Resolution to the EMCoreService terminating unexectedly on AppSense Environment manager 8 FR4 working with AppSense Management Center
On AppSense Environment manager 8.4.223 working in conjunction with AppSense Management Center we came across an intermittent issue where the EMCoreService would fail
Dump from event log: Log Name: Application Source: Application Error Date: 19/06/2015 11:12:06 Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: ######### Description: Faulting application name: EmCoreService.exe, version: 220.127.116.11, time stamp: 0x50fd9361 Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a Exception code: 0xc0000374 Fault offset: 0x00000000000c4102 Faulting process id: 0x1f40 Faulting application start time: 0x01d0aa7865465153 Faulting application path: C:\Program Files\AppSense\Environment Manager\Agent\EmCoreService.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: a2f49b69-166b-11e5-9cd9-5cf9ddeac52b Event Xml: 1000 2 100 0x80000000000000 2239368 Application CT040264.ad.ucl.ac.uk EmCoreService.exe 18.104.22.168 50fd9361 ntdll.dll 6.1.7601.18229 51fb164a c0000374 00000000000c4102 1f40 01d0aa7865465153 C:\Program Files\AppSense\Environment Manager\Agent\EmCoreService.exe C:\WINDOWS\SYSTEM32\ntdll.dll a2f49b69-166b-11e5-9cd9-5cf9ddeac52b
After a discussion with AppSense support i was pointed in the direction of the following KB article which solved my issue:
TN-150974 – EmCoreService terminating unexpectedly (heap corruption) due to invalid entries in GPT.ini
Date added: 17 Jun 2013
Last Modified: 25 Apr 2014
The EmCoreService has been seen to crash with an exception indicating a heap corruption. Once the crash has occurred, the service cannot be started due to the error “Error 1067: The process terminated unexpectedly”
The EmCoreService reads and writes to the GPT.ini file at service start to ensure the entry for group policy scripts is present (as logoff / shutdown triggers rely on it). This file is found in the following location:
From AMC8 FR3 onwards a Client Side Extension was added by the CCA to the GPT.ini file to allow the prevention of user logons whilst a Management Center installation is taking place. The CCA.exe therefore also reads / writes to the GPT.ini at service start.
Both of these processes write to the GPT.ini file using different Microsoft APIs. The APIs does not therefore provide file synchronization and it is therefore possible for two threads / processes to write to the file synchronously and cause corruption.
The corruption does not occur every time and is timing dependent.
The EmCoreService crash is resolved in Environment Manager 8 FR4 SP3 HF2 (available for download from https://www.myappsense.com/software/Hotfix.aspx?g=95e4dc53-1177-436b-86c9-6fa5c5fff930) and Environment Manager 8.3 Patch 5 (available on demand from AppSense Support) where code has been added to handle the corrupt GTP.ini file and the API has been changed to use group policy modification APIs rather than standard text file modification APIs..
An interim solution exists of either manually repairing (by copying in a working version) the GPT.ini, or deleting the file and allowing the services to recreate it individually by restarting them one at a time (although any other entries will not be recreated so this is not preferred).