Windows Server 2022 — IIS Application Pool crashes with Event ID 5002 on build 20348 — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web applications recycle unexpectedly and users receive intermittent 503 responses.

Environment & Reproduction

Windows Server 2022 build 20348 IIS workloads with custom modules or identity changes.

Import-Module WebAdministration
Get-ChildItem IIS:AppPools | Select Name,State
Get-WinEvent -LogName Application -MaxEvents 60 | Where-Object Id -in 5002,5011,5059

Root Cause Analysis

Common causes include bad module binaries, identity permission failures, or rapid-fail thresholds.

Quick Triage

Identify failing pool and most recent exception signature.

Get-WebAppPoolState -Name 'DefaultAppPool'
Get-EventLog -LogName Application -Newest 40 | Where-Object Source -match 'WAS|IIS'

Step-by-Step Diagnosis

Inspect pool identity rights and loaded module versions.

Get-ItemProperty IIS:AppPoolsDefaultAppPool -Name processModel
Get-WebGlobalModule
Get-WinEvent -LogName 'Microsoft-IIS-W3SVC-WP/Operational' -MaxEvents 80

Solution — Primary Fix

Correct identity permissions and recycle pool after module health checks.

icacls C:inetpubwwwroot /grant 'IIS APPPOOLDefaultAppPool:(OI)(CI)RX'
Restart-WebAppPool -Name 'DefaultAppPool'
iisreset /restart

Solution — Alternative Approaches

Temporarily disable problematic module and run app in isolated pool.

Remove-WebGlobalModule -Name 'CustomModule'
New-WebAppPool -Name 'App-Isolated'
Set-ItemProperty IIS:AppPoolsApp-Isolated -Name recycling.periodicRestart.time -Value 00:00:00

Verification & Acceptance Criteria

Pool remains running under load and no new Event 5002 appears.

Get-WebAppPoolState -Name 'DefaultAppPool'
Invoke-WebRequest http://localhost/ -UseBasicParsing
Get-WinEvent -LogName Application -MaxEvents 30 | Where-Object Id -eq 5002

Rollback Plan

Restore original module set and app pool settings if behavior worsens.

appcmd restore backup PreFix-IIS
Restart-WebAppPool -Name 'DefaultAppPool'

Prevention & Hardening

Deploy modules through staged validation and track pool crash counters.

Get-Counter 'W3SVC_W3WP(*)Private Bytes'
Backup-WebConfiguration -Name DailyIISConfig

Related Errors & Cross-Refs

Related to CLR version mismatch and locked identity accounts.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn IIS app pool failure analysis and WAS event IDs.