Last night, my SSRS server failed on the first access attempt after Multiple Windows patches were installed by WSUS overnight (SQL Server 2005 EE, Windows 2003 SP2). This is not a critical server for me so it doesn't get tested before patches are applied. As such, it gets all patches immediately without testing and, in fact, is a test for such patches for me. Production servers have to be approved by hand after my test servers pass.
Starting off in the Event Viewer > System, I'd see 5 W3SVC warning [a] and followed by a W3SVC failure [b]. Evidently, the rapid fail mechanism in IIS6 was shutting me down.
-
[a] 5 times: Event ID 1009; Source W3SVC; A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was 'xxxx'. The process exit code was '0xffffffff'.
-
[b] 1 time: Event ID 1002; Source W3SVC; Application pool 'xxxxxx' is being automatically disabled due to a series of failures in the process(es) serving that application pool.
Restarting application pools would just duplicate the same series of events.
Looking in the Event Viewer > System, I examined which patches were applied overnight
- KB974318
- KB973904
- KB971737
- KB973917
- KB974392
- KB976325-IE8
- KB955759
KB973917 is 'a non-security update that implements Extended Protection for Authentication in Internet Information Services (IIS).'
After reviewing each knowledge base article, I located a known issue for KB973917 that described my issue perfectly: 'Internet Information Services 6.0 may not function correctly after installing KB973917'. The solution is to reinstall SP2 for your Windows 2003 server. Per Microsoft, 'Reinstalling the KB973917 update should not be necessary'.
If you want to enable the features this update provides, view here: 'http://www.microsoft.com/technet/security/advisory/973811.mspx'
To Microsoft's credit, this is the first patch to cause a problem for me in over 3 years.
