locked
Event Error 6007 Apllication Virtualization Unable to attach to process (terminated Process) RRS feed

  • Question

  • Question: Im getting lots of event logs for:
    Event ID:6007,
    Source: Application Virtualization,
    Description:Q:\Off2k7.002\Microsoft Office\Office12\OUTLOOK.EXEUnable to attach to process 4492 (Terminated Process)

    Only seems to happen with Outlook and Word. I am using AppV client 4.6 SP1 (On Windows Server 2003). Any Ideas?

    Thanks in advance for any help
    Monday, April 11, 2011 3:00 PM

Answers

  • Hi Znack,

     

    That’s the frustrating part – he is on the same user policy as everyone else, a standard group policy that is applied to all users that connect to the Citrix server farm.

     

    I haven’t been able to get any other user to recreate this error.

     

    I have recreated his roaming profile, to ensure his user related settings were reset and I  changed his Wyse box (on the very small chance that it was some weird networking error), but thats about it.

     

    I did come accross a hotfix this morning that i am going to try - KB956438, will keep you posted on how it goes

     

    Thanks again

     

    Whiffman

     

    • Proposed as answer by znack Tuesday, May 17, 2011 1:53 PM
    • Marked as answer by Aaron.ParkerModerator Saturday, November 17, 2012 3:49 PM
    Thursday, April 14, 2011 9:08 AM

All replies

  • Hello,

    Are there any experienced problems with using the application along with these error messages? 
    /Znack
    Monday, April 11, 2011 3:09 PM
  • Hi Znack,

     

    Thanks for the response.

     

    I have one user that I have on a separate server from everyone else as he keeps seeming to crash the server.  I’m not entirely sure that the event is related, but I do see this event about 5 or 10 minutes before it hangs and not much else in the event log.      Around the same time as the event I see in the sftlog.txt:

     

    [04/11/2011 14:14:10:760 SWAP INF] {hap=1D:app=Microsoft Office Outlook 2007 12.0.6423.1000:tid=1160:usr=clindsey}

    App shut down

     

     

    [04/11/2011 14:14:11:682 ???? INF] {tid=147C:usr=clindsey}

    An error occurred while opening the virtual registry (section: 9), rc: 07B01F0C-0000004A

     

     

    [04/11/2011 14:14:11:854 ???? INF] {tid=147C}

    An error occurred while opening the virtual registry (section: 9), rc: 07B01F0C-0000004A

     

     

    [04/11/2011 14:14:11:869 SWAP INF] {hap=24:app=Microsoft Office Outlook 2007 12.0.6423.1000:tid=147C:usr=clindsey}

    Elapsed time for upload: 0.297 seconds

     

     

    [04/11/2011 14:14:12:604 SWAP INF] {hap=24:app=Microsoft Office Outlook 2007 12.0.6423.1000:tid=147C:usr=clindsey}

    Elapsed time for launch: 1.109 seconds

     

    I didn’t mention before that this user is running a Citrix Published Desktop (XenApp 5 FR2)

     

    As I said before, I’m not entirely sure the event is causing my problems but would like to rule it out.

     

    Thanks again for your response

     

    Whiffman

    Tuesday, April 12, 2011 7:40 AM
  • Hello,

    How does the server crash? 
    /Znack
    Tuesday, April 12, 2011 7:43 AM
  • Hi Znack,

     

    If I try to log onto the server console (through VSphere client), it might let me put a username and password in, but then will go no further and it just shows a blue screen (NOT a BSOD).  No other users will be able to log onto the server and on the Citrix Delivery Services console the server is shown as down.  If I try to use Process Explorer remotely from my PC, I get no response.  I am unable to do PS list, think it says that the registry cannot be accessed.  I am able ping it.  The only way to get the server available again is to reset it.    

     

    Thanks

     

    Whiffman

    Tuesday, April 12, 2011 8:11 AM
  • Hello,

    have you determined what the BSOD error says? 
    /Znack
    Tuesday, April 12, 2011 8:13 AM
  • Sorry Znack, it is not a BSOD, it is that the screen just seems to display a blue background and nothing else (no icons, no start menu, just a blank blue screen)

    Tuesday, April 12, 2011 8:27 AM
  • Hello,

    So the App-V logs gives an error 10 minutes before the freeze occurs? (wow)

    See this article;

    http://support.microsoft.com/kb/973366

    When implementing that properly - its extremely rare that a server crashes due to App-V. 


    /Znack
    Tuesday, April 12, 2011 8:29 AM
  • Thanks Znack,

     

    I need to set a couple of those registry settings, all the rest of the recommendations I have in place.  I will do this and let you know how it goes.

     

    Thanks again for all of your help

     

    Whiffman

    Tuesday, April 12, 2011 8:41 AM
  • Hi Znack,

     

    I made all of the recommended changes except:

     

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory
    Management
    Value name: PagedPoolSize
    Data type: REG_DWORD
    Radix: Hex
    Value data: FFFFFFFF

     

    As this causes a continuous reboot of the server.

     

    Will let you know how it goes

     

    Whiffman

    Tuesday, April 12, 2011 9:42 AM
  • Hi Znack,

     

    Server crash just happened again and I got a few more details as I happened to be logged onto the server.

     

    The user tried to open a word document that just seemed to hang on opening.  When he tried to close word he got an unable to end process box pop up, but was still unable to end the process.  He then attempted to log out – This is when the server stopped responding.  I watched him log off, all of his processes ended as expected, but then it left 3 processes:

     

    Csrss.exe

    Winlogon.exe

    Winword.exe

     

    I was unable to end the winword.exe process.  When he attempted to re-log into the server is just did not respond.  I attempted to log on with another user and got no response from the server.  I had to restart the server so that he could log in.

     

    I think the event log was a red herring as after this crash, when I checked the event log I did have the 6007 log, but it was 45 minutes before this crash so could not be related.  Also the error was to do with Outlook, not Word.

     

    Starting to pull my hair out with this one!

     

    Whiffman

    Wednesday, April 13, 2011 11:18 AM
  • Hello,

    Depending on how your environment is setup - quite a few things can happen.

    You stated earlier that this effects one user - have you determined if anyone else can reproduce such a problem?

    Have you tried resetting anything user-specific to verify if there is a problem with his current setup?


    /Znack
    Thursday, April 14, 2011 8:04 AM
  • Hi Znack,

     

    That’s the frustrating part – he is on the same user policy as everyone else, a standard group policy that is applied to all users that connect to the Citrix server farm.

     

    I haven’t been able to get any other user to recreate this error.

     

    I have recreated his roaming profile, to ensure his user related settings were reset and I  changed his Wyse box (on the very small chance that it was some weird networking error), but thats about it.

     

    I did come accross a hotfix this morning that i am going to try - KB956438, will keep you posted on how it goes

     

    Thanks again

     

    Whiffman

     

    • Proposed as answer by znack Tuesday, May 17, 2011 1:53 PM
    • Marked as answer by Aaron.ParkerModerator Saturday, November 17, 2012 3:49 PM
    Thursday, April 14, 2011 9:08 AM
  • I would test this under RDP without the Citrix hook to narrow down issue.

     

    Back up the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key and also the same key under the WOW6432Node.

    Then remove under the AppInit_DLLS value the "MFAPHOOK.DLL" entry.

    Log on via RDP and then test launching office.

    See if the issue reproduces.


    Steve Thomas, SSEE, Microsoft
    App-V/MED-V/SCVMM/SCCM/AppCompat
    http://madvirtualizer.wordpress.com/
    The App-V Team blog: http://blogs.technet.com/appv/
    The MED-V Team Blog: http://blogs.technet.com/medv
    The SCVMM Team blog: http://blogs.technet.com/scvmm/

    “This posting is provided "AS IS" with no warranties, and confers no rights. User assumes all risks.”
    Tuesday, April 19, 2011 10:55 AM
  • Hi Steve,

    thanks for the reply - I will try this if the hot fix is no good

    regards

    Whiffman

    Tuesday, April 19, 2011 3:19 PM
  • Just so you know, no more server crashes since the hotfix

     

    thanks again for all of your help

    Tuesday, May 17, 2011 1:46 PM