WAS service unable to start with the error 'the data is invalid'

We had an issue where WAS service was unable to start with  error data is invalid

We checked the procmon and we could see that Service is trying to read the apphost.config file and nothing happens after that

4:45:05.6132558 PM  svchost.exe      31736  41848  QueryAttributeInformationVolume            C:\Windows\System32\inetsrv\config\applicationHost.config          SUCCESS            FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00600, MaximumComponentNameLength: 255, FileSystemName: NTFS     NT AUTHORITY\SYSTEM         0

4:45:05.6133179 PM  svchost.exe      31736  41848  QueryRemoteProtocolInformation            C:\Windows\System32\inetsrv\config\applicationHost.config          INVALID PARAMETER             NT AUTHORITY\SYSTEM  0

4:45:05.6133488 PM  svchost.exe      31736  41848  QuerySecurityFile            C:\Windows\System32\inetsrv\config\applicationHost.config          SUCCESS          Information: Attribute          NT AUTHORITY\SYSTEM         0

4:45:05.6135904 PM  svchost.exe      31736  41848  ReadFile            C:\Windows\System32\inetsrv\config\applicationHost.config          SUCCESS          Offset: 0, Length: 131,072, Priority: Normal       NT AUTHORITY\SYSTEM         0

4:45:05.6137492 PM  svchost.exe      31736  41848  ReadFile            C:\Windows\System32\inetsrv\config\applicationHost.config          SUCCESS          Offset: 131,072, Length: 95,532            NT AUTHORITY\SYSTEM         0

4:45:05.6140994 PM  svchost.exe      31736  41848  CloseFile            C:\Windows\System32\inetsrv\config\applicationHost.config          SUCCESS                      NT AUTHORITY\SYSTEM  0

We checked the apphost.config file and understood that we had a null parameter getting added which corrupts the apphost.config file… removing that lines resolved the issue .

C:\WINDOWS\system32>net start WAS

The Windows Process Activation Service service is starting.

The Windows Process Activation Service service could not be started.

 A system error has occurred.

 System error 13 has occurred.

 The data is invalid.

Removing the last line “null” from the same apphost.config I was able to start the WAS service

C:\WINDOWS\system32>net start WAS

The Windows Process Activation Service service is starting.

The Windows Process Activation Service service was started successfully.

so someone/some process is corrupting the apphost by passing null parameter

 possible causes which I can think of:

• if apphost is on shared config or network share there can be disk corruption leading to this kind of issue
• i have also seen some scenarios like this when the disk gets corrupted, memory level corruptions etc can lead to config file corruption
• some scanning software /AV scanning the config folder corrupts it

in order to find the actual case ,

• we need procmon with filter set to apphost.config path to see who is touching those files
• and file level auditing for config folder
• ensure AV is not scanning IIS files/config files