An "A failure was encountered while launching the process serving application pool 'CRMAppPool'" message is logged in the Application log after you configure CRMAppPool for a domain account user in Microsoft Dynamics CRM

When you run the CRMAppPool application pool after you configure the application pool for a domain account user in Microsoft Dynamics CRM, the following message is logged in the Application log:

Event Type: Error
Event Source: W3SVC
Event Category: None
Event ID: 1059
Date: Date
Time: Time
User: N/A
Computer: ComputerName
Description: A failure was encountered while launching the process serving application pool 'CRMAppPool'. The application pool has been disabled.

Note In this error message, the Date placeholder and the Time placeholder represent the actual date and the actual time. For example, the actual date can be "2007-12-12" and the actual time can be "17:53:26.138."

When this issue occurs, the CRMAppPool application pool cannot start. Additionally, you receive the following error message: This issue occurs even if the domain account user is a member of the local administrator group.

The issue occurs because the permissions or the user rights of the domain account user are insufficient.

To resolve this issue, follow these steps:

1. Include the domain account user in the following groups in Active Directory:
   • The Domain Users Active Directory group
   • The PrivUserGroup
   • The SQLAccessGroup
   To do this, follow these steps:
   1. Log on to a server as a user who has the Domain Admin rights or the rights to update these groups.
   2. Right-click the Domain Users group in Active Directory, and then click Properties.
   3. In the Group name box, type the name of the user who is running the CRM Application Pool, and then click OK two times.
   4. Repeat steps b and c for the PrivUserGroup group and for the SQLAccessGroup group.
   If you have more than one Microsoft Dynamics CRM deployment installed, multiple groups exist in Active Directory. To determine the groups that you want to update, follow these steps.
   
   For Microsoft Dynamics CRM 3.0
   1. Run the following SQL statement against the MSCRM database:

      select organizationid from organizationbase

   2. Note the GUID. For example, the GUID may be C8AB1D52-9383-4164-B571-4C80D46674E3.
   3. Find the PrivUserGroup group and the SQLAccessGroup group in Active Directory. The group name contains the GUID that you noted in step b.
   For Microsoft Dynamics CRM 4.0
   1. Run the following SQL statement against the MSCRM_config database:

      select id, friendlyname from organization

   2. Note the GUID. For example, the GUID may be C8AB1D52-9383-4164-B571-4C80D46674E3 Org Name.
   3. Find the PrivUserGroup group and the SQLAccessGroup group in Active Directory. The group name contains the GUID that you noted in step b.
2. Include the domain account user in the following groups in the Microsoft Dynamics CRM server:
   • The local IIS_WPG group
   • The local CRM_WPG group
   Note The domain account user must have the following local user rights:
   • The Impersonate a client after authentication right
   • The Log on as a service right
   To do this, follow these steps:
   1. In the Microsoft Dynamics CRM server, click Start, point to Administrative Tools, and then click Local Security Policy.
   2. Expand Local Policies, and then click User Rights Assignment.
   3. Right-click Impersonate a client after authentication, and then click Properties.
   4. Click Add User or Group.
      
      Note You may have to click Location to select the domain instead of the local computer.
   5. In the Group name box, type the name of the user who is running the CRM Application Pool, and then click OK two times.
   6. Repeat steps 2c through 2e for the Log on as a service right.
3. Configure the CRMAppPool application pool security account to use a service principal name (SPN). For steps on how to configure SPNs, refer to the Configuring service principal names (SPN) document on the Resource Center: http://rc.crm.dynamics.com/rc/regcont/en_us/op/articles/configurespn.aspx (http://rc.crm.dynamics.com/rc/regcont/en_us/op/articles/configurespn.aspx)

   Note

   For Microsoft Dynamics CRM 4.0, you do not have to create an SPN for the domain account.
4. Configure the CRMAppPool application pool security account to be trusted for delegation. To do this, follow these steps:
   1. Log on to the domain controller by using a user account that has domain administrator permissions.
   2. Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
   3. Expand the domain, right-click the Microsoft Dynamics CRM application pool security account, and then click Properties.
   4. On the Delegation tab, click to select the Trust this user for delegation to any service (Kerberos only) check box.
   5. Click OK.
   Note For Microsoft Dynamics CRM 4.0, you do not have to create the domain account to be trusted for delegation.
5. Restart Internet Information Services (IIS). To do this, click Start, click Run, type IISRESET, and then click OK.

For more information, click the following article number to view the article in the Microsoft Knowledge Base: