maintenance window)

PageHeap often turns a late 0xC0000374 crash into an earlier, more actionable fault where the offending module is on top of the stack.

Enable (example):

gflags /p /enable w3wp.exe /full

5. Add WER LocalDumps as a safety net

If a crash happens outside your DebugDiag rule window, Windows Error Reporting can still drop a full dump:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe]
DumpType=2 (REG_DWORD)
DumpCount=10 (REG_DWORD)

Reference: Collecting user‑mode dumps (WER)

6. Check security/AV/EDR hooks

Endpoint security products sometimes inject DLLs into w3wp.exe. We’ve seen cases where disabling AV/EDR or adding exclusions stopped 0xC0000374 crashes. If policy allows, test with temporary exclusions for the site directory and worker process.

Example case: Exchange 2016 w3wp.exe repeated crashes resolved by disabling AV

7. Verify platform “bitness” alignment for native dependencies

If any dependency is 32‑bit only, set the app pool’s Enable 32‑Bit Applications = True; for 64‑bit components, keep it False.

References: ApplicationPool.Enable32BitAppOnWin64 (API), and a practical IIS note on 64‑bit systems requiring 32‑bit mode for certain drivers (e.g., Jet/Access): Working with 64‑bit systems

8. Correlate with Event Viewer

System log (WAS/IIS): events such as “A process serving application pool <name> suffered a fatal communication error…”
Application log: Application Error (Event ID 1000) shows faulting module, offsets, and exception code.
Reference: Identify crash events & fields to capture

If possible, please provide more information so we can pinpoint the issue:

Windows Server & IIS versions.
Output of:

%windir%\system32\inetsrv\appcmd list module
%windir%\system32\inetsrv\appcmd list config /section:isapifilter

Your latest DebugDiag Analysis Summary (top crashing thread stack + faulting/loaded modules).
Any AV/EDR in use and whether its DLLs appear in the dump.

The first 3 steps are usually enough, the rest are optional and only needed if the first 3 don't resolve the issue or if you need deeper diagnostics.

I hope this helps! Please try out all the steps and keep me updated on the situation.

Answer 2

One of the app pools has only one site tied to it. I'm also working on trying to get Process Monitor data when I can. Servers are 2016 with one being 2022. We use IIS10.

I didn't notice how the rest of the one part of my message wasn't posted. Here should be the rest of it. I'm not sure if this is related to the new SSO which uses OpenAmModule as that would explain why multiple servers went down. The most recent server to add the new SSO was in January.

Thread 4 - System ID 8196
Entry point	  w3tp!THREAD_POOL::CreateThreadPool+350
Create time	  10/3/2025 7:20:33 AM
Time spent in user mode	  0 Days 00:00:00.000
Time spent in kernel mode	  0 Days 00:00:00.031


This thread is not fully resolved and may or may not be a problem. Further analysis of these threads may be required.


Call Stack

ntdll!RtlpNtMakeTemporaryKey+113
ntdll!RtlpNtMakeTemporaryKey+ab2
ntdll!RtlRaiseStatus+11a
ntdll!RtlFreeHeap+823
mod_iis_openam_64!RegisterModule+b19c
mod_iis_openam_64+17641
mod_iis_openam_64+17f12
mod_iis_openam_64+1b474
mod_iis_openam_64+23220
mod_iis_openam_64+5f6d2
iiscore+d3f9
iiscore+cd9c
iiscore+cbe6
iiscore+dc1f
iiscore+11c06
w3dt!UlAtqSendEntityBody+c5
w3tp!THREAD_POOL::CreateThreadPool+4f3
w3tp!THREAD_POOL::CreateThreadPool+443
w3tp!THREAD_POOL::CreateThreadPool+399
kernel32!BaseThreadInitThunk+14
ntdll!RtlUserThreadStart+21

MODULE "IsapiModule" ( native, preCondition: )

MODULE "BasicAuthenticationModule" ( native, preCondition: )

MODULE "HttpLoggingModule" ( native, preCondition: )

MODULE "HttpCacheModule" ( native, preCondition: )

MODULE "StaticCompressionModule" ( native, preCondition: )

MODULE "DefaultDocumentModule" ( native, preCondition: )

MODULE "DirectoryListingModule" ( native, preCondition: )

MODULE "IsapiFilterModule" ( native, preCondition: )

MODULE "ProtocolSupportModule" ( native, preCondition: )

MODULE "StaticFileModule" ( native, preCondition: )

MODULE "AnonymousAuthenticationModule" ( native, preCondition: )

MODULE "RequestFilteringModule" ( native, preCondition: )

MODULE "CustomErrorModule" ( native, preCondition: )

MODULE "ServerSideIncludeModule" ( native, preCondition: )

MODULE "UrlRoutingModule-4.0" ( type:System.Web.Routing.UrlRoutingModule, preCondition:managedHandler,runtimeVersionv4.0 )

MODULE "ScriptModule-4.0" ( type:System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, preCondition:managedHandler,runtimeVersionv4.0 )

MODULE "OutputCache" ( type:System.Web.Caching.OutputCacheModule, preCondition:managedHandler )

MODULE "Session" ( type:System.Web.SessionState.SessionStateModule, preCondition:managedHandler )

MODULE "WindowsAuthenticationModule" ( native, preCondition: )

MODULE "WindowsAuthentication" ( type:System.Web.Security.WindowsAuthenticationModule, preCondition:managedHandler )

MODULE "FormsAuthentication" ( type:System.Web.Security.FormsAuthenticationModule, preCondition:managedHandler )

MODULE "DefaultAuthentication" ( type:System.Web.Security.DefaultAuthenticationModule, preCondition:managedHandler )

MODULE "RoleManager" ( type:System.Web.Security.RoleManagerModule, preCondition:managedHandler )

MODULE "UrlAuthorization" ( type:System.Web.Security.UrlAuthorizationModule, preCondition:managedHandler )

MODULE "FileAuthorization" ( type:System.Web.Security.FileAuthorizationModule, preCondition:managedHandler )

MODULE "AnonymousIdentification" ( type:System.Web.Security.AnonymousIdentificationModule, preCondition:managedHandler )

MODULE "Profile" ( type:System.Web.Profile.ProfileModule, preCondition:managedHandler )

MODULE "UrlMappingsModule" ( type:System.Web.UrlMappingsModule, preCondition:managedHandler )

MODULE "ConfigurationValidationModule" ( native, preCondition: )

MODULE "HttpRedirectionModule" ( native, preCondition: )

MODULE "IpRestrictionModule" ( native, preCondition: )

MODULE "DynamicIpRestrictionModule" ( native, preCondition: )

MODULE "CgiModule" ( native, preCondition: )

MODULE "FastCgiModule" ( native, preCondition: )

MODULE "IISCertificateMappingAuthenticationModule" ( native, preCondition: )

MODULE "CustomLoggingModule" ( native, preCondition: )

MODULE "FailedRequestsTracingModule" ( native, preCondition: )

MODULE "WebDAVModule" ( native, preCondition: )

MODULE "RewriteModule" ( native, preCondition: )

<system.webServer>

<filter name="ASP.Net_2.0.50727-64" path="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_filter.dll" enabled="true" enableCache="true" preCondition="runtimeVersionv2.0,bitness64" />

<filter name="ASP.Net_2.0.50727.0" path="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll" enabled="true" enableCache="true" preCondition="runtimeVersionv2.0,bitness32" />

<filter name="ASP.Net_2.0_for_V1.1" path="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll" enabled="true" enableCache="false" preCondition="bitness32" />

<filter name="ASP.Net_4.0_64bit" path="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_filter.dll" enabled="true" enableCache="true" preCondition="runtimeVersionv4.0,bitness64" />

<filter name="ASP.Net_4.0_32bit" path="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_filter.dll" enabled="true" enableCache="true" preCondition="runtimeVersionv4.0,bitness32" />

<filter name="IIS75Filter" path="D:\MW\CA\webagent\win64\bin\ISAPI6WebAgent.dll" enabled="true" enableCache="false" preCondition="bitness64" />

</isapiFilters>

</system.webServer>

<system.webServer>

<add name="WebDAV" path="*" verb="PROPFIND,PROPPATCH,MKCOL,PUT,COPY,DELETE,MOVE,LOCK,UNLOCK" modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />

<add name="ASPClassic" path="*.asp" verb="GET,HEAD,POST" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="File" />

<add name="SecurityCertificate" path="*.cer" verb="GET,HEAD,POST" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="File" />

<add name="ISAPI-dll" path="*.dll" verb="*" modules="IsapiModule" resourceType="File" requireAccess="Execute" allowPathInfo="true" />

<add name="CGI-exe" path="*.exe" verb="*" modules="CgiModule" resourceType="File" requireAccess="Execute" allowPathInfo="true" />

<add name="AXD-ISAPI-4.0_64bit" path="*.axd" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="PageHandlerFactory-ISAPI-4.0_64bit" path="*.aspx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="SimpleHandlerFactory-ISAPI-4.0_64bit" path="*.ashx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="WebServiceHandlerFactory-ISAPI-4.0_64bit" path="*.asmx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-rem-ISAPI-4.0_64bit" path="*.rem" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-soap-ISAPI-4.0_64bit" path="*.soap" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="aspq-ISAPI-4.0_64bit" path="*.aspq" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="cshtm-ISAPI-4.0_64bit" path="*.cshtm" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="cshtml-ISAPI-4.0_64bit" path="*.cshtml" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="vbhtm-ISAPI-4.0_64bit" path="*.vbhtm" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="vbhtml-ISAPI-4.0_64bit" path="*.vbhtml" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="TraceHandler-Integrated-4.0" path="trace.axd" verb="GET,HEAD,POST,DEBUG" type="System.Web.Handlers.TraceHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="WebAdminHandler-Integrated-4.0" path="WebAdmin.axd" verb="GET,DEBUG" type="System.Web.Handlers.WebAdminHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="AssemblyResourceLoader-Integrated-4.0" path="WebResource.axd" verb="GET,DEBUG" type="System.Web.Handlers.AssemblyResourceLoader" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="PageHandlerFactory-Integrated-4.0" path="*.aspx" verb="GET,HEAD,POST,DEBUG" type="System.Web.UI.PageHandlerFactory" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="SimpleHandlerFactory-Integrated-4.0" path="*.ashx" verb="GET,HEAD,POST,DEBUG" type="System.Web.UI.SimpleHandlerFactory" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="WebServiceHandlerFactory-Integrated-4.0" path="*.asmx" verb="GET,HEAD,POST,DEBUG" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="HttpRemotingHandlerFactory-rem-Integrated-4.0" path="*.rem" verb="GET,HEAD,POST,DEBUG" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="HttpRemotingHandlerFactory-soap-Integrated-4.0" path="*.soap" verb="GET,HEAD,POST,DEBUG" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="aspq-Integrated-4.0" path="*.aspq" verb="GET,HEAD,POST,DEBUG" type="System.Web.HttpForbiddenHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="cshtm-Integrated-4.0" path="*.cshtm" verb="GET,HEAD,POST,DEBUG" type="System.Web.HttpForbiddenHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="cshtml-Integrated-4.0" path="*.cshtml" verb="GET,HEAD,POST,DEBUG" type="System.Web.HttpForbiddenHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="vbhtm-Integrated-4.0" path="*.vbhtm" verb="GET,HEAD,POST,DEBUG" type="System.Web.HttpForbiddenHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="vbhtml-Integrated-4.0" path="*.vbhtml" verb="GET,HEAD,POST,DEBUG" type="System.Web.HttpForbiddenHandler" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="ScriptHandlerFactoryAppServices-Integrated-4.0" path="*_AppService.axd" verb="*" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="ScriptResourceIntegrated-4.0" path="*ScriptResource.axd" verb="GET,HEAD" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" preCondition="integratedMode,runtimeVersionv4.0" />

<add name="AXD-ISAPI-4.0_32bit" path="*.axd" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="PageHandlerFactory-ISAPI-4.0_32bit" path="*.aspx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="SimpleHandlerFactory-ISAPI-4.0_32bit" path="*.ashx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="WebServiceHandlerFactory-ISAPI-4.0_32bit" path="*.asmx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-rem-ISAPI-4.0_32bit" path="*.rem" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-soap-ISAPI-4.0_32bit" path="*.soap" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="aspq-ISAPI-4.0_32bit" path="*.aspq" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="cshtm-ISAPI-4.0_32bit" path="*.cshtm" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="cshtml-ISAPI-4.0_32bit" path="*.cshtml" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="vbhtm-ISAPI-4.0_32bit" path="*.vbhtm" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="vbhtml-ISAPI-4.0_32bit" path="*.vbhtml" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="TraceHandler-Integrated" path="trace.axd" verb="GET,HEAD,POST,DEBUG" type="System.Web.Handlers.TraceHandler" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="WebAdminHandler-Integrated" path="WebAdmin.axd" verb="GET,DEBUG" type="System.Web.Handlers.WebAdminHandler" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="AssemblyResourceLoader-Integrated" path="WebResource.axd" verb="GET,DEBUG" type="System.Web.Handlers.AssemblyResourceLoader" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="PageHandlerFactory-Integrated" path="*.aspx" verb="GET,HEAD,POST,DEBUG" type="System.Web.UI.PageHandlerFactory" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="SimpleHandlerFactory-Integrated" path="*.ashx" verb="GET,HEAD,POST,DEBUG" type="System.Web.UI.SimpleHandlerFactory" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="WebServiceHandlerFactory-Integrated" path="*.asmx" verb="GET,HEAD,POST,DEBUG" type="System.Web.Services.Protocols.WebServiceHandlerFactory, System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="HttpRemotingHandlerFactory-rem-Integrated" path="*.rem" verb="GET,HEAD,POST,DEBUG" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="HttpRemotingHandlerFactory-soap-Integrated" path="*.soap" verb="GET,HEAD,POST,DEBUG" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="integratedMode,runtimeVersionv2.0" />

<add name="AXD-ISAPI-2.0" path="*.axd" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

<add name="PageHandlerFactory-ISAPI-2.0" path="*.aspx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

<add name="SimpleHandlerFactory-ISAPI-2.0" path="*.ashx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

<add name="WebServiceHandlerFactory-ISAPI-2.0" path="*.asmx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-rem-ISAPI-2.0" path="*.rem" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-soap-ISAPI-2.0" path="*.soap" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

<add name="AXD-ISAPI-2.0-64" path="*.axd" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />

<add name="PageHandlerFactory-ISAPI-2.0-64" path="*.aspx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />

<add name="SimpleHandlerFactory-ISAPI-2.0-64" path="*.ashx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />

<add name="WebServiceHandlerFactory-ISAPI-2.0-64" path="*.asmx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-rem-ISAPI-2.0-64" path="*.rem" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />

<add name="HttpRemotingHandlerFactory-soap-ISAPI-2.0-64" path="*.soap" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />

<add name="SSINC-stm" path="*.stm" verb="GET,HEAD,POST" modules="ServerSideIncludeModule" resourceType="File" />

<add name="SSINC-shtm" path="*.shtm" verb="GET,HEAD,POST" modules="ServerSideIncludeModule" resourceType="File" />

<add name="SSINC-shtml" path="*.shtml" verb="GET,HEAD,POST" modules="ServerSideIncludeModule" resourceType="File" />

<add name="TRACEVerbHandler" path="*" verb="TRACE" modules="ProtocolSupportModule" requireAccess="None" />

<add name="OPTIONSVerbHandler" path="*" verb="OPTIONS" modules="ProtocolSupportModule" requireAccess="None" />

<add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />

<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" responseBufferLimit="0" />

<add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />

</handlers>

</system.webServer>

Tom Tran (WICLOUD CORPORATION) 1,920 Reputation points Microsoft External Staff

2025-10-08T03:01:51.7966667+00:00

Hi @Brown, Matt ,

Just checking in to see how you are doing - I hope you are doing well! If you have any questions, please leave a comment below. I'll be happy to help out!
Brown, Matt 146 Reputation points

2025-10-17T18:42:23.83+00:00

In short, is there documentation or a video explaining how to back up everything for IIS so I can do a reinstall of it?
Tom Tran (WICLOUD CORPORATION) 1,920 Reputation points Microsoft External Staff

2025-10-20T02:41:41.3866667+00:00

Hi @Brown, Matt ,

Sorry for the late reply.

In short, is there documentation or a video explaining how to back up everything for IIS so I can do a reinstall of it?

The answer is Yes. IIS stores its configuration in applicationHost.config and related files under %windir%\system32\inetsrv\config

The easiest way is using AppCmd:

Create a backup:

%windir%\system32\inetsrv\appcmd add backup "PreReinstallBackup"

Verify backups:

%windir%\system32\inetsrv\appcmd list backup

Restore if needed:

%windir%\system32\inetsrv\appcmd restore backup "PreReinstallBackup"

For extra safety, you can also copy the entire folder: %windir%\system32\inetsrv\config

Here are the resources that walk-through backup and restore, please check it out when you get the chance:

Restore-WebConfiguration (PowerShell)

How to Backup and Restore IIS Configuration (Windows OS Hub)

IIS Backup and Restore (Sysadmins of the North)

Note: Some of these articles are not from Microsoft official documents but trusted by other users. Please do not share your information and click on any strange links that pop up.

Hope this helps! Please try out these steps and tell me how it goes.
Brown, Matt 146 Reputation points

2025-10-22T05:06:27.7733333+00:00

One other question before I deep dive again. I have removed an old SSO in terms of modules, ISAPI Modules and CGI Restrictions, ISAPI Filters, Virtual Directories, and in the Registry. Yet, I can't remove the folder for the old SSO without the site crashing. It works fine temporally if I leave the folder. What could possibly be targeting the folder as I figure out what is keeping it from being fully deleted? I even try to delete it when IIS is running, and it says it can't remove the base folder as it is in use.
Tom Tran (WICLOUD CORPORATION) 1,920 Reputation points Microsoft External Staff

2025-10-22T06:27:00.75+00:00

Hi @Brown, Matt ,

From what you described, the folder is still being referenced somewhere, which is why IIS reports it as “in use.” Common culprits are usually:

The site or an application pool still pointing to that folder as its physical path.

A leftover reference in applicationHost.config (e.g., handler mappings or ISAPI filters).

A DLL or process locking the folder.

You could try these steps to help track it down:

Check site and app pool paths

Get-WebSite | Select Name, PhysicalPath

Make sure nothing points to the old folder.

Reference: Get-Website

Search for references in IIS config

findstr /I "OldFolderName" %windir%\system32\inetsrv\config\applicationHost.config

Replace OldFolderName with the actual folder name you’re trying to delete.

It searches the IIS configuration file (applicationHost.config) for any references to that folder. If it finds matches, those entries need to be removed before you can delete the folder safely.

Reference: findstr

Check for file locks (Optional)

Use Handle (a Sysinternals tool that shows which process is locking a file or folder):

handle.exe OldFolderName

You can also checkout this post below since it consists of other solutions that can be useful:

https://superuser.com/questions/2937/how-do-i-delete-a-folder-thats-in-use

Hope this helps! If possible, keep me updated on your situation. I'll be happy to assist!
Tom Tran (WICLOUD CORPORATION) 1,920 Reputation points Microsoft External Staff

2025-10-24T04:14:52.9766667+00:00

Hi @Brown, Matt ,

Just checking in to see if you have resolved your issue! If you have any more questions below, please feel free to reach out. I'll be happy to assist you!
Brown, Matt 146 Reputation points

2025-10-24T04:24:36.5666667+00:00

I was able to find the link to the old SSO and removed it. This enabled me to delete all of the old files. A short summary of what has happened, there is a team which run security scans and those have been tripping up our sites. We think it is related to our current SSO being outdated.
Tom Tran (WICLOUD CORPORATION) 1,920 Reputation points Microsoft External Staff

2025-10-24T04:36:12.0366667+00:00

Hi @Brown, Matt ,

I'm glad to hear that you managed to find the root cause to this.

Do you still need assistance on anything else? And was my answer helpful to you? Feel free to comment below.
Thank you!

Share via

DefaultAppPool is being automatically disabled due to a series of failures in the process(es) serving that application pool

2 answers

Your answer