Faulting application CcmExec.exe, version 4.0.6487.2000, faulting module 4ab33e4d, version ntdll.dll, fault address 0x6.1.7600.16385.

Wednesday, June 16, 2010 5:03 PM

Hello,

I am getting this error for the past 24 hours on one server every hour... I have an alert in SCOM, I have the event 7031 in the Event Logs... Faulting application CcmExec.exe, version 4.0.6487.2000, faulting module 4ab33e4d, version ntdll.dll, fault address 0x6.1.7600.16385.

Operating System: Windows Server 2008 R2 Enterprise

Anti-Virus: SOPHOS Anti-Virus 7.6.17 Threat detection date: 4.51E

sfc /scannow

Verification 100% complete

Windows Resource Protection did not find any integrity violations.

What could be the cause? how to trace it? What action to take?

Some logs:

Event Type:	Error
Event Source:	Application Error
Event Category:	(100)
Event ID:	1000
Date:		6/16/2010
Time:		9:25:04 AM
User:		N/A
Computer:	RXOAPP2.ad.medctr.ucla.edu
Description:
Faulting application CcmExec.exe, version 4.0.6487.2000, faulting module 4ab33e4d, version ntdll.dll, fault address 0x6.1.7600.16385.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
========================================================

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7031
Date:		6/16/2010
Time:		9:25:05 AM
User:		N/A
Computer:	RXOAPP2.ad.medctr.ucla.edu
Description:
The SMS Agent Host service terminated unexpectedly. It has done this 21 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

=======================================================
ccmexec.log

Registering built-in COM class objects.	CCMEXEC	6/16/2010 7:18:35 AM	7016 (0x1B68)
Registering hosted COM class objects.	CCMEXEC	6/16/2010 7:18:35 AM	7016 (0x1B68)
Error registering hosted class '{E67DBF56-96CA-4e11-83A5-5DEC8BD02EA8}'. Code 0x80040154	CCMEXEC	6/16/2010 7:18:35 AM	7016 (0x1B68)
...
CRTServiceStartupTask::Execute	CcmExec	6/16/2010 7:18:35 AM	6600 (0x19C8)
Failed to query size of Security (may not exist) (0x80070002)	CcmExec	6/16/2010 7:18:35 AM	6600 (0x19C8)
Invoking system task 'StatusAgentStartup' via ICcmSystemTask2 interface.	CcmExec	6/16/2010 7:18:35 AM	6600 (0x19C8)
...
Invoking system task 'SMSSHA_Startup'.	CcmExec	6/16/2010 7:18:41 AM	4860 (0x12FC)
System task 'SMSSHA_Startup' returned error code 0x80070005.	CcmExec	6/16/2010 7:18:41 AM	4860 (0x12FC)
Invoking system task 'DCMAgent_Startup'.	CcmExec	6/16/2010 7:18:41 AM	1212 (0x04BC)
...
CALTRACK: CAL Collection was invoked and skipped.	CcmExec	6/16/2010 7:19:12 AM	6092 (0x17CC)
Could not load logging configuration for component FileSystemFile. Using default values.	CcmExec	6/16/2010 7:19:19 AM	1212 (0x04BC)
New CCM (user, session) is: (,-1).	CCMEXEC	6/16/2010 7:19:36 AM	4836 (0x12E4)
...

Running the Control Panel > All Control Panel items > Troubleshooting > Programs > Program Compatibility > Not Listed > ccmexec Problems and Solution CcmExec is incompatible. Fix application CcmExec Completed Provides steps to fix the incompatible application. CompatMode CompatMode # WINXPSP2 UserVerifySolution User Verification of Solution Verify_YES Detection details Collection information Computer Name: RXOAPP2 Windows Version: 6.1 Architecture: amd64 Time: Wednesday, June 16, 2010 11:01:05 AM Publisher details Program Compatibility Make older programs run in this version of Windows. Package Version: 1.5 Publisher: Microsoft Windows Program Compatibility Make older programs run in this version of Windows. Package Version: 1.0 Publisher: Microsoft Corporation

Thanks,

Dom

System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

All Replies

Wednesday, June 16, 2010 6:58 PM

1

Hi,

exclude ccmexec.exe from SOPHOS real time scan.
Bechir Gharbi. MCSA, MCSE M+S, MCITP Server/Enterprise Administrator, MCT, MCTS Configuration Manager/Forefront (Time Zone : GMT+1)
- Reply
- Quote
Wednesday, June 16, 2010 7:39 PM

0

Hi Bechir,

I'm planning to swicth to Microsoft Forefront Client Security tomorrow to confirm the issue was with SOPHOS. I hope FCS will not have the same issue !!!! we have anyway a plan to move to FCS within 6 weeks so it will be a good test.

Thanks,

Dom
System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support
- Reply
- Quote
Wednesday, June 16, 2010 7:57 PM

1

I hope FCS will not have the same issue !!!!

I hope too, but by default FCS doesn't exclude ccmexec.exe, so if you will see the same problem therefore exclude also ccmexec.exe from the FCS real time scan and see the result.
Bechir Gharbi. MCSA, MCSE M+S, MCITP Server/Enterprise Administrator, MCT, MCTS Configuration Manager/Forefront (Time Zone : GMT+1)
- Reply
- Quote
Wednesday, June 16, 2010 8:51 PM

Moderator

1
We see this from time to time in our enviroment. We have a collection to see if computers are out of date by 60 days or more. Many times I and go into the client and find the service stopped because it crashed. I just restart the service. Sometimes the client needs a restart first. Some people have GPO's that force the client to restart but we want to know why it stopped in the first place.

We run Symantec and it didn't have to do with virus scanning or memory failure, just crashed out at boot up or during the normal course of the day.

http://www.sccm-tools.com http://sms-hints-tricks.blogspot.com
- Marked As Answer by Felyjos Thursday, June 24, 2010 7:23 PM
- Reply
- Quote
Wednesday, June 16, 2010 9:52 PM

1
Hi Matthew,

I saw this problem many time and in most cases I exclude ccmexec.exe from real time scan (many antivirus products) to resolve the issue, and I don't know the real cause but I'm sure that is related to the antivirus or to a third-party software !!!!! I know that the symantec antivirus last version is MU6, maybe this release resolves your problem if it's related to AV.

Bechir Gharbi. MCSA, MCSE M+S, MCITP Server/Enterprise Administrator, MCT, MCTS Configuration Manager/Forefront (Time Zone : GMT+1)
- Marked As Answer by Felyjos Thursday, June 24, 2010 7:23 PM
- Reply
- Quote
Thursday, July 14, 2011 8:34 AM

0

We're also having this issue on some of our Exchange 2010 servers.

Every hour the SMS Agent Host (ccmexec.exe) crashes and restarts on 3 of our 6 Exchange 2010 servers with the details as shown below.

Its not a/v (we run McAfee), as it still happens when I exclude the ccmexec.exe process from scanning and even when I stop all the McAfee services from running.

I uninstalled the SCCM client (ccmsetup /uninstall) and then reinstalled it.

Exactly one hour after it was reinstalled it crashed again.

So its something which SCCM does once an hour which is crashing.

I thought it was Software Inventory, but if I manually launch a Software Inventory Action from the Config Mgr Control Panel applet, it does not crash.

Log Name:      Application
Source:        Application Error
Date:          14/07/2011 9:19:21 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername>
Description:
Faulting application name: CcmExec.exe, version: 4.0.6487.2000, time stamp: 0x4ab33e4d
Faulting module name: ntdll.dll, version: 6.1.7600.16695, time stamp: 0x4cc7ab86
Exception code: 0xc0000005
Fault offset: 0x0009cec4
Faulting process id: 0x1f0c
Faulting application start time: 0x01cc41bb950988e8
Faulting application path: C:\Windows\SysWOW64\CCM\CcmExec.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 4d50be75-adb7-11e0-b5a9-00155d011100
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-14T01:19:21.000000000Z" />
    <EventRecordID>99367</EventRecordID>
    <Channel>Application</Channel>
    <Computer> <servername></Computer>
    <Security />
</System>
<EventData>
    <Data>CcmExec.exe</Data>
    <Data>4.0.6487.2000</Data>
    <Data>4ab33e4d</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7600.16695</Data>
    <Data>4cc7ab86</Data>
    <Data>c0000005</Data>
    <Data>0009cec4</Data>
    <Data>1f0c</Data>
    <Data>01cc41bb950988e8</Data>
    <Data>C:\Windows\SysWOW64\CCM\CcmExec.exe</Data>
    <Data>C:\Windows\SysWOW64\ntdll.dll</Data>
    <Data>4d50be75-adb7-11e0-b5a9-00155d011100</Data>
</EventData>
</Event>

The full report.wer is :

Version=1
EventType=APPCRASH
EventTime=129550934860175076
ReportType=2
Consent=1
ReportIdentifier=ca44f819-add6-11e0-ae29-d4856458dd04
IntegratorReportIdentifier=ca44f818-add6-11e0-ae29-d4856458dd04
WOW64=1
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=CcmExec.exe
Sig[1].Name=Application Version
Sig[1].Value=4.0.6487.2000
Sig[2].Name=Application Timestamp
Sig[2].Value=4ab33e4d
Sig[3].Name=Fault Module Name
Sig[3].Value=ntdll.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.1.7600.16695
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=4cc7ab86
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=0009cec4
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7600.2.0.0.274.10
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=3081
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=a7aa
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=a7aa91f17ea749d42a4de3b390fa5b3d
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=a7aa
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=a7aa91f17ea749d42a4de3b390fa5b3d
UI[2]=C:\Windows\SysWOW64\CCM\CcmExec.exe
UI[5]=Check online for a solution (recommended)
UI[6]=Check for a solution later (recommended)
UI[7]=Close
UI[8]=CCM Executive stopped working and was closed
UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
UI[10]=&Close
LoadedModule[0]=C:\Windows\SysWOW64\CCM\CcmExec.exe
LoadedModule[1]=C:\Windows\SysWOW64\ntdll.dll
LoadedModule[2]=C:\Windows\syswow64\kernel32.dll
LoadedModule[3]=C:\Windows\syswow64\KERNELBASE.dll
LoadedModule[4]=C:\Windows\syswow64\ADVAPI32.dll
LoadedModule[5]=C:\Windows\syswow64\msvcrt.dll
LoadedModule[6]=C:\Windows\SysWOW64\sechost.dll
LoadedModule[7]=C:\Windows\syswow64\RPCRT4.dll
LoadedModule[8]=C:\Windows\syswow64\SspiCli.dll
LoadedModule[9]=C:\Windows\syswow64\CRYPTBASE.dll
LoadedModule[10]=C:\Windows\syswow64\USER32.dll
LoadedModule[11]=C:\Windows\syswow64\GDI32.dll
LoadedModule[12]=C:\Windows\syswow64\LPK.dll
LoadedModule[13]=C:\Windows\syswow64\USP10.dll
LoadedModule[14]=C:\Windows\system32\msvcp60.dll
LoadedModule[15]=C:\Windows\system32\ATL.DLL
LoadedModule[16]=C:\Windows\syswow64\ole32.dll
LoadedModule[17]=C:\Windows\syswow64\OLEAUT32.dll
LoadedModule[18]=C:\Windows\system32\WTSAPI32.dll
LoadedModule[19]=C:\Windows\system32\ccmcore.dll
LoadedModule[20]=C:\Windows\syswow64\SHLWAPI.dll
LoadedModule[21]=C:\Windows\system32\VERSION.dll
LoadedModule[22]=C:\Windows\syswow64\PSAPI.DLL
LoadedModule[23]=C:\Windows\system32\xprslib.dll
LoadedModule[24]=C:\Windows\SysWOW64\CCM\ccmperf.dll
LoadedModule[25]=C:\Windows\system32\IPHLPAPI.DLL
LoadedModule[26]=C:\Windows\syswow64\NSI.dll
LoadedModule[27]=C:\Windows\system32\WINNSI.DLL
LoadedModule[28]=C:\Windows\SysWOW64\CCM\CCMGenCert.dll
LoadedModule[29]=C:\Windows\syswow64\CRYPT32.dll
LoadedModule[30]=C:\Windows\syswow64\MSASN1.dll
LoadedModule[31]=C:\Windows\SysWOW64\CCM\smscore.dll
LoadedModule[32]=C:\Windows\SysWOW64\CCM\CCMUtilLib.dll
LoadedModule[33]=C:\Windows\syswow64\WS2_32.dll
LoadedModule[34]=C:\Windows\SysWOW64\CCM\CcmTask.dll
LoadedModule[35]=C:\Windows\SysWOW64\CCM\ccmid.DLL
LoadedModule[36]=C:\Windows\syswow64\SHELL32.dll
LoadedModule[37]=C:\Windows\SysWOW64\CCM\LSUtilities.dll
LoadedModule[38]=C:\Windows\system32\NETAPI32.dll
LoadedModule[39]=C:\Windows\system32\netutils.dll
LoadedModule[40]=C:\Windows\system32\srvcli.dll
LoadedModule[41]=C:\Windows\system32\wkscli.dll
LoadedModule[42]=C:\Windows\system32\LOGONCLI.DLL
LoadedModule[43]=C:\Windows\system32\ACTIVEDS.dll
LoadedModule[44]=C:\Windows\system32\adsldpc.dll
LoadedModule[45]=C:\Windows\syswow64\WLDAP32.dll
LoadedModule[46]=C:\Windows\system32\DNSAPI.dll
LoadedModule[47]=C:\Windows\SysWOW64\CCM\FSPUtilLib.dll
LoadedModule[48]=C:\Windows\system32\IMM32.DLL
LoadedModule[49]=C:\Windows\syswow64\MSCTF.dll
LoadedModule[50]=C:\Windows\syswow64\CLBCatQ.DLL
LoadedModule[51]=C:\Windows\system32\wbem\wbemprox.dll
LoadedModule[52]=C:\Windows\system32\wbemcomn.dll
LoadedModule[53]=C:\Windows\system32\CRYPTSP.dll
LoadedModule[54]=C:\Windows\system32\rsaenh.dll
LoadedModule[55]=C:\Windows\system32\RpcRtRemote.dll
LoadedModule[56]=C:\Windows\system32\wbem\wbemsvc.dll
LoadedModule[57]=C:\Windows\system32\wbem\fastprox.dll
LoadedModule[58]=C:\Windows\system32\NTDSAPI.dll
LoadedModule[59]=C:\Windows\system32\msi.dll
LoadedModule[60]=C:\Windows\syswow64\WINTRUST.dll
LoadedModule[61]=C:\Windows\system32\ncrypt.dll
LoadedModule[62]=C:\Windows\system32\bcrypt.dll
LoadedModule[63]=C:\Windows\SysWOW64\bcryptprimitives.dll
LoadedModule[64]=C:\Windows\system32\USERENV.dll
LoadedModule[65]=C:\Windows\system32\profapi.dll
LoadedModule[66]=C:\Windows\system32\GPAPI.dll
LoadedModule[67]=C:\Windows\system32\cryptnet.dll
LoadedModule[68]=C:\Windows\system32\SensApi.dll
LoadedModule[69]=C:\Windows\system32\WINHTTP.dll
LoadedModule[70]=C:\Windows\system32\webio.dll
LoadedModule[71]=C:\Windows\system32\credssp.dll
LoadedModule[72]=C:\Windows\system32\mswsock.dll
LoadedModule[73]=C:\Windows\System32\wshtcpip.dll
LoadedModule[74]=C:\Windows\System32\wship6.dll
LoadedModule[75]=C:\Windows\system32\dhcpcsvc6.DLL
LoadedModule[76]=C:\Windows\system32\dhcpcsvc.DLL
LoadedModule[77]=C:\Windows\syswow64\CFGMGR32.dll
LoadedModule[78]=C:\Windows\system32\rasadhlp.dll
LoadedModule[79]=C:\Windows\SysWOW64\APPHELP.DLL
LoadedModule[80]=C:\Windows\system32\ntmarta.dll
LoadedModule[81]=C:\Windows\SysWOW64\CCM\PolicyAgent.dll
LoadedModule[82]=C:\Windows\SysWOW64\CCM\SrcUpdateMgr.dll
LoadedModule[83]=C:\Windows\SysWOW64\CCM\CcmDTS.dll
LoadedModule[84]=C:\Windows\SysWOW64\CCM\CcmCTMNotification.DLL
LoadedModule[85]=C:\Windows\SysWOW64\CCM\smssha.dll
LoadedModule[86]=C:\Windows\system32\framedyn.dll
LoadedModule[87]=C:\Windows\SysWOW64\CCM\UpdatesDeployment.dll
LoadedModule[88]=C:\Windows\SysWOW64\CCM\ScanAgent.dll
LoadedModule[89]=C:\Windows\SysWOW64\CCM\Sched.dll
LoadedModule[90]=C:\Windows\SysWOW64\CCM\rebootcoord.dll
LoadedModule[91]=C:\Windows\SysWOW64\CCM\RTConfiguration.dll
LoadedModule[92]=C:\Windows\system32\SAMCLI.DLL
LoadedModule[93]=C:\Windows\system32\newdev.dll
LoadedModule[94]=C:\Windows\system32\UxTheme.dll
LoadedModule[95]=C:\Windows\syswow64\SETUPAPI.dll
LoadedModule[96]=C:\Windows\syswow64\DEVOBJ.dll
LoadedModule[97]=C:\Windows\system32\devrtl.DLL
LoadedModule[98]=C:\Windows\SysWOW64\CCM\UpdatesStore.dll
LoadedModule[99]=C:\Windows\SysWOW64\CCM\ContentAccess.dll
LoadedModule[100]=C:\Windows\SysWOW64\CCM\CPApplet.dll
LoadedModule[101]=C:\Windows\SysWOW64\CCM\CcmCTM.dll
LoadedModule[102]=C:\Windows\SysWOW64\CCM\LibRDC.dll
LoadedModule[103]=C:\Windows\SysWOW64\CCM\execmgr.dll
LoadedModule[104]=C:\Windows\SysWOW64\CCM\VAppLaunchMgr.dll
LoadedModule[105]=C:\Windows\SysWOW64\CCM\SrvWinMgr.dll
LoadedModule[106]=C:\Windows\system32\WINSTA.dll
LoadedModule[107]=C:\Windows\SysWOW64\CCM\StatusAgent.dll
LoadedModule[108]=C:\Windows\system32\wbem\wmidcprv.dll
LoadedModule[109]=C:\Windows\system32\wbem\wmiutils.dll
LoadedModule[110]=C:\Windows\system32\wbem\esscli.dll
LoadedModule[111]=C:\Windows\SysWOW64\CCM\ccmident.dll
LoadedModule[112]=C:\Windows\system32\SAMLIB.dll
LoadedModule[113]=C:\Windows\SysWOW64\CCM\StandardEventForwarder.dll
LoadedModule[114]=C:\Windows\System32\msxml6.dll
LoadedModule[115]=C:\Windows\SysWOW64\CCM\smsclient.dll
LoadedModule[116]=C:\Windows\SysWOW64\CCM\StatusAgentProxy.dll
LoadedModule[117]=C:\Windows\SysWOW64\CCM\LSInterface.dll
LoadedModule[118]=C:\Windows\system32\SXS.DLL
LoadedModule[119]=C:\Windows\system32\SECUR32.DLL
LoadedModule[120]=C:\Windows\System32\fwpuclnt.dll
LoadedModule[121]=C:\Windows\SysWOW64\Kerberos.DLL
LoadedModule[122]=C:\Windows\system32\cryptdll.dll
LoadedModule[123]=C:\Windows\SysWOW64\CCM\MtrMgr.dll
LoadedModule[124]=C:\Windows\system32\MPR.dll
LoadedModule[125]=C:\Windows\SysWOW64\CCM\Prep.dll
LoadedModule[126]=C:\Windows\SysWOW64\CCM\WUAHandler.dll
LoadedModule[127]=C:\Windows\SysWOW64\CCM\UpdatesHandler.dll
LoadedModule[128]=C:\Windows\SysWOW64\CCM\pdpagent.dll
LoadedModule[129]=C:\Windows\SysWOW64\CCM\PolicyAgentEndpoint.dll
LoadedModule[130]=C:\Windows\SysWOW64\CCM\SdmAgent.dll
LoadedModule[131]=C:\Windows\SysWOW64\CCM\CIAgent.dll
LoadedModule[132]=C:\Windows\SysWOW64\CCM\ccm_caltrack.dll
LoadedModule[133]=C:\Windows\SysWOW64\CCM\dcmagent.dll
LoadedModule[134]=C:\Windows\SysWOW64\CCM\PwrAgentEndpoint.dll
LoadedModule[135]=C:\Windows\system32\POWRPROF.dll
LoadedModule[136]=C:\Windows\SysWOW64\CCM\PwrEventTask.dll
LoadedModule[137]=C:\Windows\SysWOW64\CCM\InvEndPoint.dll
LoadedModule[138]=C:\Windows\SysWOW64\CCM\InvDataStore.dll
LoadedModule[139]=C:\Windows\SysWOW64\CCM\StateMessage.dll
LoadedModule[140]=C:\Windows\SysWOW64\CCM\InvFileSystemCollectionTask.dll
LoadedModule[141]=C:\Windows\SysWOW64\CCM\InvFileSystemQueryTask.dll
LoadedModule[142]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\COMCTL32.DLL
LoadedModule[143]=C:\Windows\SysWOW64\CCM\CCMAuthMessageHook.dll
LoadedModule[144]=C:\Windows\SysWOW64\CCM\CcmProxy.dll
LoadedModule[145]=C:\Windows\SysWOW64\CCM\ccmhttp.dll
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=CCM Executive
AppPath=C:\Windows\SysWOW64\CCM\CcmExec.exe
- Reply
- Quote
Thursday, July 14, 2011 9:09 AM

1

So its something which SCCM does once an hour which is crashing.

Just have look at the ConfigMgr logfiles to see what's going on at the point of time.
Torsten Meringer | http://www.mssccmfaq.de
- Reply
- Quote
Friday, September 16, 2011 8:36 AM

1
Hi there

If the message is showing every 65 minutes or so then it could be that CALTRACK.DLL is faulting. Are these machines Server 2008 and x64 by any chance?

Try renaming CALTRACK.DLL to CALTRACK.OLD. Does the problem go away?
- Proposed As Answer by Jason W Wallace Monday, November 07, 2011 2:52 PM
- Reply
- Quote
Saturday, September 17, 2011 5:54 PM

0
Hello there,

I can confirm that we also has the same issue on all of our SCCM Secondary Sites running Windows Server 2008 R2 x64.
This server runs WDS, MP, DP on SCCM 2007 SP2 R3.

During OSD Deployment we suddenly see that the SMS Agent Host Serivce crashes (CCMEXEC.exe) with following event error:
----------------------QOUTE----------------------------------------------------------------------------------------------------------------------------------

Faulting application name: CcmExec.exe, version: 4.0.6487.2000, time stamp: 0x4ab33e4d
Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58
Exception code: 0xc0000005
Fault offset: 0x0009ce04
Faulting process id: 0xc58
Faulting application start time: 0x01cc50371f1d9317
Faulting application path: D:\SMS_CCM\CcmExec.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 93ccc0f5-e058-11e0-9746-984be1753436'

----------------------UNQOUTE----------------------------------------------------------------------------------------------------------------------------------

5minutes after the SMS Agent Host service has crashed, the ManagementPoints crashes with HTTP 500 internal server error in the event log:

----------------------QOUTE----------------------------------------------------------------------------------------------------------------------------------

On 16.09.2011 13:40:49, component SMS_MP_CONTROL_MANAGER on computer SBO000 reported: MP Control Manager detected management point is not responding to HTTP requests. The HTTP status code and text is 500, Internal Server Error.

Possible cause: Management point encountered an error when connecting to SQL Server.
Solution: Verify that the SQL server is properly configured to allow Management Point access. Verify that management point computer account or the Management Point Database Connection Account is a member of SMS Management Point Role (msdbrole_MP) in the SQL Server database.

Possible cause: The SQL Server Service Principal Names (SPNs) are not registered correctly in Active Directory
Solution: Ensure SQL server SPNs are correctly registered. Review Q829868.

Possible cause: Internet Information Services (IIS) isn't configured to listen on the ports over which SMS is configured to communicate.
Solution: Verify that the designated Web Site is configured to use the same ports which SMS is configured to use.

Possible cause: The designated Web Site is disabled in IIS.
Solution: Verify that the designated Web Site is enabled, and functioning properly.

Possible cause: The SMS ISAPI Application Identity does not have the requisite logon privileges.
Solution: Verify that the account that the SMS ISAPI is configured to run under has not been denied batch logon rights through group policy.

For more information, refer to Microsoft Knowledge Base article 838891.
----------------------------------------------------UNQOUTE------------------------------------------------------------------------------------------------------------------

After these two Event Messages in the Event Log, we see that the SCCM Client and SCCM MP are "re-configured/reinstalled"
every 1hours as follows:

-----------------------QOUTE-----------------------------

Windows Installer reconfigured the product. Product Name: SMS Management Point. Product Version: 4.00.6487.2000. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.

Windows Installer reconfigured the product. Product Name: Configuration Manager Client. Product Version: 4.00.6487.2000. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.

--------------------------------------------------UNQOUTE------------------------------------------------------------------------------------------------------------------

This problem re-occurs every hours and all OSD Deployment fails.
We also see that the during F12 PXE boot, that when the Boot Image states "Windows is starting up", the machines simply
goes in black and reboots when you expect to see the "welcome message".

We contactet Microsoft Premier Support today and was instructed to rename
the "ccm_caltrack.dl" to "ccm_caltrack.dll.old" and reboot the server.

This file is located in .\SMS_CCM folder of your Management Point directory.

After doing this we have not seen this problem so far, but we are awaiting for Microsoft Premier Support
to verify if this is an bug or what that possibly can cause this issue.

This is simply frustrating. I reccomend other that are experienceing this problem
to conact Microsoft Premier Support.

Best Regards
Anders Horgen

Best Regards Anders Horgen
- Proposed As Answer by Anders Horgen Saturday, September 17, 2011 5:54 PM
- Reply
- Quote

Monday, October 10, 2011 10:17 AM

Hi,

I've been seeing a similair issue to this on 2008 R2 x64 servers recently - checked via running status message report (#77 - MessageID 669).

The CCMExec.exe crash seems to be happening every 65 minuites and is related to CALTrack.

I've spoken to a Microsoft PFE who confirms this is a know issue which has been bug tracked (184867), but the fix is being delayed until SCCM 2012.

The workaround for this, if you are not tracking CALs via SCCM, is to rename the ccm_caltrack.dll file in %systemroot%\SysWOW64\CCM

Example of ccmexec.log

CALTRACK: ICcmSystemTask::Execute invoked by ccmexec.          CcmExec              9/19/2011 2:37:17 PM    7716 (0x1E24)
CALTRACK: ICcmTask::Execute invoked by ccmexec.        CcmExec              9/19/2011 2:37:17 PM    7716 (0x1E24)
CALTRACK: CCalTrackMgr::DoCalTrack Invoked                CcmExec              9/19/2011 2:37:17 PM    7716 (0x1E24)
CALTRACK: No previous CAL data was collected on this system.                CcmExec              9/19/2011 2:37:17 PM    7716 (0x1E24)
CALTRACK: CAL Collection was invoked and skipped.     CcmExec              9/19/2011 2:37:17 PM    7716 (0x1E24)
Successfully raised pending event             CCMEXEC            9/19/2011 2:37:17 PM    7676 (0x1DFC)
Raising event:

instance of CCM_CcmHttp_Status
{
                ClientID = "GUID:01FD0D34-BC70-4BC0-BF6B-778E570A22B2";
                DateTime = "20110919133717.921000+000";
                HostName = "XXXX";
                HRESULT = "0x00000000";
                ProcessID = 6800;
                StatusCode = 0;
                ThreadID = 7848;
};
                CcmExec              9/19/2011 2:37:17 PM    7848 (0x1EA8)
Starting CCMEXEC service...        CcmExec              9/19/2011 2:42:18 PM    216 (0x00D8)
Running on machine XXXX as user SYSTEM.   CcmExec              9/19/2011 2:42:18 PM    216 (0x00D8)
Initializing COM.               CcmExec              9/19/2011 2:42:18 PM    216 (0x00D8)

Not ideal, but it has reduced the instances of CCMExec.exe crashes to zero.

Regards,

Steve.

Just a good old boy, never meaning no harm

Proposed As Answer by Fuse Collaboration Thursday, November 17, 2011 9:38 AM

Thursday, November 24, 2011 1:39 PM

0

@SteveCarter: Thanks a lot for your replying here!

Had the exact same issue on a SCCM 2007 SP2 R3 server running on Windows Server 2008 R2.

The crashing of the ccm_exec process every ~65 minutes caused big problems for the sccm server; OSD tasks that were running would fail in the middle of the task, because they couldn't communicate with the sccm server for a couple of minutes.

Had already disabled the virusscanner on the server (SCCM-integrated FEP), and excluded the ccm_exec process, but no luck.

Very happy to read this thread, so i can close this incident.
- Reply
- Quote
Wednesday, July 25, 2012 6:52 AM

0
Hello All,

Microsoft has finnaly created an SCCM Client HotFix which resolves this
the issue where CCMEXEC Process crasses every ~66minutes : http://support.microsoft.com/kb/2724939

Therefore there is no more need to perform the ccm_Caltrack.dll workaround anymore :)
Best Regards Anders Horgen
- Proposed As Answer by Torsten [MVP]MVP Wednesday, July 25, 2012 7:24 AM
- Reply
- Quote

Faulting application CcmExec.exe, version 4.0.6487.2000, faulting module 4ab33e4d, version ntdll.dll, fault address 0x6.1.7600.16385.

All Replies

Products

Resources

Solutions

Updates

Trials

Related Sites

Training

Certifications

Other resources

Support by product

Other support links

Not an IT pro?