Good morning; We have SCCM installed on our Primary Site Server. The OS has been recently upgraded and now the SMS Agent Host (CcmExec) process runs for about a day but the dies, restarts after 5 minutes, and continues to die every 62 minutes. Restarting the server will fix it for about a day. Original configuration: Windows Server 2008 Standard, 16 GB memory; SQL Server 2008 SP1; SCCM 2007 SP2/R2 Mixed Mode New configuration: Windows Server 2008 Enterprise R2, 48 GB memory; SQL Server 2008 SP2; SCCM 2007 SP2/R2 Mixed Mode NOTE: The Primary Site Server has the following roles: ConfigMgr component server ConfigMgr PXE service point ConfigMgr site server ConfigMgr site system ConfigMgr site database server These roles are on additional servers in the primary site: ConfigMgr component server ConfigMgr distribution point ConfigMgr management point ConfigMgr reporting point ConfigMgr server locator point ConfigMgr site system ConfigMgr fallback status point ConfigMgr software update point ConfigMgr state migration point When the process dies, the following is logged in the application log: Log Name: Application Source: Application Error Date: 4/29/2010 9:52:02 AM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: <REMOVED> Description: Faulting application name: CcmExec.exe, version: 4.0.6487.2000, time stamp: 0x4ab33e4d Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b Exception code: 0xc0000005 Fault offset: 0x0009cb74 Faulting process id: 0x3938 Faulting application start time: 0x01cae79a795cd071 Faulting application path: E:\SMS_CCM\CcmExec.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll Report Id: 632420c1-5396-11df-b319-0015178515b7 Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2010-04-29T13:52:02.000000000Z" /> <EventRecordID>3217682</EventRecordID> <Channel>Application</Channel> <Computer>REMOVED</Computer> <Security /> </System> <EventData> <Data>CcmExec.exe</Data> <Data>4.0.6487.2000</Data> <Data>4ab33e4d</Data> <Data>ntdll.dll</Data> <Data>6.1.7600.16385</Data> <Data>4a5bdb3b</Data> <Data>c0000005</Data> <Data>0009cb74</Data> <Data>3938</Data> <Data>01cae79a795cd071</Data> <Data>E:\SMS_CCM\CcmExec.exe</Data> <Data>C:\Windows\SysWOW64\ntdll.dll</Data> <Data>632420c1-5396-11df-b319-0015178515b7</Data> </EventData> </Event> Additionally, a mdmp and mtxt file are created in the E:\SMS_CCM directory. The mtxt file contains: App Name = CcmExec.exe App Version = 4.0.6487.2000 Module Name = ntdll.dll Module Version = 6.1.7600.16385 Module Offset = 0009cb74 And this is what is in the ccmexec.log right before it dies: <![LOG[CALTRACK: ICcmSystemTask::Execute invoked by ccmexec.]LOG]!><time="08:44:55.363+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="23944" file="systemtasks.cpp:29"> <![LOG[CALTRACK: ICcmTask::Execute invoked by ccmexec.]LOG]!><time="08:44:55.364+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="23944" file="systemtasks.cpp:39"> <![LOG[CALTRACK: CCalTrackMgr::DoCalTrack Invoked]LOG]!><time="08:44:55.365+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="23944" file="caltrackmgr.cpp:305"> <![LOG[CALTRACK: No previous CAL data was collected on this system.]LOG]!><time="08:44:55.369+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="23944" file="caltrackmgr.cpp:153"> <![LOG[CALTRACK: CAL Collection was invoked and skipped.]LOG]!><time="08:44:55.369+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="23944" file="caltrackmgr.cpp:600"> <![LOG[Successfully raised pending event]LOG]!><time="08:44:55.613+240" date="04-29-2010" component="CCMEXEC" context="" type="1" thread="12624" file="eventprovider.cpp:383"> <![LOG[Raising event: instance of CCM_CcmHttp_Status { ClientID = "GUID:49B8F2BC-132E-4259-9AC2-A9F90C6406F8"; DateTime = "20100429124455.792000+000"; HostName = "<MPSERVER>"; HRESULT = "0x00000000"; ProcessID = 29304; StatusCode = 0; ThreadID = 22140; }; ]LOG]!><time="08:44:55.792+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="22140" file="event.cpp:525"> <![LOG[Starting CCMEXEC service...]LOG]!><time="08:49:58.077+240" date="04-29-2010" component="CcmExec" context="" type="1" thread="37452" file="entrypoint.cpp:2169"> Please Advise. Thanks; Terence Durning

have you checked ccmexec.log ?Bechir Gharbi. MCSA, MCSE M+S, MCITP Server/Enterprise Administrator, MCT, MCTS Configuration Manager/Forefront (Time Zone : GMT+1)

The pb maybe caused by a third party software programs or drivers that have been installed on your computer, as far as I know it is almost always the cause of ntdll.dll errors. When you have removed the sccm client, have you rebooted and removed the ccm folder (under %systemroot%system32) before reinstalling the client again Bechir Gharbi. MCSA, MCSE M+S, MCITP Server/Enterprise Administrator, MCT, MCTS Configuration Manager/Forefront (Time Zone : GMT+1)

Hi Bechir; Yes, the server was rebooted in between the uninstall and reinstall of the client, as well as the CCM and CCMSetup folders. It has been working for 18 months, but just started this behavior since the Server 2008 Enterprise R2 upgrade. Thanks; Terence

Here are the results when I ran the following: C:\>sfc /verifyonly Beginning system scan. This process will take some time. Beginning verification phase of system scan. Verification 100% complete. Windows Resource Protection did not find any integrity violations. C:\>

another question: what antivirus you use on your server ? Can you exclude the ccmexec process from real time scan (auto-protect) & see the result.Bechir Gharbi. MCSA, MCSE M+S, MCITP Server/Enterprise Administrator, MCT, MCTS Configuration Manager/Forefront (Time Zone : GMT+1)

I have to wait until Monday, but I'll try that and let you know. Thanks for your help on this, I do appreciate it.

We have the exact same problem, and I ran the C:\>sfc /scannow with the same result. Windows Resource Protection did not find any integrity violations. We are running Norman Endpoint Protection on the server and I will try to exclude the ccmexec.exe from real time scan, as proposed by Bechir Gharbi. I'll post the result here later on.

Yes, it is always the same error in eventvwr. Starting to get a headache over this now...

Sorry for the late response. Indeed it was a third-party product that caused the error. Actually it was the anti-virus software ;p Thanks for all the help. A Fabis Abstinentes -Pythagoras of Samos

Hi Bechir; Good call. I talked with the AV team and the SCCM folders are already excluded from AV scanning, but it seems AV might have been the root cause after all - they upgraded the McAfee Framework from 4.0 to 4.5 and the problem has not reappeared. Thanks; Terence Durning