So, recently over the past two weeks our servers and hosts WinRM service keeps crashing. The temporary fix we have right now, is once it crashes it we just remote in and start the service again which seems to work for about 2-3 days. However on ~20 servers
this is at least a server a day.
Event Log:
Faulting application name: svchost.exe_WinRM, version: 6.3.9600.17415, time stamp: 0x54504177
Faulting module name: KERNELBASE.dll, version: 6.3.9600.18666, time stamp: 0x58f33794
Exception code: 0xc0000002
Fault offset: 0x00000000000095fc
Faulting process id: 0x43c
Faulting application start time: 0x01d3387565efdfe9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 4045e04e-a522-11e7-8109-90e2ba195d1d
Faulting package full name:
Faulting package-relative application ID:
Having noticed that I was able to fix it just with a basic service restart, I assumed that maybe by increasing the auto restart delay it would fix it. However this did not work.
Note:
- This issue has happened on Windows Server 2016 and Windows Server 2012 R2.
- There is no noticeable pattern to these crashes.
- We do you use remote powershell very often for a few of our PRTG sensors.