Fixed:the Windows Process Activation Service service terminated with the following error:the system cannot find the file Specified

I ' m not yet clear and I did, but I'm blogging it so it can found if someone else have this issue.

For whatever reason, last week both of my Vista 64-bit machines suddenly stopped being able to start IIS (Internet Informa tion Server). The service just wouldn ' t start. I started getting this error instead "cannot start service w3svc on computer '. ' Which wasn ' t too helpful.

A visit to the System event Log via the event Viewer in computer Management told me these four errors:

"The World Wide Web Publishing Service service depends on the Windows Process Activation Service service which failed to s Tart because of the following error:the system cannot find the file specified. "

and

"The Windows Process Activation Service service terminated with the following error:
The system cannot find the file specified. "

and

"Windows Process Activation Service (WAS) is stopping because it encountered an error. The data field contains the error number. "

and

"The directory specified for the temporary application pool config files are either missing or is isn't accessible by the Win Dows Process Activation Service. Specify an existing directory and/or ensure the it has proper access flags. The data field contains the error number. "

Unfortunately there ' s little information to go on the any of these error messages. However, it's clear (as mud) from the last error that there's a directory missing or not accessible. I ' ll add "anymore" to that because it worked before. That's means that something changed.

If IIS won ' t start because Windows Process Activation Service won ' t start, then I need to get is started up first. However, I don ' t know what directory it doesn ' t has access to.

I can see from the Services application that is isn ' t its own executable, but rather lives inside of an instance of Svcho St.exe, where a lot of services live.

So I'll fire up Process Monitor and set the filters (filters is VERY important if you want to avoid being overwhelmed qui Ckly in ProcMon) to show only svchost.exe processes.

Even still, there's a lot of svchost.exe processes out there and they would quickly fill the monitor up. I ' ll need to setup some strategic (read:guessed) highlighting as well.

The hotkey to stop capturing in Procmon.exe is CTRL-E. Basically I ll clear the screen, hits CTRL-E to capture, try-to-start was (pronounced Waaz), watch it fail, the stop Captur E with CTRL-E.

Based on the vague message about application pools temporary files and a directory I'll make a guess and configure Highlig Hting to find paths this contain "temp," "Log," "config" or "app" in Process Monitor as seen in the screenshot below.

After I run the capture, I scroll around looking for suspicious stuff. One of the nice things about Process Monitor is so can EXCLUDE things in a given capture through that fact. For example, I saw a pile of Audio and Media related stuff, is visually confusing and cluttering the point, so I excl Uded it.

The result is here:

It looks like there should is a folder call C:\inetpub\temp\apppools and on my Vista machines, in the last of the weeks to A month, it just disappeared. No idea why. I just noticed recently when I tried to move from a local Web development service to IIS itself.

I created the folder, started was, then IIS and I were back up and running.

I ' ll pass the feedback on to the is team about the obscure error messages, but I thought I ' d share this little ten minute Debugging session to point out a few things that I think is important and possibly helpful, Dear Reader:

• Know What Your Processes is Doing (or at least, Know how to find out)
knowing How to look INSIDE the Windows "black box" using tools like ProcMon makes your realize that's no OS is a Black box At all. It's very empowering to know so CAN see inside.
• task:  Learn process Monitor and process Explorer.
• Enable Your Intuition
• Debugging is 95% tools and 5% intuition. Know What tools can get you the next bit of information your need to take the next step in your analysis.
• If You feel an wall in the your analysis, knock that wall down. Your process is doing IO to a file/registry/device/network/etc. Watch it. Look for failures.