> Source: [sk182792](https://support.checkpoint.com/results/sk/sk182792)

# sk182792 - Identity Collector process unexpectedly terminates on Windows server

| Property | Value |
|----------|-------|
| Solution ID | sk182792 |
| Date Created | 2024-11-12 |
| Last Modified | 2026-05-26 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * `cpidc.exe` unexpectedly restarted with the following similar Application error

  Application Event Log (`eventvwr.msc` \> **Windows Logs** \> **Application**):
  > `Faulting application name: cpidc.exe, version: 81.69.0.0, time stamp: 0x67010a72
  > Faulting module name: KERNELBASE.dll, version: 0.0.0.0, time stamp: 0x4460fbf4
  > Exception code: 0xe06d7362
  > Fault offset: 0x001392e2
  > Faulting process id: 0xf14
  > Faulting application start time: 0x01db1f0f371c5c03
  > Faulting application path: C:\Program Files (x86)\CheckPoint\Identity Collector\cpidc.exe
  > Faulting module path: C:\Windows\System32\KERNELBASE.dll
  > Report Id: aa54bcf7-d05f-4beb-a804-2cd24e8cf595
  > `
* The `ia_IDC.log` collected as per [sk123261](https://support.checkpoint.com/results/sk/sk123261) contains the following similar exception logs:

  Collected from the *Identity Collector logs* at: `C:\ProgramData\CheckPoint\Identity Collector\Logs\ia_IDC.log`
  . Example log entries: `
  > [ExceptionTranslator (NAC::IS::TD::Events)] UTILS::ExceptionTranslator::~ExceptionTranslator: Exception Translator removed
  > [Thread (NAC::IS::TD::Surprise)] UTILS::Thread::threadProc: Thread 8972 - DC 10.110.15.98 @ 1728884792, finished with exception SEH Exception ACCESS_VIOLATION (0xc0000005) at address 0x010dae45. ; catch exceptions? 0
  > [Thread (NAC::IS::TD::Surprise)] UTILS::Thread::threadProc: catch exceptions set to false; throwing exception
  > `
* `WinDbg` opens the `ia_IDC.dmp` file collected as per [sk123261](https://support.checkpoint.com/results/sk/sk123261).
  The `.dmp` file can be located in the same folder as the logs: 
  `C:\ProgramData\CheckPoint\Identity Collector\Logs\ia_IDC.dmp`.
  When analyzed using *WinDbg* (per instructions in [sk123261](https://supportcenter.checkpoint.com)), running the `kv` command may yield output similar to the following:

  > `
  > 0:018> kv
  > # ChildEBP RetAddr Args to Child
  > 00 038fc354 749676ed e06d7363 00000001 00000003 KERNELBASE!RaiseException+0x62 (FPO: [4,22,0])
  > 01 038fc38c 01106534 038ff49c 014c7e68 74942e27 msvcr100!_CxxThrowException+0x48 (FPO: [Non-Fpo])
  > WARNING: Stack unwind information not available. Following frames may be wrong.
  > 02 038ffce0 74950fac 0b20bb7c f549fe90 74951073 cpidc+0x1d6534
  > 03 038ffd18 749510b1 74951073 038ffd34 761467f9 msvcr100!_endthreadex+0x3f (FPO: [Non-Fpo])
  > 04 038ffd24 761467f9 0b22fe30 761467e0 038ffd8c msvcr100!_endthreadex+0xce (FPO: [Non-Fpo])
  > 05 038ffd34 7712800d 0b22fe30 f68ebae5 00000000 kernel32!BaseThreadInitThunk+0x19 (FPO: [Non-Fpo])
  > 06 038ffd8c 77127fdb ffffffff 771574eb 00000000 ntdll!__RtlUserThreadStart+0x2b (FPO: [Non-Fpo])
  > 07 038ffd9c 00000000 74951073 0b22fe30 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
  > `

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content