Hello, I am getting this error for the past 24 hours on one server every hour... I have an alert in SCOM, I have the event 7031 in the Event Logs... Faulting application CcmExec.exe, version 4.0.6487.2000, faulting module 4ab33e4d, version ntdll.dll, fault address 0x6.1.7600.16385. Operating System: Windows Server 2008 R2 Enterprise Anti-Virus: SOPHOS Anti-Virus 7.6.17 Threat detection date: 4.51E sfc /scannow Verification 100% complete Windows Resource Protection did not find any integrity violations. What could be the cause? how to trace it? What action to take? Some logs: Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1000 Date: 6/16/2010 Time: 9:25:04 AM User: N/A Computer: RXOAPP2.ad.medctr.ucla.edu Description: Faulting application CcmExec.exe, version 4.0.6487.2000, faulting module 4ab33e4d, version ntdll.dll, fault address 0x6.1.7600.16385. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ======================================================== Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7031 Date: 6/16/2010 Time: 9:25:05 AM User: N/A Computer: RXOAPP2.ad.medctr.ucla.edu Description: The SMS Agent Host service terminated unexpectedly. It has done this 21 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ======================================================= ccmexec.log Registering built-in COM class objects. CCMEXEC 6/16/2010 7:18:35 AM 7016 (0x1B68) Registering hosted COM class objects. CCMEXEC 6/16/2010 7:18:35 AM 7016 (0x1B68) Error registering hosted class '{E67DBF56-96CA-4e11-83A5-5DEC8BD02EA8}'. Code 0x80040154 CCMEXEC 6/16/2010 7:18:35 AM 7016 (0x1B68) ... CRTServiceStartupTask::Execute CcmExec 6/16/2010 7:18:35 AM 6600 (0x19C8) Failed to query size of Security (may not exist) (0x80070002) CcmExec 6/16/2010 7:18:35 AM 6600 (0x19C8) Invoking system task 'StatusAgentStartup' via ICcmSystemTask2 interface. CcmExec 6/16/2010 7:18:35 AM 6600 (0x19C8) ... Invoking system task 'SMSSHA_Startup'. CcmExec 6/16/2010 7:18:41 AM 4860 (0x12FC) System task 'SMSSHA_Startup' returned error code 0x80070005. CcmExec 6/16/2010 7:18:41 AM 4860 (0x12FC) Invoking system task 'DCMAgent_Startup'. CcmExec 6/16/2010 7:18:41 AM 1212 (0x04BC) ... CALTRACK: CAL Collection was invoked and skipped. CcmExec 6/16/2010 7:19:12 AM 6092 (0x17CC) Could not load logging configuration for component FileSystemFile. Using default values. CcmExec 6/16/2010 7:19:19 AM 1212 (0x04BC) New CCM (user, session) is: (,-1). CCMEXEC 6/16/2010 7:19:36 AM 4836 (0x12E4) ... Running the Control Panel > All Control Panel items > Troubleshooting > Programs > Program Compatibility > Not Listed > ccmexec Problems and Solution CcmExec is incompatible. Fix application CcmExec Completed Provides steps to fix the incompatible application. CompatMode CompatMode # WINXPSP2 UserVerifySolution User Verification of Solution Verify_YES Detection details Collection information Computer Name: RXOAPP2 Windows Version: 6.1 Architecture: amd64 Time: Wednesday, June 16, 2010 11:01:05 AM Publisher details Program Compatibility Make older programs run in this version of Windows. Package Version: 1.5 Publisher: Microsoft Windows Program Compatibility Make older programs run in this version of Windows. Package Version: 1.0 Publisher: Microsoft Corporation Thanks, Dom System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

We're also having this issue on some of our Exchange 2010 servers. Every hour the SMS Agent Host (ccmexec.exe) crashes and restarts on 3 of our 6 Exchange 2010 servers with the details as shown below. Its not a/v (we run McAfee), as it still happens when I exclude the ccmexec.exe process from scanning and even when I stop all the McAfee services from running. I uninstalled the SCCM client (ccmsetup /uninstall) and then reinstalled it. Exactly one hour after it was reinstalled it crashed again. So its something which SCCM does once an hour which is crashing. I thought it was Software Inventory, but if I manually launch a Software Inventory Action from the Config Mgr Control Panel applet, it does not crash. Log Name: Application Source: Application Error Date: 14/07/2011 9:19:21 AM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: <servername> Description: Faulting application name: CcmExec.exe, version: 4.0.6487.2000, time stamp: 0x4ab33e4d Faulting module name: ntdll.dll, version: 6.1.7600.16695, time stamp: 0x4cc7ab86 Exception code: 0xc0000005 Fault offset: 0x0009cec4 Faulting process id: 0x1f0c Faulting application start time: 0x01cc41bb950988e8 Faulting application path: C:\Windows\SysWOW64\CCM\CcmExec.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll Report Id: 4d50be75-adb7-11e0-b5a9-00155d011100 Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-07-14T01:19:21.000000000Z" /> <EventRecordID>99367</EventRecordID> <Channel>Application</Channel> <Computer> <servername></Computer> <Security /> </System> <EventData> <Data>CcmExec.exe</Data> <Data>4.0.6487.2000</Data> <Data>4ab33e4d</Data> <Data>ntdll.dll</Data> <Data>6.1.7600.16695</Data> <Data>4cc7ab86</Data> <Data>c0000005</Data> <Data>0009cec4</Data> <Data>1f0c</Data> <Data>01cc41bb950988e8</Data> <Data>C:\Windows\SysWOW64\CCM\CcmExec.exe</Data> <Data>C:\Windows\SysWOW64\ntdll.dll</Data> <Data>4d50be75-adb7-11e0-b5a9-00155d011100</Data> </EventData> </Event> The full report.wer is : Version=1 EventType=APPCRASH EventTime=129550934860175076 ReportType=2 Consent=1 ReportIdentifier=ca44f819-add6-11e0-ae29-d4856458dd04 IntegratorReportIdentifier=ca44f818-add6-11e0-ae29-d4856458dd04 WOW64=1 Response.type=4 Sig[0].Name=Application Name Sig[0].Value=CcmExec.exe Sig[1].Name=Application Version Sig[1].Value=4.0.6487.2000 Sig[2].Name=Application Timestamp Sig[2].Value=4ab33e4d Sig[3].Name=Fault Module Name Sig[3].Value=ntdll.dll Sig[4].Name=Fault Module Version Sig[4].Value=6.1.7600.16695 Sig[5].Name=Fault Module Timestamp Sig[5].Value=4cc7ab86 Sig[6].Name=Exception Code Sig[6].Value=c0000005 Sig[7].Name=Exception Offset Sig[7].Value=0009cec4 DynamicSig[1].Name=OS Version DynamicSig[1].Value=6.1.7600.2.0.0.274.10 DynamicSig[2].Name=Locale ID DynamicSig[2].Value=3081 DynamicSig[22].Name=Additional Information 1 DynamicSig[22].Value=a7aa DynamicSig[23].Name=Additional Information 2 DynamicSig[23].Value=a7aa91f17ea749d42a4de3b390fa5b3d DynamicSig[24].Name=Additional Information 3 DynamicSig[24].Value=a7aa DynamicSig[25].Name=Additional Information 4 DynamicSig[25].Value=a7aa91f17ea749d42a4de3b390fa5b3d UI[2]=C:\Windows\SysWOW64\CCM\CcmExec.exe UI[5]=Check online for a solution (recommended) UI[6]=Check for a solution later (recommended) UI[7]=Close UI[8]=CCM Executive stopped working and was closed UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available. UI[10]=&Close LoadedModule[0]=C:\Windows\SysWOW64\CCM\CcmExec.exe LoadedModule[1]=C:\Windows\SysWOW64\ntdll.dll LoadedModule[2]=C:\Windows\syswow64\kernel32.dll LoadedModule[3]=C:\Windows\syswow64\KERNELBASE.dll LoadedModule[4]=C:\Windows\syswow64\ADVAPI32.dll LoadedModule[5]=C:\Windows\syswow64\msvcrt.dll LoadedModule[6]=C:\Windows\SysWOW64\sechost.dll LoadedModule[7]=C:\Windows\syswow64\RPCRT4.dll LoadedModule[8]=C:\Windows\syswow64\SspiCli.dll LoadedModule[9]=C:\Windows\syswow64\CRYPTBASE.dll LoadedModule[10]=C:\Windows\syswow64\USER32.dll LoadedModule[11]=C:\Windows\syswow64\GDI32.dll LoadedModule[12]=C:\Windows\syswow64\LPK.dll LoadedModule[13]=C:\Windows\syswow64\USP10.dll LoadedModule[14]=C:\Windows\system32\msvcp60.dll LoadedModule[15]=C:\Windows\system32\ATL.DLL LoadedModule[16]=C:\Windows\syswow64\ole32.dll LoadedModule[17]=C:\Windows\syswow64\OLEAUT32.dll LoadedModule[18]=C:\Windows\system32\WTSAPI32.dll LoadedModule[19]=C:\Windows\system32\ccmcore.dll LoadedModule[20]=C:\Windows\syswow64\SHLWAPI.dll LoadedModule[21]=C:\Windows\system32\VERSION.dll LoadedModule[22]=C:\Windows\syswow64\PSAPI.DLL LoadedModule[23]=C:\Windows\system32\xprslib.dll LoadedModule[24]=C:\Windows\SysWOW64\CCM\ccmperf.dll LoadedModule[25]=C:\Windows\system32\IPHLPAPI.DLL LoadedModule[26]=C:\Windows\syswow64\NSI.dll LoadedModule[27]=C:\Windows\system32\WINNSI.DLL LoadedModule[28]=C:\Windows\SysWOW64\CCM\CCMGenCert.dll LoadedModule[29]=C:\Windows\syswow64\CRYPT32.dll LoadedModule[30]=C:\Windows\syswow64\MSASN1.dll LoadedModule[31]=C:\Windows\SysWOW64\CCM\smscore.dll LoadedModule[32]=C:\Windows\SysWOW64\CCM\CCMUtilLib.dll LoadedModule[33]=C:\Windows\syswow64\WS2_32.dll LoadedModule[34]=C:\Windows\SysWOW64\CCM\CcmTask.dll LoadedModule[35]=C:\Windows\SysWOW64\CCM\ccmid.DLL LoadedModule[36]=C:\Windows\syswow64\SHELL32.dll LoadedModule[37]=C:\Windows\SysWOW64\CCM\LSUtilities.dll LoadedModule[38]=C:\Windows\system32\NETAPI32.dll LoadedModule[39]=C:\Windows\system32\netutils.dll LoadedModule[40]=C:\Windows\system32\srvcli.dll LoadedModule[41]=C:\Windows\system32\wkscli.dll LoadedModule[42]=C:\Windows\system32\LOGONCLI.DLL LoadedModule[43]=C:\Windows\system32\ACTIVEDS.dll LoadedModule[44]=C:\Windows\system32\adsldpc.dll LoadedModule[45]=C:\Windows\syswow64\WLDAP32.dll LoadedModule[46]=C:\Windows\system32\DNSAPI.dll LoadedModule[47]=C:\Windows\SysWOW64\CCM\FSPUtilLib.dll LoadedModule[48]=C:\Windows\system32\IMM32.DLL LoadedModule[49]=C:\Windows\syswow64\MSCTF.dll LoadedModule[50]=C:\Windows\syswow64\CLBCatQ.DLL LoadedModule[51]=C:\Windows\system32\wbem\wbemprox.dll LoadedModule[52]=C:\Windows\system32\wbemcomn.dll LoadedModule[53]=C:\Windows\system32\CRYPTSP.dll LoadedModule[54]=C:\Windows\system32\rsaenh.dll LoadedModule[55]=C:\Windows\system32\RpcRtRemote.dll LoadedModule[56]=C:\Windows\system32\wbem\wbemsvc.dll LoadedModule[57]=C:\Windows\system32\wbem\fastprox.dll LoadedModule[58]=C:\Windows\system32\NTDSAPI.dll LoadedModule[59]=C:\Windows\system32\msi.dll LoadedModule[60]=C:\Windows\syswow64\WINTRUST.dll LoadedModule[61]=C:\Windows\system32\ncrypt.dll LoadedModule[62]=C:\Windows\system32\bcrypt.dll LoadedModule[63]=C:\Windows\SysWOW64\bcryptprimitives.dll LoadedModule[64]=C:\Windows\system32\USERENV.dll LoadedModule[65]=C:\Windows\system32\profapi.dll LoadedModule[66]=C:\Windows\system32\GPAPI.dll LoadedModule[67]=C:\Windows\system32\cryptnet.dll LoadedModule[68]=C:\Windows\system32\SensApi.dll LoadedModule[69]=C:\Windows\system32\WINHTTP.dll LoadedModule[70]=C:\Windows\system32\webio.dll LoadedModule[71]=C:\Windows\system32\credssp.dll LoadedModule[72]=C:\Windows\system32\mswsock.dll LoadedModule[73]=C:\Windows\System32\wshtcpip.dll LoadedModule[74]=C:\Windows\System32\wship6.dll LoadedModule[75]=C:\Windows\system32\dhcpcsvc6.DLL LoadedModule[76]=C:\Windows\system32\dhcpcsvc.DLL LoadedModule[77]=C:\Windows\syswow64\CFGMGR32.dll LoadedModule[78]=C:\Windows\system32\rasadhlp.dll LoadedModule[79]=C:\Windows\SysWOW64\APPHELP.DLL LoadedModule[80]=C:\Windows\system32\ntmarta.dll LoadedModule[81]=C:\Windows\SysWOW64\CCM\PolicyAgent.dll LoadedModule[82]=C:\Windows\SysWOW64\CCM\SrcUpdateMgr.dll LoadedModule[83]=C:\Windows\SysWOW64\CCM\CcmDTS.dll LoadedModule[84]=C:\Windows\SysWOW64\CCM\CcmCTMNotification.DLL LoadedModule[85]=C:\Windows\SysWOW64\CCM\smssha.dll LoadedModule[86]=C:\Windows\system32\framedyn.dll LoadedModule[87]=C:\Windows\SysWOW64\CCM\UpdatesDeployment.dll LoadedModule[88]=C:\Windows\SysWOW64\CCM\ScanAgent.dll LoadedModule[89]=C:\Windows\SysWOW64\CCM\Sched.dll LoadedModule[90]=C:\Windows\SysWOW64\CCM\rebootcoord.dll LoadedModule[91]=C:\Windows\SysWOW64\CCM\RTConfiguration.dll LoadedModule[92]=C:\Windows\system32\SAMCLI.DLL LoadedModule[93]=C:\Windows\system32\newdev.dll LoadedModule[94]=C:\Windows\system32\UxTheme.dll LoadedModule[95]=C:\Windows\syswow64\SETUPAPI.dll LoadedModule[96]=C:\Windows\syswow64\DEVOBJ.dll LoadedModule[97]=C:\Windows\system32\devrtl.DLL LoadedModule[98]=C:\Windows\SysWOW64\CCM\UpdatesStore.dll LoadedModule[99]=C:\Windows\SysWOW64\CCM\ContentAccess.dll LoadedModule[100]=C:\Windows\SysWOW64\CCM\CPApplet.dll LoadedModule[101]=C:\Windows\SysWOW64\CCM\CcmCTM.dll LoadedModule[102]=C:\Windows\SysWOW64\CCM\LibRDC.dll LoadedModule[103]=C:\Windows\SysWOW64\CCM\execmgr.dll LoadedModule[104]=C:\Windows\SysWOW64\CCM\VAppLaunchMgr.dll LoadedModule[105]=C:\Windows\SysWOW64\CCM\SrvWinMgr.dll LoadedModule[106]=C:\Windows\system32\WINSTA.dll LoadedModule[107]=C:\Windows\SysWOW64\CCM\StatusAgent.dll LoadedModule[108]=C:\Windows\system32\wbem\wmidcprv.dll LoadedModule[109]=C:\Windows\system32\wbem\wmiutils.dll LoadedModule[110]=C:\Windows\system32\wbem\esscli.dll LoadedModule[111]=C:\Windows\SysWOW64\CCM\ccmident.dll LoadedModule[112]=C:\Windows\system32\SAMLIB.dll LoadedModule[113]=C:\Windows\SysWOW64\CCM\StandardEventForwarder.dll LoadedModule[114]=C:\Windows\System32\msxml6.dll LoadedModule[115]=C:\Windows\SysWOW64\CCM\smsclient.dll LoadedModule[116]=C:\Windows\SysWOW64\CCM\StatusAgentProxy.dll LoadedModule[117]=C:\Windows\SysWOW64\CCM\LSInterface.dll LoadedModule[118]=C:\Windows\system32\SXS.DLL LoadedModule[119]=C:\Windows\system32\SECUR32.DLL LoadedModule[120]=C:\Windows\System32\fwpuclnt.dll LoadedModule[121]=C:\Windows\SysWOW64\Kerberos.DLL LoadedModule[122]=C:\Windows\system32\cryptdll.dll LoadedModule[123]=C:\Windows\SysWOW64\CCM\MtrMgr.dll LoadedModule[124]=C:\Windows\system32\MPR.dll LoadedModule[125]=C:\Windows\SysWOW64\CCM\Prep.dll LoadedModule[126]=C:\Windows\SysWOW64\CCM\WUAHandler.dll LoadedModule[127]=C:\Windows\SysWOW64\CCM\UpdatesHandler.dll LoadedModule[128]=C:\Windows\SysWOW64\CCM\pdpagent.dll LoadedModule[129]=C:\Windows\SysWOW64\CCM\PolicyAgentEndpoint.dll LoadedModule[130]=C:\Windows\SysWOW64\CCM\SdmAgent.dll LoadedModule[131]=C:\Windows\SysWOW64\CCM\CIAgent.dll LoadedModule[132]=C:\Windows\SysWOW64\CCM\ccm_caltrack.dll LoadedModule[133]=C:\Windows\SysWOW64\CCM\dcmagent.dll LoadedModule[134]=C:\Windows\SysWOW64\CCM\PwrAgentEndpoint.dll LoadedModule[135]=C:\Windows\system32\POWRPROF.dll LoadedModule[136]=C:\Windows\SysWOW64\CCM\PwrEventTask.dll LoadedModule[137]=C:\Windows\SysWOW64\CCM\InvEndPoint.dll LoadedModule[138]=C:\Windows\SysWOW64\CCM\InvDataStore.dll LoadedModule[139]=C:\Windows\SysWOW64\CCM\StateMessage.dll LoadedModule[140]=C:\Windows\SysWOW64\CCM\InvFileSystemCollectionTask.dll LoadedModule[141]=C:\Windows\SysWOW64\CCM\InvFileSystemQueryTask.dll LoadedModule[142]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\COMCTL32.DLL LoadedModule[143]=C:\Windows\SysWOW64\CCM\CCMAuthMessageHook.dll LoadedModule[144]=C:\Windows\SysWOW64\CCM\CcmProxy.dll LoadedModule[145]=C:\Windows\SysWOW64\CCM\ccmhttp.dll FriendlyEventName=Stopped working ConsentKey=APPCRASH AppName=CCM Executive AppPath=C:\Windows\SysWOW64\CCM\CcmExec.exe

So its something which SCCM does once an hour which is crashing. Just have look at the ConfigMgr logfiles to see what's going on at the point of time.Torsten Meringer | http://www.mssccmfaq.de