WSUS 3.

0 console fails to open with "MMC could not create the snap-in" errorWe've seen a couple instances of an issue here lately that I wanted to mention just in case anyone else happens to run across it. The symptoms can vary but include the following: 1. The WSUS console will not open and may generate the error "MMC could not create the snap-in" 2. If you check the Update Services service for WSUS, you find that it is stopped. When you attempt to start the service, it seems to start but stops again with no errors. 3. You may see the following event in the event log: Event Type: Error Event Source: MSSQLSERVER Event Category: (2) Event ID: 6510 Description: Common Language Runtime (CLR) v2.0.50727 not installed properly. The CLR is required to use SQL/CLR features. What usually turns out to be the cause is a problem with .NET Framework and most of the time you can correct the issue by simply repairing it. The easiest way to do this is by opening Add/Remove Programs, double-clicking on the version of Microsoft .NET Framework installed and selecting the Repair option. If the repair cannot find the needed MSI, you can download .NET 2.0 SP1 and use /x to extract the needed MSI files to finish the repair. You could also probably remove and reinstall it although I've never personally tried that myself so take that one with a grain of salt. I must also give a special thanks to Justin Luyt and Mike Johnson for originally documenting this. Thanks guys!

********************************************************************* Consider the following scenario. You configure the World Wide Web Publishing Service on Microsoft Windows Server 2003 to interact with the desktop. You log on to a console session either locally or remotely. In this scenario, when you browse an .aspx page that requires compilation, you may receive the following error message: Compilation Error Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately. Compiler Error Message: The compiler failed with error code 128. Back to the top

CAUSE

This problem occurs because the worker process that tries to start the Microsoft ASP.NET compiler process is running under the Network Service identity or under an account that is not in the Administrators group. When the ASP.NET compiler process tries to start Vbc.exe or Csc.exe, the process initialization routine fails. This failure occurs because a dependent DLL fails during its initialization routine. If any of the DLLs for a process return a failure in their initialization routine, the operating system stops the process startup and returns an error code of 128 (ERROR_WAIT_NO_CHILDREN). Back to the top

RESOLUTION
To resolve this problem, use either of the following methods. Use the method that fits your situation the best. Back to the top

Method 1: Prevent the World Wide Web Publishing Service from interacting with the desktop
You can prevent the World Wide Web Publishing Service from interacting with the desktop. This is the preferred method. Note By default, the World Wide Web Publishing Service is not configured to interact with the desktop. To do this, follow these steps: 1. 2. 3. 4. 5. 6. 7. 8. Click Start, click Run, type cmd, and then click OK. At the command prompt, type control admintools, and then press ENTER. Double-click Services. In the Services pane, locate World Wide Web Publishing Service. Right-click World Wide Web Publishing Service, and then click Properties. Click the Log On tab. Click to clear the Allow service to interact with desktop check box. Click OK.

Back to the top

Method 2: Change the application pool identity to the Local System identity
Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk. You can change the application pool identity to the Local System identity.

Important You should only use this method if the following conditions are true:

The ASP.NET Web application must interact with the desktop. You understand the security implications of changing the application pool identity to the Local System identity. For more information about the Local System account and the Network Service account, see the "Applications as NT Services" section at the following Microsoft Developer Network (MSDN) Web site: http://msdn2.microsoft.com/en-us/library/ms952392.aspx

To do this, follow these steps: 1. 2. 3. 4. Click Start, click Run, type cmd, and then click OK. At the command prompt, type control admintools, and then press ENTER. Double-click Internet Information Services (IIS) Manager. Expand the computer name, expand Application Pools, right-click the name of the application pool that you want to modify, and then click Properties. 5. Click the Identity tab. 6. Click Predefined, and then click Local System. 7. Click OK. Back to the top

MORE INFORMATION
ASP.NET does not try to compile a page after an error is encountered during the compilation process. The error is cached until the process is recycled, or until the page or one of its dependencies is modified. When the worker process is tied to the console windowstation (Winsta0), the World Wide Web Publishing Service adds the security identifier (SID) for the IIS_WPG group to the access control list (ACL) for the Winsta0 object. Then, the World Wide Web Publishing Service starts the W3wp.exe process. When a user logs on to or off a console session, the Winlogon process rebuilds the ACL for the Winsta0 object and removes the IIS_WPG SID from the ACL. Any child processes that are started by the worker process (W3wp.exe) may not start. These processes include the Csc.exe and Vbc.exe processes. Back to the top When a service is not configured to interact with the desktop, the process uses a noninteractive windowstation that is unaffected by a user logging on to the console. Note You can log on to the console in Windows Server 2003 by any one of the following methods:

Log on to the computer interactively. Use the Remote Desktop client application. For example, type mstsc.exe /console at a command prompt.

Use a third-party application that accesses the console session.