Conhost.exe, CSRSS and Session 0

Under Windows 2008 and Windows 7 a new process has appeared in task manager which did not exist before. This process is the Console Windows Host, %SystemRoot%\system32\conhost.exe.

The aim of this new process is to separate end user activity from system activity and limit exposure of the highly privileged CSRSS.EXE process. It is, to make it short, a brand new Microsoft security feature which you can definitively trust.

VMware guests and ISCSI/SAN storage

Last week I have had a problem with my Windows Server VMs residing on an iSCSI storage. Error eventid 11 (The driver detected a controller error on \Device\Harddisk0.) and eventid 15 (The device, \Device\Scsi\symmpi1, is not ready for access yet.) where recorded by some of my VMWARE virtual machines running Windows.

Event Type: Error
Event Source: Disk
Event Category: None
Event ID: 11
User: N/A
Description:
The driver detected a controller error on \Device\Harddisk1.

Event Type: Error
Event Source: symmpi
Event Category: None
Event ID: 15
User: N/A
Description:
The device, \Device\Scsi\symmpi1, is not ready for access yet.

Furthermore, in our case I detected the following error on the ESX logs:

SharePoint Gatherer Event ID 2442 and 2444

I have these days a problem with my SharePoint. To be specific, the search module is no more indexing documents that are added to the WSS 3.0 document libraries. To make myself clear, the serach module ("C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\mssearch.exe" ) is properly working but recently added docs are not being returned.

I have had a look to the Event Viewer on the Sharepoint server and, filtering for source Windows SharePoint Services 3 Search and Category Gatherer, I’ve found that I have two kind of events: