MigratorPro/DirSync/PPS — IIS site returns HTTP 503 Service Unavailable after Application Pool identity password change (4382957)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

MigratorPro/DirSync/PPS — IIS site returns HTTP 503 Service Unavailable after Application Pool identity password change
Description

⚠ Error: HTTP 503 Service Unavailable

After the password of the domain account used as the identity of the Application Pool for the Quest Password Propagation Service (PPS), Directory Sync agent, or MigratorPro web site is changed in Active Directory, the affected IIS site begins returning HTTP 503 Service Unavailable errors. This article documents the symptom, the cause, and the steps to restore service.

Symptoms

–
Browsing to the PPS, Directory Sync, or MigratorPro web site returns HTTP 503 Service Unavailable.

–
The affected Application Pool appears as Stopped in IIS Manager, and attempting to start it manually either fails or causes it to stop again on the next request.

–

The Windows System event log contains Service Control Manager / WAS events indicating the Application Pool was disabled because its identity could not be authenticated:

Event 5057 / 5059Application Pool worker process failed to start.

Event 5021The identity of Application Pool is invalid; the Worker Process will not be able to start.

–
The failure began after a scheduled or unscheduled password change on the domain service account used as the Application Pool identity.
Cause

Root cause

The domain account configured as the identity of the affected Application Pool had its password changed in Active Directory, but the new password was not updated in the Application Pool's identity configuration in IIS. IIS continues to hold the previously configured password for the identity, and when the Worker Process Activation Service (WAS) attempts to start a worker process for the pool, authentication against Active Directory fails.

After a small number of consecutive authentication failures, WAS disables the Application Pool to prevent further lockout of the service account. With the Application Pool stopped, no worker process is available to handle requests, and IIS returns HTTP 503 Service Unavailable to all clients of the site.

Note This is not a defect in PPS, Directory Sync, or MigratorPro — it is an IIS-level authentication failure caused by the mismatch between the password stored in the Application Pool identity configuration and the current password of the service account in Active Directory.
Resolution

Update the Application Pool identity in IIS with the new password for the service account and restart IIS. No reinstallation or reconfiguration of PPS, Directory Sync, or MigratorPro is required.

Steps

1 Open IIS Manager

On the server hosting the affected web site, open IIS Manager (inetmgr).

2 Select Application Pools

In the left pane, select the server node and click Application Pools.

3 Open Advanced Settings

Locate the Application Pool associated with the affected site (for example the pool used by PPS / Directory Sync / MigratorPro), right-click it, and select Advanced Settings…

4 Open the identity editor

Under Process Model, click the Identity row, then click the … button to open the identity editor.

5 Select Custom account

Select Custom account and click Set….

6 Enter the new password

Re-enter the service account in the format DOMAIN\username, then enter and confirm the new password. Click OK to close each dialog.

7 Run iisreset

Open an elevated command prompt and run:
iisreset

8 Confirm the Application Pool started

After IIS restarts, confirm the Application Pool is in the Started state in IIS Manager.

9 Verify the site

Browse to the site and confirm the 503 error is gone and the site loads normally.

Important notes

–
If the Application Pool continues to stop after the password update, confirm that the account has not been locked out in Active Directory as a result of earlier authentication attempts with the stale password, and that the account still has "Log on as a service" and "Log on as a batch job" rights on the local server.

–
If multiple servers host the same role (for example multiple Directory Sync agents or a load-balanced MigratorPro deployment), the Application Pool identity password must be updated on each server.

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

MigratorPro/DirSync/PPS — IIS site returns HTTP 503 Service Unavailable after Application Pool identity password change (4382957)

Title

Description

Cause

Resolution

Leave a Comment