locked
Outlook version 1909 ( click-to-run) Fault : c0000005 when Group Policy syncs ! RRS feed

  • Question

  • We have a user base of around 1200 machines,  ever week we average about  700 crash occurring on half of our computers. Of the Outlook crashes, 75% are of the exception type C0000005 ( access violation).  here is sample of the crash details :

    From the users perspective the crashes occur randomly, something when they are not even using their computers.  Email drafts are sometimes lost in the process.

    From an event log perspective, the 75% of the C0000005 crashes occur then the Group Policy client is syncing policy.  As a control, we completely disabled the gpsvc service on a few machine = No group policy. which is radical config change but on those machines No more Outlook crashing.

    Using a different group of PCs we are disabling User and Computer processing of a few GPO Preference extensions for which we see Processing start - complete activity in milliseconds prior or after the crash here is an example :

    I merged the App fault event ID 1000 with the Group Policy log to get synced view of the crashing. 

    11/28/2019 3:54:16 PM 5320 Information      Microsoft-Windows-GroupPolicy Checking for Group Policy client extension...

    11/28/2019 3:54:16 PM 5320 Information      Microsoft-Windows-GroupPolicy Service configuration update to standalone...

    11/28/2019 3:54:16 PM 5320 Information      Microsoft-Windows-GroupPolicy Finished checking for non-system extensions.

    11/28/2019 3:54:16 PM 4016 Information      Microsoft-Windows-GroupPolicy Starting Registry Extension Processing. ... 

    11/28/2019 3:54:17 PM 5016 Information      Microsoft-Windows-GroupPolicy Completed Registry Extension Processing in...

    11/28/2019 3:54:17 PM 4016 Information      Microsoft-Windows-GroupPolicy Starting Group Policy Local Users and Grou...

    11/28/2019 3:54:17 PM 1000 Error            Application Error             Faulting application name: OUTLOOK.EXE, ve...

    11/28/2019 3:54:22 PM 1085 Warning          Microsoft-Windows-GroupPolicy Windows failed to apply the Group Policy L...

    11/28/2019 3:54:22 PM 7016 Error            Microsoft-Windows-GroupPolicy Completed Group Policy Local Users and Gro...

    11/28/2019 3:54:22 PM 4016 Information      Microsoft-Windows-GroupPolicy Starting Group Policy Folders Extension Pr...

    11/28/2019 3:54:27 PM 1085 Warning          Microsoft-Windows-GroupPolicy Windows failed to apply the Group Policy F...

    11/28/2019 3:54:27 PM 7016 Error            Microsoft-Windows-GroupPolicy Completed Group Policy Folders Extension P...

    11/28/2019 3:54:27 PM 4016 Information      Microsoft-Windows-GroupPolicy Starting Group Policy Files Extension Proc...

    11/28/2019 3:54:36 PM 5016 Information      Microsoft-Windows-GroupPolicy Completed Group Policy Files Extension Pro...

    Modules we have disabled to date : using the Dword, NoUserPolicy, and NoMachinePolicy = 1 keys,  as keys are locked with security, do make  changes we use psexec as system account.

    psexec \\$CmpName -s cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}" /v "NoUserPolicy"  /t REG_DWORD /d 1 /f 2>$null

    ..etc 

    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}" - Registry Processing
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509} - Local Users and groups
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8} Folder Options
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}" - Folders

    We are still waiting for crash data to see if the disabling of the GPExtensions above has made an impact. 

    Anyone else here seeing this pattern ?


    • Edited by naimco Saturday, November 30, 2019 5:58 PM typo in title
    • Moved by Perry-Pan Monday, December 2, 2019 1:31 AM
    Friday, November 29, 2019 6:54 PM

Answers

  • We opened a ticket with Premier got nowhere because we were not able to get any of our users to use Outlook with all add-in's disabled.

    So after 2 months of hell for our users we updated Office 365  last week. 

    Our deployed Outlook went from version 16.0.12130.20344 to version 16.0.12325.20298 

    And with this change Amazing, our crash numbers went back down !  Great job Office team on the stealth bugs and subsequent stealth fix.



    • Marked as answer by naimco Monday, January 27, 2020 7:22 PM
    • Edited by naimco Monday, January 27, 2020 7:23 PM type
    Monday, January 27, 2020 7:22 PM

All replies

  • As it occurs to large amounts of computers, it could be more related with the environment or global settings.

    We can try opening Outlook in safe mode to see if the issue continues. Please exit Outlook, press Win key + R to open the Run command, type outlook /safe and then press Enter. This helps eliminate whether the problem lies on any third party add-ins.

    Besides, according to the “Fault : c0000005”, I found one similar thread which mentions this could be related with the antivirus software on these PCs.

    Try temporarily exit all antivirus programs on one problematic client to test the results.

    If none of these helps, in case this issue was caused by software conflicts, please try performing a clean boot in Windows to check the result.

    Regards,

    Perry


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    • Proposed as answer by Perry-Pan Tuesday, December 3, 2019 6:47 AM
    Monday, December 2, 2019 2:22 AM
  • Are there any updates with this issue?

    Regards,

    Perry


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, December 5, 2019 1:53 AM
  • Well we did two things :  Opened an Support call with our EA support, started the support ticket with the Group Policy team.  as the Outlook crash is not the 1st issue,  GPO extensions take over 5000ms  when the Outlook crash occurs.

    The second thing we did is "shim", the GPO scheduled task, at every boot we change the action of tasks :
    "\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}" and "{A7719E0F-10DB-4640-AD8C-490CC6AD5202}"  replace default actions with a custom script I created that starts a procmon trace, prior to doing the requested Gpupdate /target:User or gpupdate /target:computer.  If an Outlook crash occurs during the Procmon trace we keep it and I get an email notificatino of the crash.  If no crash occurs the procmon trace is deleted.   I also added extra logic to cancel the gpupdate /target:  if a user is logged on and Outlook.exe is running.  That way we can still collect data from crash while excluding users who can no longer afford to crash. 

    My next step is to prepare is to run after hours a script that will call Outlook.exe /safe in the enter use context and will then perform and end less loop of , Procmon trace, gpupdate /target:Computer, 30 seconds wait, gpupdate /Targe:User repeat till crash.  If I can get a crash of Outlook.exe crashing in /safe mode we will open a second ticket with the Office 365 team. 

    Regards
    Monday, December 9, 2019 4:40 PM
  • Thanks for your update. Have you tried the suggestion above? Are there any improvements?

    I would recommend you focus the ticket with Office 365 team. You could also share the updates here.

    Regards,

    Perry


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Tuesday, December 10, 2019 5:27 AM
  • We opened a ticket with Premier got nowhere because we were not able to get any of our users to use Outlook with all add-in's disabled.

    So after 2 months of hell for our users we updated Office 365  last week. 

    Our deployed Outlook went from version 16.0.12130.20344 to version 16.0.12325.20298 

    And with this change Amazing, our crash numbers went back down !  Great job Office team on the stealth bugs and subsequent stealth fix.



    • Marked as answer by naimco Monday, January 27, 2020 7:22 PM
    • Edited by naimco Monday, January 27, 2020 7:23 PM type
    Monday, January 27, 2020 7:22 PM