Procexp152.sys can't be loaded

[petermorlion]

Describe the bug

I installed RabbitMQ 3.12.10 via the Windows installer and also tried 3.12.9 via Chocolatey. In both cases I see get an error message from Windows when the I enable the management plugin: A driver cannot load on this device. Specifically, the procexp152.sys driver:

I get these popups constantly, one over the other.

I've search the internet and the driver is linked to Process Explorer, which I don't have on my PC. I tried installing the latest version of Process Explorer because the internet tells me the latest version has an updated driver. To no avail.

Reproduction steps

1. Install RabbitMQ on Windows
2. Enable the management plugin

This might be specific to my PC of course. Also, Core Isolation feature in Windows Security is on.

Expected behavior

No popups about risky drivers.

Additional context

No response

[michaelklishin]

@petermorlion procexp152.sys is not something that ship with RabbitMQ or Erlang. In fact, RabbitMQ does not have any Windows-specific or OS-specific code.

[michaelklishin]

A quick search suggests that procexp152.sys is a driver that is installed under C:\Windows\System32\drivers. RabbitMQ Windows installer certainly does not install anything to that location.

Here are just a few threads where all kinds of security tools flag this driver:

• One
• Two
• Three
• Four

There aren't any specific details as to what the vulnerabilities in the driver are but none of the
threads "install RabbitMQ" as one of the steps. It is not something that RabbitMQ installs or uses.

Some users in one of the threads above delete that driver and the issue goes away. What kind of software can be affected by this "solution", I don't know. Please do your own research.

[petermorlion]

As I said "This might be specific to my PC of course" and with respect, I did do research. But I thought to ask here to be sure it wasn't RabbitMQ doing anything specific. Now I know I should dig deeper and elsewhere. Thank you for the clarification.

[sir-wilhelm]

I ran into this after a client server was upgraded from Windows Server 2012 R2 to 2025. This VM was running RabbitMQ 3.11.13 and the same prompt was showing up.

I tracked the problem to handle.exe. We had an old version of handle.exe so RabbitMQ could get handle counts and not spam the logs saying "Could not find handle.exe, please install from sysinternals". I think updating handle.exe to the latest version would fix the issue.

We opted to just remove it, since box has pwsh and that can be used as a fallback to get handle information (#6613).

[michaelklishin]

@sir-wilhelm thank you for sharing the details. In addition to #6613, there is also #12369 but we don't have an ETA. It's a small change to contribute, though, because parsing fshc's JSON output will be trivial compared to handle.exe's borderless table-like format.

[michaelklishin]

@sir-wilhelm hm, apparently there's also #8961 so #12369 is still relevant, as should be updating handle.exe.

If you have a link to the most recent version that works on Windows 2025, I'll find a place in the docs to mention it.

[sir-wilhelm]

digging through old logs I found we had handle v4.1 on the system:

2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0> handle.exe output did not contain a line beginning with 'File', using powershell to determine used file descriptor count: ["Nthandle v4.1 - Handle viewer",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "Copyright (C) 1997-2016 Mark Russinovich",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "Sysinternals - www.sysinternals.com",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "Handle type summary:",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 2",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 4",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 21",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 1",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 447",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 2",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 6",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 6",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 2",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 1",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 3",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 5",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 8",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 369",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 2",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 1",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 15",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "<Unknown type>  : 100",
2025-04-22 13:09:40.416000-04:00 [warning] <0.486.0>                                                                                                                            "Total handles: 995"]

I downloaded the latest version (v5.0 published 2022-10-26) from: https://learn.microsoft.com/en-us/sysinternals/downloads/handle and put it in a folder in the system path.

After restarting RabbitMQ I did not see any warnings like <0.492.0> Could not find handle.exe, using powershell to determine handle count or
handle.exe output did not contain a line beginning with 'File', using powershell to determine used file descriptor count..., and the driver prompt did not pop up either.

It looks like handle.exe v5 works on Server 2025.

[michaelklishin]

@sir-wilhelm excellent investigative work, I'll try to find a reasonable place for this in the docs

[michaelklishin]

Ended up document it in the Windows installation guide.