FIX: Web sites restart and Event ID 1000 is logged for svchost.exe_WAS in Internet Information Services (IIS) 7.0


In Internet Information Services (IIS) 7.0, you find that some Web sites restart when there are frequent configuration changes to the configuration data in a short time. Additionally, you find that an Event ID 1000 is logged in the Application log. This event resembles the following:
  • The fault offset, the process id, and the application start time all vary, depending on the situation. The faulting module may also vary but the faulting module is usually Nativerd.dll, Iisutil.dll or unknown. However, the faulting application is always Svchost.exe_WAS.
  • This issue usually occurs in a shared hosting environment when multiple configuration changes occur within in a short time.


This issue occurs because of a race condition during frequent configuration changes in IIS. This race condition causes Windows Process Activation Service (WAS) to crash the Svchost.exe process. Because IIS worker processes rely on WAS, IIS worker processes exit when WAS crashes. This causes the Web sites to restart.


To resolve this problem, obtain the latest service pack for Windows Vista or Windows Server 2008. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

935791 How to obtain the latest Windows Vista service pack

968849 How to obtain the latest service pack for Windows Server 2008

Note There is no separate hotfix package available for this issue. The only available solution is to apply the service pack.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Article ID: 968898 - Last Review: Aug 24, 2009 - Revision: 1