Home / server / Questions / 130716
Accepted
Ice
Asked: 2010-04-09 13:24:52 +0800 CST

If DEP has stopped an app, is there a possibility to see this events in a log?

  • 772

DEP (Microsofts Data Execution Prevention) stopps sometimes some apps and kills it out of memory. As an administrator, may i see such events in a log and if which one?

My experience is that there is no user information as written in Help about DEP, user reported only that the desired app disappears from their screens. This happens on a Citrix-Server running on a windows-2003 R2 64-Bit Server.

windows windows-server-2003

2 Answers

  1. Best Answer

    yes I'm pretty sure you'll see and application error in the application log!

    • 1

  2. Yes, the Application event log will show an Error entry with Event ID = 1000.

    In my experience, events with exception ID 0xc0000005 (STATUS_ACCESS_VIOLATION) are often indicative that the application is not compatible with DEP.

    Application developers should be aware of DEP behavior in user mode. A user-mode DEP exception results in a STATUS_ACCESS_VIOLATION (0xc0000005) on Windows systems. The first parameter of ExceptionInformation that is located inside the EXCEPTION_RECORD structure contains the type of access violation that occurred. A value of 8 for ExceptionInformation[0] indicates the access violation was an execution violation.

    Source: http://technet.microsoft.com/en-us/library/cc738483(WS.10).aspx

    • 1