Antivirus and Intermittent issues viewing documents with Office Web Apps 2013


Scenario

We have seen a number of support incidents with intermittent errors when viewing Office documents using Office Web Apps 2013.  All Office file types are affected, most often PowerPoint and Word.  Often, the same document will display at one time, then throw an error at another.  The errors seen by users are varied and are frankly too generic to bother with a comprehensive list.  Instead, let’s jump into the cause and current resolution.

If you turn up logging to Verbose using the -LogVerbosity “Verbose” parameter in Powershell, you will see in Office Web Apps server ULS logs reference to “ConversionError” and/or “Conversion failed”.


Cause

Antivirus (AV) network monitoring processes that monitor the *\Program Files\Microsoft Office Web Apps\” folder and all executables (.exe) in each subfolder can potentially interfere with the file conversion functionality.  To display documents, each document is “converted” into image files that are cached on the Office Web Apps servers.  The process responsible for this conversion is called AppServerHost.exe.  Numerous instances of this subprocess are opened and closed by Office Web Apps repeatedly, and AV monitoring software can detect this activity as a threat or otherwise cause these processes to terminate unexpectedly.  This in turn leads to a corrupted cached file and the error condition results.

Resolution

While attempts to manually/programmatically clear the Office Web Apps cache have had limited success, so far the AV programs that cause this behavior must be reconfigured to allow Office Web Apps to freely create and sustain its AppServerHost.exe processes (and all relating subprocesses).  Here are some configuration guidelines:

  1. Exclude any monitoring within the following directories.
    1. C:\Program Files\Microsoft Office Web Apps\
    2. C:\ProgramData\Microsoft\OfficeWebApps\Working\d
    3. C:\ProgramData\Microsoft\OfficeWebApps\Working\waccache
    4. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
  2. Exclude monitoring or lower the “risk level” for the AppServerHost.exe process and the “wacsm” Windows service.
  3. If the previous two guidelines don’t help, please contact your Antivirus software support for further assistance.

Below is a basic list of the Office Web App Server 2013 processes that you should be excluding. This is a basic list only, you may have other processes depending on what is installed.

AgentManagerWatchdog.exe
AppServerHost.exe
broadcastwatchdog_app.exe
broadcastwatchdog_wfe.exe
DiskCacheWatchdog.exe
EditAppServerHost.exe
EditAppServerHostSlim.exe
excelcnv.exe
FarmStateManagerWatchdog.exe
FarmStateReplicator.exe
HostingServiceWatchdog.exe
ImagingService.exe
ImagingWatchdog.exe
MetricsProvider.exe
Microsoft.Office.Excel.Server.EcsWatchdog.exe
Microsoft.Office.Excel.Server.WfeWatchdog.exe
Microsoft.Office.Web.AgentManager.exe
Microsoft.Office.Web.WebOneNoteWatchdog.exe
OneNoteMerge.exe
ppteditingbackendwatchdog.exe
pptviewerbackendwatchdog.exe
pptviewerfrontendwatchdog.exe
ProofingWatchdog.exe
SandboxHost.exe
SpellingWcfProvider.exe
ULSControllerService.exe

w3wp.exe
WordViewerAppManagerWatchdog.exe
WordViewerWfeWatchdog.exe

**UPDATED Sep 27th 2016**

Comments (0)

Skip to main content