AppSense: User Virtualization Service has unexpectedly terminated

Summary:

Resolution to the EMCoreService terminating unexectedly on AppSense Environment manager 8 FR4 working with AppSense Management Center

 Issue:

On AppSense Environment manager 8.4.223 working in conjunction with AppSense Management Center we came across an intermittent issue where the EMCoreService would fail

Dump from event log:

Log Name: Application
Source: Application Error
Date: 19/06/2015 11:12:06
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: #########
Description:
Faulting application name: EmCoreService.exe, version: 8.4.195.0, time stamp: 0x50fd9361
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000374
Fault offset: 0x00000000000c4102
Faulting process id: 0x1f40
Faulting application start time: 0x01d0aa7865465153
Faulting application path: C:\Program Files\AppSense\Environment Manager\Agent\EmCoreService.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: a2f49b69-166b-11e5-9cd9-5cf9ddeac52b
Event Xml:



1000
2
100
0x80000000000000

2239368
Application
CT040264.ad.ucl.ac.uk



EmCoreService.exe
8.4.195.0
50fd9361
ntdll.dll
6.1.7601.18229
51fb164a
c0000374
00000000000c4102
1f40
01d0aa7865465153
C:\Program Files\AppSense\Environment Manager\Agent\EmCoreService.exe
C:\WINDOWS\SYSTEM32\ntdll.dll
a2f49b69-166b-11e5-9cd9-5cf9ddeac52b

Resolution:

After a discussion with AppSense support i was pointed in the direction of the following KB article which solved my issue:

https://www.myappsense.com/Knowledgebase/TN-150974.aspx

TN-150974 – EmCoreService terminating unexpectedly (heap corruption) due to invalid entries in GPT.ini

Date added: 17 Jun 2013

Last Modified: 25 Apr 2014

Back to results

Applies To

Products:
Environment Manager 8.1.ALL, Environment Manager 8.2.ALL, Environment Manager 8.3.ALL, Management Center 8.3.ALL, Management Center 8.4.186, Environment Manager 8.4.190, Environment Manager 8.4.195, Environment Manager 8.4.223

Fixed In:
Environment Manager 8_3_308, Environment Manager 8_4_497

Symptom

The EmCoreService has been seen to crash with an exception indicating a heap corruption. Once the crash has occurred, the service cannot be started due to the error “Error 1067: The process terminated unexpectedly”

Cause

The EmCoreService reads and writes to the GPT.ini file at service start to ensure the entry for group policy scripts is present (as logoff / shutdown triggers rely on it). This file is found in the following location:

C:\Windows\System32\GroupPolicy\gpt.ini

From AMC8 FR3 onwards a Client Side Extension was added by the CCA to the GPT.ini file to allow the prevention of user logons whilst a Management Center installation is taking place. The CCA.exe therefore also reads / writes to the GPT.ini at service start.

Both of these processes write to the GPT.ini file using different Microsoft APIs. The APIs does not therefore provide file synchronization and it is therefore possible for two threads / processes to write to the file synchronously and cause corruption.

The corruption does not occur every time and is timing dependent.

Solution

The EmCoreService crash is resolved in Environment Manager 8 FR4 SP3 HF2 (available for download from https://www.myappsense.com/software/Hotfix.aspx?g=95e4dc53-1177-436b-86c9-6fa5c5fff930) and Environment Manager 8.3 Patch 5 (available on demand from AppSense Support) where code has been added to handle the corrupt GTP.ini file and the API has been changed to use group policy modification APIs rather than standard text file modification APIs..

An interim solution exists of either manually repairing (by copying in a working version) the GPT.ini, or deleting the file and allowing the services to recreate it individually by restarting them one at a time (although any other entries will not be recreated so this is not preferred).

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s