Recently I was at a customer site and noticed quite a few W3SVC errors in both the system and application eventlog. The specific errors were:
In the system eventlog:
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1013
Date: 9-3-2011
Time: 6:40:05
User: N/A
Computer: -
Description: A process serving application pool ‘MSExchangeSyncAppPool’ exceeded time limits during shut down. The process id was ’65380′. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
In the same timespan as the above eventlog entry, I found the following in the application eventlog:
Event Type: Warning
Event Source: W3SVC-WP
Event Category: None
Event ID: 2262
Date: 9-3-2011
Time: 8:07:26
User: N/A
Computer: -
Description: ISAPI ‘C:WINDOWSMicrosoft.NETFramework64v2.0.50727aspnet_isapi.dll’ reported itself as unhealthy for the following reason: ‘Deadlock detected’. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
It seemed that the above entries in the eventviewer went hand in hand with the introduction of iPhones as mobile mail clients. After some research, this blog linked me to Technet Article cc778630, which states:
Setting SSLAlwaysNegoClientCert also helps eliminate client certificate renegotiation deadlocks, which may occur when a client is blocked on sending a large request body when a renegotiation request is received.
People that are familiar with SQL (and programming in general) will probably know that deadlocks occur when two ore more actions are each waiting for the other to finish processing, which results in a never-ending loop. The system detects the deadlock and prevents it from happening. Exactly the same thing happens with IIS 6 in Windows server 2003 when the SSLAlwaysNegoClientCert has not been set. The following procedure describes on how to set the SSLAlwaysNegoClientCert property in IIS, which solves the issue and eliminates the W3SVC errors:
- First, find the site identifier of the website where the Exchange ActiveSync service resides. This can be done by starting the IIS manager, selecting the servername in the left hand pane. The site identifier will be shown on the right. For more information on finding the site identifier, see Scott Forsyth’s blog.
- Open a command prompt and navigate to c:inetpubadminscripts
- Execute the following command: ‘cscript adsutil.vbs set w3svc/siteID/SSLAlwaysNegoClientCert True’ , of-course replacing ‘siteID’ with the appropriate ID.
