Windows Server 2019 — Application pool crashes loop on rapid-fail protection — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

An IIS application pool on Windows Server 2019 hits rapid-fail protection and is disabled, taking the hosted site offline. Requests return 503 errors, monitoring alerts fire, and worker process w3wp.exe restarts repeatedly before the pool stops entirely.

Environment & Reproduction

Trigger occurs when worker process crashes exceed the configured threshold within the failure interval. Inspect recent deployments and the Application log.

Get-Service -Name iis
Get-WinEvent -LogName System -MaxEvents 40
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Root Cause Analysis

Common causes include unhandled exceptions in app code, .NET runtime mismatch, identity permission loss, or an OOM kill triggered by a memory leak in a hosted module.

Quick Triage

Note the pool name, the rapid-fail count, and the last crash event identifier before remediation.

sc.exe query iis
Get-Service -Name iis | Select-Object Status,StartType
Get-EventLog -LogName System -Newest 30 | Where-Object {$_.Source -match 'iis'}

Step-by-Step Diagnosis

Read worker process crash events, list the application pool identity, and confirm the .NET version targeted.

Get-WinEvent -LogName System -MaxEvents 50 | Where-Object {$_.ProviderName -match 'iis'} | Select TimeCreated,Id,LevelDisplayName,Message
sc.exe qfailure iis
sfc /verifyonly

Solution — Primary Fix

Reset rapid-fail protection counters, fix the failing identity or runtime, and restart the pool with monitoring enabled.

Restart-Service -Name iis -Force
Get-Service -Name iis | Select-Object Status,StartType
Get-WinEvent -LogName System -MaxEvents 20 | Where-Object {$_.ProviderName -match 'iis'}

Solution — Alternative Approaches

If a memory leak is suspected, recycle on a private memory threshold while the application team patches the root cause.

sc.exe config iis start= auto
sc.exe failure iis reset= 86400 actions= restart/60000/restart/60000/run/1000
Restart-Service -Name iis -Force

Verification & Acceptance Criteria

The pool stays running for the agreed observation window with worker crash count at zero.

Get-Service -Name iis
Get-WinEvent -LogName System -MaxEvents 25 | Where-Object {$_.ProviderName -match 'iis' -and $_.LevelDisplayName -eq 'Error'}
Test-NetConnection -ComputerName localhost -Port 

Rollback Plan

Stop the pool and redeploy the prior application build alongside the previous web.config.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
wbadmin get versions
# Restore previous configuration export if available

Prevention & Hardening

Add health monitoring, configure ping behaviour, and gate deployments behind smoke tests.

Get-Service -Name iis | Export-Clixml C:/Temp/iis-baseline.xml
Get-WinEvent -LogName System -MaxEvents 50 > C:/Temp/iis-events.txt
Get-ScheduledTask | Where-Object {$_.TaskName -match 'iis'}

Related Errors & Cross-Refs

Linked to events 5002, 5009, 5117 and .NET runtime crash event 1000.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn references for IIS application pool failure modes and worker process recycling on Windows Server 2019.