HOWTO: Diagnose and Fix Common ISAPI Filter Installation Failures

How many of you are familiar with the following scenario of ISAPI Filters on IIS:

  1. You have just obtained an ISAPI Filter DLL (either you compiled/linked it from source, or the binary was given or purchased)
  2. You figured out whether to configure the DLL as a global or site ISAPI Filter
  3. You restarted IIS to load the global ISAPI Filter (site ISAPI Filter load on-demand on first request for IIS6, immediately on prior IIS versions)

And… the filter does not appear to be loaded nor working. Now:

  1. On IIS6, failure to load/run any configured ISAPI Filter results in failing to start the website, which means that you will see “503 Service Unavailable” for the request
  2. On prior IIS versions, failure to load/run any configured ISAPI Filters are simply ignored by IIS, so it just looks like the filter is not working/running on the request

When you see the above situation when you are trying to install an ISAPI Filter, the best way to troubleshoot is to look in the Windows Event Log for error event entries from either W3SVC or W3SVC-WP regarding a failure to load the HTTP Filter DLL. The “data” of the error is the most important piece of information used to diagnose the failure to load/run an ISAPI Filter.

Here are some of the common error codes and resolutions (one big caveat mentioned at the end…):

Data: 02 00 00 00

Win32 error 2 – NET HELPMSG 2 returns “The system cannot find the file specified.”

  • IIS was configured to load an ISAPI Filter, either per-website or globally across all websites, and the ISAPI Filter specified an ISAPI Filter DLL that does not exist.

    Prior to IIS6, this sort of configuration slipped by silently because IIS would ignore and not load the configured ISAPI Filter. However, IIS6 treats this sort of invalid configuration as fatal to the operation of the website or web server and will fail loading because of it (leading to a 503 Service Unavailable error)

    The right way to fix this issue is to determine if the ISAPI Filter is necessary for the operation of your web server. If it is not, then remove the ISAPI Filter; if it is necessary, then locate the correct ISAPI Filter DLL file and correct the configuration.

Data: 05 00 00 00

Win32 error 5 – NET HELPMSG 5 returns “Access is denied.”

  • Since IIS uses the process identity to load and run an ISAPI Filter, it means that the process identity failed to have ACL to load the ISAPI Filter DLL. For IIS6 in worker process isolation mode, the process identity is configurable and is at least a member of the IIS_WPG group, while for IIS6 in IIS5 Compatibility Mode and prior IIS versions, the process identity is Local System. So, check for either deny or lack of allow ACLs for the process identity identity on the named ISAPI Filter DLL.
  • The ISAPI Filter DLL returned FALSE from GetFilterVersion() and GetLastError() returns ERROR_ACCESS_DENIED. The reason is completely arbitrary and depends on the ISAPI Filter implementation itself. For example, the ISAPI Filter may have tried to read/write a Registry key or file as the process identity, but unlike prior IIS versions, IIS6 runs as an unprivileged account by default that may fail to read/write with ERROR_ACCESS_DENIED, so the filter errors out by returning FALSE and leaving ERROR_ACCESS_DENIED as GetLastError().

Data: 7E 00 00 00

Win32 error 126 – NET HELPMSG 126 returns “The specified module could not be found.”

  • The ISAPI Filter DLL is linked against some resource(s) that are not on the web server.

    One common reason for missing link dependencies is when your DLL is compiled as DEBUG and you do not have the DEBUG CRT/ATL/MFC DLLs on the web server. The DEBUG CRT/ATL/MFC DLLs are installed by Visual Studio, so your filter DLL may magically work on your dev machine but mysteriously “fail” on the production web server.

    Another common reason is when your DLL is linked against a newer version of CRT/ATL/MFC DLLs that are not present on the target OS. For example, DLLs compiled by Visual Studio .NET and later use CRT/ATL/MFC DLLs that are newer than available on the latest current version of Windows, Windows Server 2003. So, the DLL will magically work on your dev machine but mysterious “fail” on the production server.

    The easiest way to diagnose this issue is to use DEPENDS.EXE from the Windows Platform SDK (or from VS.Net) on the problematic DLL on the OS and see which dependency DLLs show up as red. Then, make sure those DLL dependencies are satisfied on the target OS (DEPENDS.EXE will report all dependency DLLs as green).

Data: 7F 00 00 00

Win32 error 127 – NET HELPMSG 127 returns “The specified procedure could not be found.”

  • In order to load a DLL as an ISAPI Filter DLL, IIS expects certain method signatures to be exported from the DLL. You must export at least GetFilterVersion and HttpFilterProc (TerminateFilter is optional). Using MS LINK.EXE, you do this by specifying a .DEF file with the /DEF switch using the following content as the .DEF file.
    LIBRARY MyFilterName

  • If your ISAPI DLL uses an API call that is not actually present on the target OS, you can get this error. This is particularly insidious because you are able to compile/link the DLL successfully, yet the DLL fails to load on an OS which does not implement the API call you linked against.

    For example, suppose your ISAPI uses the RegGetValue() API call introduced in Windows Server SP1 (all platforms) and XP Pro x64. You download and use the latest Microsoft Platform SDK, which contains the advapi32.lib and include files for you to link and use RegGetValue(). Now, you try to run this ISAPI DLL on XP Pro 32bit, which has an older version of advapi32.dll that as documented, does not support RegGetValue(). The end result is error 127 since your ISAPI DLL will be looking for advapi32.dll to provide the RegGetValue() that it needs… which does not exist on XP Pro 32bit.

    The only way to resolve this is to use an API call that actually exists on the target OS. This is one reason why just because a piece of code compiles does NOT mean it actually works… 😉

Data: Arbitrary Value

While using the data value to diagnose ISAPI Filter install failures usually works, there is one big caveat you need to know. The ISAPI Filter DLL itself can trigger the exact same event log entry with ANY data value, even for reasons unrelated to what I mention above.

  • IIS loads and initializes an ISAPI Filter by first calling LoadLibrary() on the configured filter DLL image file path, then verifying that at least GetFilterVersion() and HttpFilterProc() entrypoints exists, and finally invoking the GetFilterVersion() entrypoint. If this entry point returns FALSE, IIS will log the same “HTTP Filter failed to load” event log entry with WHATEVER value GetLastError() returns.

    In other words, an ISAPI Filter can generate that event if it succeeded or failed for arbitrary reason – as long as the filter returns FALSE, the last set error gets reported.


Comments (73)

  1. David Wang says:

    HOWTO: ISAPI Filter which sets Cache-Control based on Content-Type

  2. David Wang says:

    HOWTO: ISAPI Filter which sets Cache-Control based on Content-Type

  3. says:

    i am getting the following error in the event me to solve it.

    source :W3SVC-WP

    event ID: 2268

    The HTTP Filter DLL C:WINNTsystem32dmnetembed.dll failed to load. The data is the error.

    Could not load all ISAPI filters for site/service. Therefore startup aborted.


  4. David.Wang says:

    Please read the third paragraph of this blog entry and provide the necessary information to troubleshoot. Quote: "When you see the above situation when you are trying to install an ISAPI Filter, the best way to troubleshoot is to look in the Windows Event Log for error event entries from either W3SVC or W3SVC-WP regarding a failure to load the HTTP Filter DLL. The "data" of the error is the most important piece of information used to diagnose the failure to load/run an ISAPI Filter." You did not provide the "data" of the error, so no one can guide you to solve it. //David

  5. jonathan says:

    Went from deep joy at finding this post to further confusion…

    I’m in a classic "works in test, fails in production" situation.

    data is: 7e 00 00 00

    Downloaded Depends.exe and ran on my ISAPI .dll (in production) and all dependencies show fine as far as I can see.

    The test system is Windows 2003 Server (was sp1, but downgraded it when I realized production didn’t have it). Production seems to be a WINNT system that was upgraded to 2003 server (it has a c:winnt directory that doesn’t exist on the test box).

    Any other thoughts on things to check here? Is it possible that this is a runtime dependency (which depends.exe can’t check on a .dll it seems?)

    Any help would be greatly appreciated.

  6. David.Wang says:

    Correct, DEPENDS.EXE is not going to be able to verify if your code makes any LoadLibrary() calls at runtime and whether they would succeed. You will have to do the code review yourself to figure that out.

    If DEPENDS says the static linkages are good, and code review shows that dynamic linkages are good, then I cannot think of any more typical reasons. I am going to start with some more random possibilities

    1. Are you sure that the failure actually comes from IIS trying to load your ISAPI Filter DLL and not anything else. Could that server have ANOTHER misconfigured/malformed filter from the upgrade that is failing (in other words, run DEPENDS on the actual module IIS reports to be failing to load with error 0x7E in the event log).

    2. The event log entry is not unique – any ISAPI Filter can return FALSE in GetFilterVersion(), and the value returned by GetLastError() is what IIS reports as data for that event log entry.

    So, it is possible for your filter to fail for arbitrary reason, return FALSE for GetFilterVersion(), and have random error code be logged. You will need to code-review to figure this out.

    It looks like you need to do some more source code review on your ISAPI Filter to resolve this issue.


  7. jonathan says:

    It seems fairly certain that it’s the ISAPI filter that’s giving the problem. The server box was upgraded ages ago, and the webservers there were running fine until I came along.

    errors in Event Log:

    The HTTP filter DLL e:iisldapauthldap2.dll failed to load. The data is the error.

    Could not load all ISAPI filters for site/service. Therefore startup aborted.

    Remove the filter and everyting works fine. Add it and nothing starts.

    No dynamically loaded modules in the code that I can see, though my c skills are on the rusty side (and my Windows skills were never present enough that they could become rusted).

    Is there some way I can get a good trace of the loading of this .dll so I can see better where it’s failing?

  8. David.Wang says:

    If you are sure the error is not coming from the ISAPI Filter code itself (i.e. either failing to dynamically load another module or return FALSE from GetFilterVersion() ), then you want to look up MSDN documentation for LoadLibraryEx ( ) for assistance on how to troubleshoot DLL load failures. The problem seems really far away from IIS/ISAPI at this point. //David

  9. jonathan says:

    got this resolved. turns out it was an SP1 issue after all.

    rebuilt test without SP1 and the same issue we were seeing in production started showing (we had previously just removed SP1 from test, which apparently doesn’t really remove everything (filter still worked with SP1 removed)).

  10. David.Wang says:

    I am glad that you got the issue resolved.

    If you do not mind me asking – what was the dependency that was causing your problems?

    However, to be clear, this does not sound like an SP1 issue to me. Hear me out…

    When a filter fails to load due to dependency failure, it is usually the fault of the filter author for requiring a dependency that the filter user did not fulfill. An SP cannot be the issue.

    I can think of plenty of cases where user error can cause this situation, and only one situation where it is an SP1 issue — if the uninstall failed to copy back the original file the SP overwrote. That is very improbable.

    For example, here is one possible explanation for your situation.

    Suppose your filter had a dependency on MSXML4.DLL which is not part of WS03RTM but is (hypothetically) included in WS03SP1.

    – When you first built the test machine with WS03RTM you had to install MSXML4 Redist to get your filter to work.

    – Then, when you applied WS03SP1 to the test machine things continue to work.

    – You forget about this dependency when building the production machine and it fails to load the Filter because MSXML4 is not on WS03RTM

    – You go back to the test machine and uninstall WS03SP1. The Filter still works because the MSXML4 Redist is there. So you think that SP1 uninstall apparently does not remove everything

    Note: SP1 uninstall is NOT going to remove MSXML4 to get back to WS03RTM state because it was ALREADY installed on the system. The only issue I see in this scenario is user error. 🙂


  11. jonathan says:

    hey David – much thanks for your input on this,

    Ok… I should clarify that I’m still not certain what the problem is – I’m just assuming it’s an SP1 issue due to events…

    The long version of this saga:

    The filter itself was compiled by myself under Windows XP… it’s a modified version of some C code I found online.

    A test Windows 2003 box was built by one of the Windows admins here. This was supposed to be a box that was configured exactly like our production box where this filter was to be applied. The production box in this case has been running for ages.

    I installed JRE, Sun’s Directory Server Resource Kit, and my filter on the test box. Everything works fine… Exactly like it did on my desktop here (Windows XP).

    Tried to move this to the production box (installed exactly the same stuff) and the filter wouldn’t load. I discovered that the production box wasn’t running SP1 and the test box I was given was. I removed SP1 from test, but my filter still worked.

    Found this website and used depends.exe to verify that all dependencies were satisfied in production – they were.

    Had the test box rebuilt from scratch without SP1. Now my install process (install JRE, install Sun’s DSRK, install filter) results in an unloadable filter… my assumption – something installed with SP1 (but not uninstalled when SP1 was) is causing troubles.

    I would gladly try something that would let me nail down the exact problem more precisely, but my Windows-fu is lacking here (I’m normally a UNIX guy).

  12. David Wang says:

    Ok, I’m just now getting caught up in a lot of things. Most of the past 7 days has been spent on IIS7-related tasks.

    Reading IIS source code in this area shows that there are only two ways for you to get the event log error with data 7E

    1. GetFilterVersion() of authldap2.dll returned FALSE and GetLastError() returned 126.

    2. LoadLibrary() of authldap2.dll failed and GetLastError() returned 126.

    If you are certain that the source code of the filter does not return FALSE from GetFilterVersion() with GetLastError() of 126, then we have to look at the binary itself and how it was made.

    You said that you found some source code and compiled it yourself – what exact headers/lib files did you compile/link against and what versions are they? Maybe your code is pulling in some newer LIB file somewhere that only match against XPSP2/WS03SP1 and not older OS.

    I wonder if the reason it worked on your test box with SP1 removed was because your ISAPI Filter was loaded and hence prevented unrolling of the dependent SP1 version of the DLL.

    Otherwise… I am a bit out of ideas. I just do not consider this as an "SP1 issue" because applications are supposed to handle their own dependencies.


  13. Gabe Brown says:

    You can find out the return code from any ISAPI extension by calling it in your browser explicitly and then look in the webservers logs. Here is an example logline

    2005-08-23 18:41:01 W3SVC1 GET /myVirtFolder/myISAPIExt.dll – 80 – Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322) 404 0 2

    The last two numbers 0 and 2 represent sc-substatus and sc-win32-status respectivly. The logs are usually located in: D:WINDOWSsystem32LogFilesW3SVC1

  14. David Wang says:

    Absolutely. The IIS log file for a website is generally your friend when troubleshooting IIS, especially runtime errors during request processing.

    In this case, we are talking about ISAPI Filters and specifically install/load time failures, and the event log entry is the only mechanism to troubleshoot.

    Basically, no one has made a request to IIS, so errors have no place to go but in the event log.

    On the other hand, ISAPI Extensions can only be triggered by a request, thus its errors can be found in the IIS log file for the website.


  15. lee says:

    i am recieving the same error. Except i have done everyting possible to remove all references, and yet i still get the following error

    The HTTP Filter DLL C:PHPphp.exe failed to load. The data is the error.

    0000: 7e 00 00 00 ~…

    i have tried everything i can think of to remove all references to php.

    If i can get the site back to apoint where it at least starts, then i can begin to fix the php problem, but as of now, i cant seem to find all the references.

    How do i go about this?

    Oddly enough, this entire problem started after an update. I then made it worse by tryingto unintall/reinstall php.

    thanks in addvance



  16. David Wang says:

    lee – this error happened because you have misconfigured PHP.EXE as an ISAPI Filter. Since PHP.EXE is a CGI Executable that should be configured as an Application Mapping and NOT an ISAPI Filter, it does not export the necessary function exports that IIS expects of an ISAPI Filter.

    This is not a problem with any Microsoft update – human editing of IIS configuration caused this.

    The right thing for you to do is remove PHP.EXE from being configured as an ISAPI Filter.

    See for help on correctly setting up PHP on IIS.


  17. Very good explanations, hanks for the help! The depends.exe tool worked beautifully.

  18. jroy says:

    Is there way to script a check on the success or failure of the Filter, ie a vbscript object that contains the state of loaded DLL’s?  

    One can get the list of filters installed from the metabase, but how would one get the state?  The metabase doesn’t seem to contain that.  

    Doesn’t necessarily validate it but if I look in the UI, the green up arrow tells me enough not to scurry off to the event viewer to see what went wrong.  Some COM object contains that, right?

  19. David.Wang says:

    jroy – Ok, your question motivated to to toss together a little script tool to illustrate how to do what you are asking (check on filter load success/fail)…


  20. jonathan says:

    hi David.  hoping you can help me out again here.

    having problems moving my filter to a different box.  "the data is the error".  Filter won’t load at all.  I have this working on several other boxes, but I can’t see a real difference on this new one.

    data is:  5a 04 00 00

    depends.exe shows msjava.dll is missing, but based on some readings this isn’t a problem (as mshtml.dll handles this now?).  I tried moving msjava.dll from a box that had it into the PATH with no change in error.

    This box is a Windows 2003 Server.  Not sure if this is relevant, but the only other 2003 box this is working on was an upgrade from WinNT.

    any thoughts/insights greatly appreciated.

  21. David.Wang says:

    Jonathan – Error code 0x45A = Win32 Error 1114

    NET HELPMSG 1114 returns:

    A dynamic link library (DLL) initialization routine failed.

    This issue is similar to the one described by this KB:

    Basically, your ISAPI Filter DLL is linked to load in a particular memory address that something else also wants, so these two binaries conflict over it. Whoever loads first wins.

    In KB821157, some DLL is linked to load at one address that .Net Framework also wants, so ASP.Net ISAPI DLL fails to load because it was not first.

    I have also seen variations where an ISAPI Filter compiles with /clr switch to load CLR at load time, but its Base address prevents CLR from loading… so the Filter DLL literally prevents itself from loading since CLR fails to load due to where the ISAPI Filter DLL is based.

    Easiest solution is to change the Base memory address of whichever DLL you can recompile so that it does not conflict. You can also attach a debugger onto the w3wp.exe where the Filter fails to load, and since you know what Base address the Filter wants, use the debugger to see what DLL is loaded at that address at the point of failure.


  22. jonathan says:

    hi David,  thanks for the reply.

    Does your response indicate that my .dll is non-relocatable as currently compiled?  Would recompiling it as a relocatable .dll rectify this situation?

    I’m not a developper, and playing with the debugger so far has caused me to crash quite a few apps on my pc.  Using this route on our production box makes me nervous.

  23. David.Wang says:

    Jonathan – If your issue is what I think it is, then what is going on is that your DLL is choosing to locate itself at a virtual memory address which while in the middle of nowhere, conflicts with .Net Framework’s desires over the same memory address… so .Net Framework fails to load up. If this filter also has dependencies on .Net… then the filter also fails to load up.

    Can you tell me if this Filter DLL uses the .Net Framework in any way, or if .Net Framework is used within the process the filter DLL fails to load?

    This can be fixed by recompiling the DLL to choose some other address as its base address and letting the OS relocate it if in conflict.

    Using the debuggers from Microsoft Debugging Toolkit should be pretty painless to observe- after the filter load fails, run:

       ntsd -p <w3wp’s PID>

    Then on the debugger’s commandline, type:


    And press enter. It should dump out a list of module names and memory addresses. Copy/Paste that into a text editor. Then on the debugger commandline, type:


    And press enter. You should now be detached from the process and can close that ntsd window without crashing anything.


  24. jonathan says:

    I don’t believe I’m using anything from .NET.

    I’m using just standard c stuff:  windows.h, httpfilt.h, stdlib.h, stdio.h.  I’m also using Sun’s LDAP dev kit for C:  ldap.h, ldap_ssl.h, lber.h, ldapauth.h.

    depends.exe lists my isapi filter .dll preferred base address as:  0x61A40000.

    Your debugger directions worked great and I’ve got the following listed in/around the above address after a .dll load failure (excerpt of full output):

    5b640000 5b658000   strmfilt     (deferred)

    5f270000 5f2c9000   hnetcfg      (deferred)

    608f0000 60901000   ADMWPROX     (deferred)

    60ba0000 60bb1000   wamreg       (deferred)

    61200000 61215000   MSDATL3      (deferred)

    62da0000 62da7000   LONSINT      (deferred)

    64700000 6472d000   IISUTIL      (deferred)

    647b0000 647d7000   IisRTL       (deferred)

    67150000 67159000   HTTPAPI      (deferred)

    68000000 6802f000   rsaenh       (deferred)

    I should be able to re-base the .dll if that would help, but I’m not sure how one would go about picking a "better" address than the one I’m currently using.

  25. jonathan says:

    I’ve re-compiled my .dll three times at different preferred base addresses (depends.exe lists 0x6C1C000000, 0x6C3C0000, and 0x6FFC000000) and am still experiencing the same errors.

    Is this a problem with how capable Windows is at relocating .dlls when the .NET framework is in use?

    Based on my readings, Windows should be able to rebase this .dll dynamically when it loads (though at some performance cost).

  26. David.Wang says:

    Jonathan – No, the problem is not with Window’s ability to relocate DLLs nor .NET Framework.

    Please read KB 821157 carefully. The issue mentioned there is NOT with ability to relocate DLLs but rather with basing of DLLs that affect .Net Framework which happen to fail DLL load:

    1. You compile the DLL with /clr for native/managed interop, which hooks .Net Framework initialization when the DLL is loaded

    2. .Net Framework initialization has requirements for available memory block size for GC, caches, etc

    3. The DLL has to be based at some location in memory

    Now, suppose the DLL is based (or rebased) in memory in such a way that prevents .Net Framework from obtaining the size of memory block that it wants. Furthermore, suppose this DLL is the one that triggers .Net Framework to load (it is compiled with /clr). What happens when you try to load the DLL?

    Well, LoadLibrary loads the DLL into memory. Because it is compiled with /clr, this load triggers the .Net Framework to load. But this DLL is based in memory in such a way that prevents .Net Framework from getting the memory block that it wants, so .Net Framework bails on initialization. And since this .Net Framework initialization is triggeredby the DLL with /clr, this failure causes the DLL to fail to load as well. This results in LoadLibrary reporting error 1114.

    In other words, due to how the DLL is based, it literally prevents itself from being loaded. Strange but true.

    Now, the issue that KB 821157 mentions can be hit as soon as you use /clr to compile. Your DLL does not need to be using anything from .Net at all.

    Of course, your issue may have nothing to do with .Net nor DLL rebasing; I am just pointing out one easily plausible way to get to error 1114.

    The next troubleshooting step involves getting the debugger attached onto the process but BEFORE your ISAPI Filter is loaded. Type in:

    sx e ld "filter DLL name" <ENTER>


    And then trigger your ISAPI Filter to load with a request. You will now break into the debugger right on the LoadLibrary call and you can step through things to see what actually causes your DLL to fail to load.


  27. David Wang says:

    I recently sat down and thought a little about the typical user experience when troubleshooting IIS6,…

  28. David.Wang says:

    Hurray! Another blog entry makes it past the 10K page-browsed mark…


  29. jonathan says:


    hey.  congrats.  I have a good idea where a few hundred of those hits came from.

    I’ve managed to get our production system working with an old version of my .dll.  I’m a bit leery of the stability of things as it seemed to remain loaded when I unloaded it, or not load properly occasionally (no "data is the error" on this plugin version though).

    I’ve got another (non production box) headed my way this week, so I hope to be back on the troubleshooting trail again soon.

    I’ve also been able to replicate the 1114 error on my pc (Windows XP).  This is a different rev of IIS, however than I had trouble with in production (no w3wp.exe process).

  30. Max says:

    I would just like to say that your tip to use the DEPENDS.EXE utility was very useful indeed!  It helped me identify a misconfiguration in the server’s PATH variable (of all things).

    Thankyou for the tip.


  31. Mark Mills says:

    Thanks for all the info here.  I’m not looking just to be "fed" (given the answer like youhave nothing else better to do than to) here, but to learn how to troubleshoot my own issues.

    I’ve installed WordPress on IIS.  Now trying to get the PermaLinks set up.  I’m installing an ISAPI filter now.  I’ve followed   to the letter and am getting the error indicating "Data: 05 00 00 00 -Win32 error 5 – NET HELPMSG 5 returns "Access is denied.""

    So according to what I think I’ve learned from your posts is that this is a "Process Identity" and ACL issue? right?

    My question now – is what is the next step I should take? I’m not familiar with dealing with IIS from a programmatic or scripting scenario.  

  32. Mark Mills says:

    Thanks for all the info here.  I’m not looking just to be "fed" (given the answer like youhave nothing else better to do than to) here, but to learn how to troubleshoot my own issues.

    I’ve installed WordPress on IIS.  Now trying to get the PermaLinks set up.  I’m installing an ISAPI filter now.  I’ve followed   to the letter and am getting the error indicating "Data: 05 00 00 00 -Win32 error 5 – NET HELPMSG 5 returns "Access is denied.""

    So according to what I think I’ve learned from your posts is that this is a "Process Identity" and ACL issue? right?

    My question now – is what is the next step I should take? I’m not familiar with dealing with IIS from a programmatic or scripting scenario.

  33. Mark Mills says:

    OK – WordPress ISAPI Filter issue resolved BUT


    As I mentioned the WordPress ISAPI filter creating many Application log errors 2268 and 2214

    So I then after reading and learning a littel from the "David.Wang Blog" (most hazardly and without web security in mind) added the WordPress users "site_name_Anon" and "site_name_Admin" to the IIS_WPG user Group (it is creatd by W2k3 by default) and I also gave the user IIS_WPG "read" and "execute" permissions to the WordPressPlugin.dll file.

    The WordPress ISAPI Filter now works.  What I need to know now is "How big of a security hole did I just make?" and "what do you recommend for appropriate security measures, in place of what I did?" Should I be modifing the members of the IIS_WPG group at all.  Is it safe to add anonymous as well as fully priviledged Admin accounts to this group.  My gut feeling say @#!   No!

    PLease advise,

    Thanks MMills

  34. Einar says:

    You saved my day! "Somebody" had added a DLL in the ISAPI Filter dialog that does not have the required procedures. I got the 7F error and "Service unavailable". IIS did not show the name in the dialog-box, but I found it in the application Event log. The solution was to copy and rename the FpExeDll.dll to replace the bad dll. Then I got rid of the error.

  35. Aaron says:

    I’m getting the 0000: 05 00 00 00 error. I am unsure as to how to fix this problem. Can anyone help?

  36. Dean Pullen says:

    I had the 0000: 05 00 00 00 error too.

    Seems we need to give the .dll security "read" and "execute" permissions for the user IIS_WPG.

    That solved it for me.

  37. mnjrupp says:

    David, thanks for the article. I have searched high and low for this.

    I had an issue with an ATL server deployed on my local machine.

    I compiled under VS2005 professional on 2003 server SP1.

    I was getting an Win32 error 127 in the IIS log file when browsing to the .srf file.

    As you probably know, ATL server under VS2005 creates an ISAPI Extension DLL to go along with the server DLL. For some strange reason Visual Studio 2005 will associate the .dll and .srf  with the

    <myATLserver>.dll instead of the <myATLserverISAPI>.dll when you deploy in VS. MSDN was no help with this. After beating my head against the wall for 2 hrs, I decided to change the mapping in IIS6 manager for both the .srf and .dll files to <myATLserverISAPI>.dll and it worked great!

    I hope I can help someone else who might have this same issue.

  38. Petri Wilhelmsen says:

    Hi, I got one problem when loading an ISAPI filter. The filter runs well on WinXP and Windows Server 2003, SP1 but when I deploy it on my test server( also windows server 2003 SP2 std edition ) it fails with the error message: "Error in code", ID: 2214, and Data: b1 26 00 00

    Win32 Error code is then 14001, and the source is W3SVC-WP.

    Any idea of what this can be, and how I can solve this?


    Petri Wilhelmsen

  39. Eric Conrad says:

    The second point that is mentioned for data 05 doesn’t give a resolution.  It mentions that

    "For example, the ISAPI Filter may have tried to read/write a Registry key or file as the process identity, but unlike prior IIS versions, IIS6 runs as an unprivileged account by default that may fail to read/write with ERROR_ACCESS_DENIED, so the filter errors out by returning FALSE and leaving ERROR_ACCESS_DENIED as GetLastError()."  

    What would be the solution for this?  I am trying to load isapi_redirect.dll as a tomcat 5.5 connector.  I’m going a little nuts as I’ve followed the official docs to a T, and even my support person from the vendor can’t reproduce what I’m seeing.  I’m getting the 05 error, and I’ve verified that IUSR is a member of the IIS_WPG group, and that that group has permissions to the dll file.  But how can I give access to the registry?


    Eric Conrad

  40. Patrick says:

    I am receiving a 0000: 02 00 00 00    Data error when trying to load the websphere 6 iis plugin.  I have checked NTFS security, and everything seems to be set ok.  We currently have 2 webservers, 1 server loads the DLL successfully.  When trying to set up the second webserver we receive the 2214 event id with data error above.


  41. Chip says:

    I am trying to install the asp.dll filter but it will not load. I am getting this in the error log:

    7f 00 00 00.

  42. David.Wang says:

    Chip – asp.dll is not a filter, thus what you see in the event log is exactly correct.

    Do not install asp.dll as an ISAPI Filter because it is not an ISAPI Filter.

    ASP.DLL is configured as an Application Mapping to handle .asp requests, which should be pre-configured by default.


  43. David.Wang says:

    Patrick – Make sure you configured the correct pathname to the  Filter DLL. This is really a support issue for WebSphere, not IIS/Windows configuration issue.


  44. David.Wang says:

    Eric – many things can cause Access Denied. Thus, I can only give possible examples to get you thinking.

    As I mentioned in my blog entry, ISAPI Filter runs as the process identity, which requires membership in the IIS_WPG group.

    IUSR is usually the impersonated Anonymous user account, which is not the process identity and thus not used to execute ISAPI Filter.

    Unless you configured the Application Pool to run as IUSR, you are not investigating the right user identity which is getting access denied.

    Please carefully read this and other blog entries of mine on how IIS executes code for troubleshooting tips.


  45. Rahul says:

    I am receiving a 0000: fc 2a 00 00 Data error when trying to load the websphere 6 iis plugin.  I have checked NTFS security, and everything seems to be set ok.  We currently have 2 webservers, 1 server loads the DLL successfully.  When trying to set up the second webserver we receive the 2268 & 2214 event id with data error above and following 2 messages.

    1 –

    The HTTP Filter DLL D:Program FilesWebSphereAppServerbiniisWASPlugin_http.dll failed to load.  The data is the error.


    Could not load all ISAPI filters for site/service.  Therefore startup aborted.

    Please help.

  46. David.Wang says:

    Rahul – You are seeing the last case I mentioned, arbitrary value.

    It means the error came from the WebSphere ISAPI Filter iisWASPlugin_http.dll itself, which means you have to contact your support personel for that software.

    This seems like WebSphere configuration issue, unrelated to IIS.


  47. Celso Bessa says:

    I also got this 0000: 05 00 00 00 error.

    In my case, i just installed PHP (via installer) and loaded the php5isapi.dll , rebooted the machine and then got this Service Unavailable message.

    Can you, please, tell me what could i do for solve it?

    Best Regards from Brazil.

    Celso Bessa

  48. David.Wang says:

    Celso Bessa – If you used the PHP Installer, you need to obtain community support for PHP – it is supposed to setup everything for you.

    If it is doing this incorrectly, then you need to notify the PHP community and have the community correct it because the problem will likely affect everyone else that uses the installer.


  49. santhosh says:

    Hi All,

    I have found one more scenario where IIS 5.1 raises an

    127 "The specified procedure could not be found."

    error when attempting to start the WWW service on a Windows XP SP2 machine.

    I also have a working instance of IIS with the same configuration.

    I used the depends.exe to analyse the difference between the working and the non working instances.

    The file infocomm.dll should have the version 6.0.2600.2180

    which seems to be the correct file version shared by all files in SP2.

    The service was able to start once i had this version installed.

    Please note: reinstallation of IIS did not solve the problem, which might indicate it justcopies whatever is present in the cab files and these are not from SP2.

    Thanks David  for the tips here which helped me to resolve this.



  50. David.Wang says:

    santhosh – Thanks.

    Actually, Win32 Error 127 is pretty generic and happens whenever one piece of code tries to call a method in another piece of code and it fails to find that method.

    In the context of ISAPI Filters, the usual causes are as I describe above.

    In your specific instance, it was due to mismatched DLL versions, which do not have anything to do with ISAPI Filters. That specific problem happens for a small number of users with certain QFEs installed.


  51. Premkumar Subramanian says:

    We are using IIS6.

    The ISAPI filter has been added to log the original client IP address in the log files. After adding the ISAPI filter, the status of the filter is shown with neither a red arrow nor a green arrow. It is blank even after several page requests. However all the pages were served successfully and we have not faced any issue with the site.

    The surprising part is, the ISAPI filter DOES it’s expected functionality though the status of the filter in the site is blank. The log files do have the expected values.

    No error is logged in the event log (application + system) reg. the failure to load.

    Could you please help me in finding out where it goes wrong?

  52. David.Wang says:

    Premkumar – if the Website which loads the ISAPI Filter is not created with the IIS UI or ADSI CreateWebSite() (i.e. you just CreateNode the entire structurue), then an ACL will be missing on the /Filters node of that website, which will prevent IIS from providing Filter Status (which is just a volatile metabase property) even though the filter is loaded and running.

    This is really a corner case introduced with IIS6 when the worker process ran as unprivileged Network Service — which may not be able to modify all metabase properties. The Filter Status is one of those volatile metabase properties used by the UI to display status, so when Network Service is unable to modify the /Filters node (which is completely reasonable), you end up with the situation where the filter is running fine but no status shows up.


  53. Premkumar Subramanian says:

    Hi David,

                    Thanks for the reply.

                    Yes, the websites were not created using IIS UI. As you mentioned, ACL is missing from the filter node when I look at metabase.xml.

                     If I continue with the filter (though the status shown in UI is blank), Will there be any issues ?

    Thanks & Regards,

    Premkumar Subramanian

  54. David.Wang says:

    Premkumar – if you do not observe any issues, then there is none to worry about.


  55. AM2008 says:


     We want to have two websites running parallely on Windows XP box (this is the webdesigners box)

    both these websites are developed using .net 2.0 one of them runs with a secured protcol (https)

    For this we procured a ISAPI dll from the follwoing link,category,Multisite.aspx

    However i was not able configure it as per the stpes mentioned in the bolg, infact everytime I configure the ISAPI filter ….my locahost also comes up with the .NET error

    Is there a diferrent method to get two websites runnning simultaneously on XP box

    Aplologies if this is not the rigth forum



  56. Marcos says:

    Hello I need some help here,

    Event Type: Error

    Event Source: W3SVC-WP

    Event Category: None

    Event ID: 2268

    Could not load all ISAPI filters for site/service.  Therefore startup aborted.


    0000: af 05 00 00               ¯…    

    What’s this?

  57. David.Wang says:

    Marcos – the blog entry already explains it – the ISAPI Filter returned a custom status code when failing to load.

    The reason completely depends on the ISAPI Filter, so you will have to obtain support for the ISAPI Filter.


  58. Alina says:

    I have not-standard question.  I want to have an object (wrapper around native object) to survive app-pool recycling and to only be reloaded on iisreset. If I implement ISAPI filter/extention (native or managed, doesn’t metter) to load this object, will it live in its own app-pool (app domain) that will not be subject to normal IIS health-check app-pool recycle? In other words where within w3wp.exe process do ISAPI filter loaded? Once we load it in ISAPI, I assume we will be able to marshal by ref the calls into and from w3wp app pool itself (I hope). Any thoughts?



  59. Chris says:

    Wow thank you!  I had 7F 00 00 00 and my isapi worked in 32 bit and not 64 bit.  I missed the /def for the 64 bit compile.  Thanks again for all the help!

  60. Chris C says:

    David, thanks for the great info across your site. I am having an issue loading an ISAPI filter for Tomcat (isapi_redirect-1.2.26.dll).

    I am running IIS 6.0 on Windows 2003. I checked the Windows event viewer, and I am getting a W3SVC-WP error, or 02 00 00 00. The ISAPI filter points to an existing DLL, so it is trying to load the right DLL, it is having some other error.

    I ran Dependency Walker on isapi_redirect-1.2.26.dll and it is showing a failure loading dwmapi.dll. I looked this up online and it is a Windows Vista DLL and should not even be on Windows 2003. I’ve also heard that it is a bug in IE7 since the IEFRAME.DLL looks for dwmapi.dll. Do you know how I can fix this problem? This is a shared development server so I would rather not uninstall IE7 if possible. Is there any other answer? Is dwmapi.dll really necessary to load my Tomcat connectors DLL?


  61. David.Wang says:

    Chris C – the bug is in the Tomcat ISAPI filter. It should not be linked to have dependency on dwmapi.dll, which cannot be fulfilled on Windows Server 2003 without IE7.

    This issue has nothing to do with what you have heard with IE7 and dwmapi.dll — it is the ISAPI Filter’s fault for having extra dependencies…


  62. Paweł says:

    Hi David,

    I’ve got really peculiar problem. I’ve got my own ISAPI Filter which works perfectly installed on two servers (Win 2003 Ent R2), but on other two it does not want to load. What is the most strange it’s that it seems not to load but the page starts and there is no 503. Filter status is not showing any arrow (red or green) after first hit. IIS log shows the request as processed. Event viewer says nothing. Filter’s log file is not created but it’s one of the first tasks in GetFilterVersion. When log file is not created GetFilterVersion should return false.

    So my question is. In what situations IIS does not return 503 when the Filter is not loaded? Any help is welcome even a sentence that it’s written in the documentation. Just to know that it’s something known. Here is the code of GetFilterVersion (I’m very fresh to the VC++ so any constructive criticism of the code is welcome):

    BOOL CASFilter::GetFilterVersion(PHTTP_FILTER_VERSION pVer)


    // Call default implementation for initialization


    // Create buffer for logging


    char szLogFile[ MAX_PATH ];

    // Initialize COM


    // Initialize some locks


    InitializeCriticalSection( &logFileLock );

           // Initialize Configuration

    BOOL ret = ASConfiguration::Initialize();

    if (ret == FALSE)


    return ret;


           //Initialize logger


    CASFilter::bRulesInitialized = FALSE;

    wcstombs(CASFilter::pchLogFileName, ASConfiguration::logFilePath, AS_BUFSIZE);

    CASFilter::logLevel = ASConfiguration::logLevel;


    sprintf( szLogFile, "%s.%d.log", CASFilter::pchLogFileName, GetCurrentProcessId() );

           // Create file here


    if ( hLogFile == INVALID_HANDLE_VALUE )


           return FALSE;


    DWORD writtenBytes;

    ret = WriteFile(hLogFile, logBuffer, (DWORD)strlen(logBuffer), &writtenBytes, NULL);

    if (ret == FALSE)


    return FALSE;


    // Clear the flags set by base class

    pVer->dwFlags &= ~SF_NOTIFY_ORDER_MASK;

    // Set the flags we are interested in


    // Set Priority

    pVer->dwFlags |= SF_NOTIFY_ORDER_LOW;

    _tcscpy(pVer->lpszFilterDesc, "…");

    if (Logger::isInfo) logger.Info(logBuffer, AS_BUFSIZE, "Filter loaded successfully.");

    ret = logger.WriteToFile(hLogFile, logBuffer);

    return ret;


  63. Paweł says:


    For those who have questions to this article. If you don’t find the answer read the blog more. Solution to my problem is on another post. Thanks for the solution:

    <a href=""></a&gt;



  64. Gary S. says:

    Thanks for the great page, which didn’t completely solve my problem but did point me in the right direction.

    When trying to set up isapi_redirector-1.2.27.dll with IIS 6.0, I was getting errors 2268 and 2214 with data 02 00 00 00 (system cannot find file). I thought it meant that IIS could not find the DLL I had specified. The key on this page that helped me is that the error was thrown by the ISAPI filter DLL itself, not by IIS trying to find the DLL.

    The file that was missing was a properties file that isapi_redirector-1.2.27.dll expects. See for full details. That page claims that you can use either the registry or a properties file called in the same directory as the DLL. The registry didn’t work for me, but once I started using a properties file instead of the registry, the redirector started working.

    I hope this will be helpful to someone.

  65. David.Wang says:

    Gary S. – Glad that the blog entry helped resolve your issue. I do not expect a blog entry to resolve all possible issues with ISAPI Filters, but it should point everyone in the right direction and keep digging.

    I would use a tool like Process Monitor (or the older FileMon/RegMon) from to sniff what file and/or registry key that isapi_redirector is querying at start up. Perhaps the Application Pool Identity running the isapi_redirector ISAPI Filter did not have permissions to read that registry key or file system resource. The FileMon/RegMon/ProcMon tool will tell you what happened.


  66. Bruno says:


    I have problem with the code 05 00 00 00 (Could not load all ISAPI filters for site/service.  Therefore startup aborted.) and (The HTTP Filter DLL E:IIS_SitesnameofmysiteBinUrlRewritingIsapiRewrite4.dll failed to load.  The data is the error. )

    The user IIS_WGP not result in success when i give in dll member, i have IIS 6.0 in Windows 2003 Server.

    Please Help Me

  67. ren.forever says:

    I have a website "RootSite" use AppPool#0

    and there are two virtual directories ("vdir1" & "vdir2") in "RootSite"

    vdir1 uses AppPool#1 and vdir2 uses AppPool#2.

    And then when IIRF rewrites requests to vdir1 or vdir2, it shows HTTP403 ERROR

  68. Allen says:

    Excellent site for people like me, i have a problem my production webservice box is dying, i am trying to replace the box and configured webservice their.  I have test program by adding webreference i can send file to this test box, but when i post it give me "500 internal server error".  But i can do the same in production, the production and test box are identical.   I can browse the webservice in the test box but i cannot post.

    Thank in advance..


  69. Kalpesh says:

    I am able to load ISAPI dll file in IIS but getting error 404 file not found error after installing ISAPI in IIS. I am using IIS 5.1

  70. filter failed says:

    The HTTP Filter DLL C:Program FilesWebSphereAppServerbiniisWASPlugin_http.dll failed to load.  The data is the error.


    0000: fc 2a 00 00

  71. Peter B says:

    We have this issue on SharePoint with the error data: 0D 00 00 00.

    Any thoughts?

  72. Rhett G says:

    Gary’s comments on March 4 hit home. The Tomcat page he refers to was the eye opener.