Agrypnia

So version 1.1 of MS Debug Diagnostics is currently the latest version of the debugger, however on Win 2008 x64 the only thing you can do with it directly is use the Analysis portion. It will not allow you to create dumps, so we will have to create one manually.

To capture a dump of an Application Pool we need to use adplus which is part of the debugging tools.  Adplus can be targeted at either a process name (w3wp.exe) or a PID.

To determine which PID belongs to our application pool we can use the native IIS tools:

H:\>%windir%\system32\inetsrv\appcmd list wp
WP "4072" (applicationPool:RDWebAccess)

Then we can target that PID with adplus like this:

adplus –quiet –crash –p 4072 –o PATH_TO_DUMPFILE