A Windows Server 2019 VM hosts an intranet site in IIS. Several times each day the site freezes for about a minute; during the freeze the OS is still reachable, but users' browsers never finish loading and Task Manager shows w3wp.exe as "Not Responding." Event Viewer logs Application Hang, Event ID 1002, for that process.
You must collect a full user-mode dump the next time the worker process window is unresponsive so developers can inspect the blocked threads. The collection must occur automatically and keep the process running. Which command accomplishes this goal?
Configure a System Diagnostics Data Collector Set in Performance Monitor to sample counters every 15 seconds.
Execute taskkill /F /PID <w3wp PID> and rely on Windows Error Reporting to save a dump.
Schedule Windows Memory Diagnostic (MdSched.exe) to run an extended test at the next reboot.
Run procdump -h -ma w3wp.exe from an elevated command prompt.
ProcDump is designed to monitor a running process and trigger a memory-dump file when certain conditions occur. The -h switch tells ProcDump to write a dump if any window in the target process is hung (does not respond to window messages for at least five seconds), and -ma requests a full dump that includes all user-mode memory-exactly what developers need for a thread and heap analysis. Because ProcDump simply clones the process to create the dump, the IIS worker process continues running, satisfying the requirement to keep the site available.
The other options do not meet the requirements:
Forcibly terminating the process with taskkill /F may generate a WER dump, but it brings down the application pool, violating the "keep the process running" constraint.
Creating a System Diagnostics Data Collector Set in Performance Monitor records performance counters and ETW traces, not a process dump tied to the exact hang condition.
Windows Memory Diagnostic runs at reboot and checks RAM integrity; it does not capture application-specific dump files.
Therefore, running procdump -h -ma w3wp.exe is the correct approach.