FIX: Windows Process Activation Service (WAS) does not start when you use the IISRESET /RESTART command to restart IIS 7.0 or IIS 7.5

Consider the following scenario:

• You have Internet Information Services (IIS) 7.0 installed on a computer that is running Windows Vista or Windows Server 2008.Or, you have IIS 7.5 installed on a computer that is running Windows 7 or Windows Server 2008 R2.
• You restart IIS by using the IIRESET /RESTART command.

In this scenario, IIS World Wide Web Publishing Service (W3SVC) does not start. Additionally, the following events are logged in the application event log:

Log Name: System
Source: Service Control Manager
Event ID: 7001
Description: The World Wide Web Publishing Service service depends on the Windows Process Activation Service service which failed to start because of the following error:

Log Name: System
Source: Service Control Manager
Event ID: 7022
Description: The Windows Process Activation Service service hung on starting.

After IIS 7.0 or IIS 7.5 starts, Windows Process Activation Service (WAS) calls the LookupAccountName function to resolve account names on the local system. If no name is succesfully resolved, the LookupAccountName function tries to resolve account names by using domain controllers (DCs) trusted by the local system. Depending on the configuration of the DCs, the LookupAccountName query may take more than 30 seconds to be completed. In this situation, it takes a long time to start WAS. Additionally, W3SVC does not start because W3SVC depends on WAS.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must have IIS 7.0 or IIS 7.5 installed on a computer that is running one of the following operating systems.

For IIS 7.0

• Windows Vista SP1
• Windows Vista SP2
• Windows Server 2008
• Windows Server 2008 SP2

For IIS 7.5

• Windows 7
• Windows Server 2008 R2

Restart requirement

You must restart the computer if IIS is running when you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File information for Windows Vista and Windows Server 2008

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported Itanium-based versions of Windows Server 2008

File information for Windows 7 and Windows Server 2008 R2

For all supported x86-based versions of Windows Server 2008 R2 and of Windows 7

For all supported x64-based versions of Windows Server 2008 R2 and of Windows 7

For all supported IA64-based versions of Windows Server 2008 R2 and of Windows 7

To work around the issue, use one of the following methods:

1. Make Sure that Domain Controllers (DCs) can be pinged and accessed by using RPC communication.
   
   Note The LookupAccountName API uses RPCs to communicate with the DCs.
2. Manually restart IIS. To do this, perform one of the following operations:
   • Run the following command:
     net start w3svc
   • Start the World Wide Web Publishing Service (W3SVC) in the management window of Windows Services.
3. If there are many DCs, set the LsaLookupRestrictIsolatedNameLevel registry key to 1 to speed up the LookupAccountName query.
   
   Note For more information about how to set the LsaLookupRestrictIsolatedNameLevel registry entry, click the following article number to view the article in the Microsoft Knowledge Base:
   818024  (http://support.microsoft.com/kb/818024/ ) How to restrict the lookup of isolated names in external trusted domains by using the LsaLookupRestrictIsolatedNameLevel registry entry

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about the LookupAccountName function, visit the following Microsoft Developer Network (MSDN) Web site: For more information about the activation architecture of WAS, visit the following Microsoft Developer Network (MSDN) Web site: