Procdump Error while writing dump file: 0x80070005 Error 0x80070005 (-2147024891): access denied

Question

We recently had problems trying to capture a memory dump for various IIS application pools on a 2012 R2 server. I tried using the task manager, but it generates an error and also uses procdump in the administrative console:

PS C:\Users\_______\Downloads> procdump -mA 31016

ProcDump v7.1 - Writes process dump files
Copyright (C) 2009-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
With contributions from Andrew Richards

[19:59:22] Dump 1 initiated: C:\Users\____\Downloads\w3wp.exe_161008_195922.dmp
[19:59:25] Dump 1 writing: Estimated dump file size is 29278 MB.
[20:01:15] Dump 1 error: Error writing dump file: 0x80070005
Error 0x80070005 (-2147024891): Access is denied.

[20:01:15] Waiting for dump to complete...
[20:01:17] Dump count not reached.

I tried various combinations of -ma and -mA and -64 and procdump64, but they all have the same Access, which is denied an error for workflows that use more than 16 GB of memory.

I also tried adding -r to flip / clone the process, as recommended. How to dump memory in an ASP.NET application pool quickly , but still get the same error message as above.

: , IIS , ping 90 . :

90 , , , .

Answer 1

, , procdump , , -r reflect/clone. 90 , IIS , . Procdump " " " ReadProcessMemory WriteProcessMemory " , , , .

, Resouce, Process Explorer PsSuspend svchost.exe -k iissvcs, procdump. PowerShell script, w3wp :

#Prevent IIS from recycling the process during procdump and causing an Access Denied error message
$iispid = Get-Process svchost | ?{$_.modules.ModuleName -eq "iisw3adm.dll"} | Select -First 1 -ExpandProperty Id
$workerpid = Get-Process w3wp | Sort ws -Descending | Select -First 1 -ExpandProperty Id
cd ~\Downloads  #move to location where you want to save the dump files
#Add -accepteula to the sysinternals calls if you want to bypass the initial EULA prompt on new servers
& "c:\sysinternals\pssuspend.exe" $iispid 
Write-Output "Creating memory dump for w3wp PID $workerpid"
& "c:\sysinternals\procdump.exe" -ma $workerpid
& "c:\sysinternals\pssuspend.exe" $iispid -r

:

PS> & "\\dfshare\sysinternals\pssuspend.exe" $iispid

PsSuspend v1.06 - Process Suspender
Copyright ⌐ 2001-2003 Mark Russinovich
Sysinternals

Process 49836 suspended.

PS> & "\\dfshare\sysinternals\procdump.exe" -ma 98340

ProcDump v8.2 - Sysinternals process dump utility
Copyright (C) 2009-2016 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com

[01:03:24] Dump 1 initiated: C:\Users\gbray\Downloads\w3wp.exe_161230_010324.dmp
[01:03:29] Dump 1 writing: Estimated dump file size is 19347 MB.
[01:05:14] Dump 1 complete: 19350 MB written in 109.8 seconds
[01:05:14] Dump count reached.

PS> & "\\dfshare\sysinternals\pssuspend.exe" $iispid -r

PsSuspend v1.06 - Process Suspender
Copyright ⌐ 2001-2003 Mark Russinovich
Sysinternals

Process 49836 resumed.

, iissvcs, iisreset .