Low tech answer:
+ Use the task manager to determine the loaded workflow.
+ Use c: \ windows \ system32 \ issapp.vbs to identify the application pool name of the loaded process (alternatively, DebugDiag makes the same easier if you are familiar with this tool. There is a column header for the application pool name on the Process tab).
+ Create new application pools and share your applications between them until you can isolate the application, causing a problem in the application pool.
More technical answer:
+ Use the task manager to determine the loaded workflow. Grab the dump this workflow using DebugDiag or ADPlus -hang -p (part of the Debugging Tools for Windows, both free downloads from Microsoft)
+ DebugDiag can pre-analyze the freezing dump for you, and can just give you all the hints you need. Which is a mid-tech solution that often works. You will want to look at and right-click the abusive process. Select "Full user mode" Dump "or something like that. The created dump file in c: \ Program Files \ DebugDiag \ Logs \ Misc * .dmp and double-click it to see before analysis.
+ If DebugDiag does not give you enough hints, then WinDBG can tell you exactly what you need to know, although it is a secret and complex tool, even starting out is a much smaller wizard. (This is also a lot of fun. I highly recommend it if you are an administrator and have often asked such questions.)
source share