For the most part, the analysis summary can be ignored.Ī little bit down in the report points me to what I was seeing in Process Explorer with the problem thread that was using all the CPU time: It will do its best to figure out the issue in the most vague way and you almost always need to do some interpretation of your own. When it is installed, simply right-click the dump file and select Analyze Crash/hang Issue from the context menu and point it to the crash file. It has a very high learning curve and if you don’t use it much, its easy to forget everything except the old faithful !analyze –v or !analyze –v –hang. I have grown increasingly lazy and forgetful over the years with WinDbg. So, to confirm what I was seeing, I used the Task Manager to dump the msiexec process that was using the CPU time by right-clicking it and select Create dump file (which can also be done via Process Explorer):ĭumps can be analyzed with WinDbg or a tool like DebugDiag 2.0. Note, this might not be entirely abnormal as you can always expect any anti-virus suite to be hooking itself into any number of processes. You can see a 3rd party component here (HCApi – McAfee HIPS) at play. From here, I opened the thread by selecting it and clicking Stack: The thread that is doing all the work (or in this case getting hung up) is indicated by the Cycles tab. Opening the process details, I select the Threads tab. There were multiple processes running, but I could see one process, though, eating CPU resources, and this was likely where I might find the culprit: After manually deleting the components from the file system (it was missing from Programs and Features), I ran the MSI again and this time used Process Explorer to look inside the hung msiexec processes. However, the root issue still needed to be identified as I had no idea what else in the MSI was failing to complete. To confirm, I manually registered all the components in the program directly via the command line:įOR /R "C:\Program Files (x86)\ApplicationFolder" %G IN (*.dll) DO "%systemroot%\system32\regsvr32.exe" /s "%G").Īfterwards, the application with the dependency launched without error and Outlook was no longer crashing. My guess was that the application’s components were not getting registered. 93, time stamp: 0x52d811c0įaulting application start time: 0x01d12d4e055d29fcįaulting application path: C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXEįaulting module path: C:\Program Files (x86)\Interwoven\WorkSite\iOutlook\imFileSite.dll 1000, time stamp: 0x514a1b69įaulting module name: imFileSite.dll, version. Crashing Config Manager Client & Remote Control Viewer after Windto 1709 Updateįaulting application name: OUTLOOK.EXE, version.The Case of the Dysfunctional Adobe PDF Plugin.The Case of the Missing Image Preview Tiles.As a normal user you cannot change those registry settings. The only problem with this batch is that you need to run it as an elevated administrator, so when creating a shortcut for it, specify to run it as an administrator. Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\PATHTO\PROCEXP.EXE" /f In Process Explorer, untick 'Options - Replace Task Manager', then run 'taskmgr.exe' and tick 'Options - Replace Task Manager' again.Īlternatively you can create a batch-file that removes that registry setting, starts task manager and puts the setting back in: reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /f So for now, I don't see a way to have Process Explorer as default task manager and be able to run task manager at the same time. Even if started from a medium integrity level, it automatically runs in high integrity level and it can not be killed even with local system privileges. The renamed task manager behaves rather odd. Rather odd behavior, normally it is no problem to rename an Renaming taskmgr.exe to something else seems to break something So moving task manager to a different directory does not work. This means whenever you start an executable named 'taskmgr.exe', start whatever is specified in this value instead. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger The way that Process Explorer takes over from Task Manager is by adding a registry value:
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |