Hi Guys, I've got a Windows Server 2008 R2 file server which simply has a few shared drives and a couple of shared printers. Twice now it has crashed and rebooted over the past two weeks. The crash info I get is; Problem signature: Problem Event Name: BlueScreen OS Version: 6.0.6002.2.2.0.272.7 Locale ID: 2057 Additional information about the problem: BCCode: 1000007e BCP1: FFFFFFFF80000003 BCP2: FFFFF80001C9F750 BCP3: FFFFFA60045E0A98 BCP4: FFFFFA60045E0470 OS Version: 6_0_6002 Service Pack: 2_0 Product: 272_3 Files that help describe the problem: C:\Windows\Minidump\Mini111710-01.dmp C:\Users\seb.spiers\AppData\Local\Temp\2\WER-431529-0.sysdata.xml C:\Users\seb.spiers\AppData\Local\Temp\2\WERC679.tmp.version.txt Annoyingly when I look in C:\Users\seb.spiers\AppData\Local\Temp\2 there is nothing there. Does anyone have any ideas? Thanks.

I just had the same problem. Nom d’événement de problème: BlueScreen Version du système: 6.0.6002.2.2.0.768.3 Identificateur de paramètres régionaux: 3084 Informations supplémentaires sur le problème: BCCode: be BCP1: 980078AC BCP2: A165E121 BCP3: BE9B0A9C BCP4: 0000000B OS Version: 6_0_6002 Service Pack: 2_0 Product: 768_1 What is happening with Windows. I would like to receive an answer asap. I lost all my infos that I was working on.

Hi, I would like to suggest you update the BIOS and the hardware drivers for Windows Server 2008 R2 first. If the issue persists, would you please send me more information for analyzing. For your convenience, I have created a workspace for you. You can upload the information files to the following link. (Please choose "Send Files to Microsoft") Workspace URL: https://sftasia.one.microsoft.com/choosetransfer.aspx?key=6906c50d-2baa-49b9-852a-7f8b2c5c1211 Password: fzMvxOCcgr1 Note: Due to differences in text formatting with various email clients, the workspace link above may appear to be broken. Please be sure to include all text between '(' and ')' when typing or copying the workspace link into your browser. Meanwhile, please note that files uploaded for more than 72 hours will be deleted automatically. Please ensure to notify me timely after you have uploaded the files. Thank you for your understanding. Collect Minidump Files ================= 1. Click "Start", input "SYSDM.CPL" (without quotation marks) in the “Search” bar and press “Enter”. 2. Switch to the "Advanced" tab and click the "Settings" button under "Startup and Recovery". 3. Under "Write debugging information" section, make sure the "Small memory dump (128KB)" option is selected. 4. Make sure "%SystemRoot%\Minidump" is in the "Small dump directory" open box and click “OK”. If the Blue Screen appears again, please refer to the following steps to collect memory dump files: 1. Click “Start”, type “%SystemRoot%\Minidump" (without quotation marks) in “Search” bar and press “Enter”. 2. Go to your Desktop, right-click on it and create a new folder named "Dump". 3. Copy all the memory dump files (looks like [Mini092008-01.dmp]) in Minidump to this folder. 4. Right-click on the Dump folder, click "Send To", and click "Compressed (zipped) Folder". 5. Please send the ZIP file to us. You may also analyze them with Debugging Tools by yourself. You can install it and it’s Symbol Packages from the following link: http://www.microsoft.com/whdc/Devtools/Debugging/default.mspx WinDbg will tell you the possible cause. For more information, please read Microsoft KB Article: How to read the small memory dump files that Windows creates for debugging. If no clue can be found, you may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Arthur, thank you for your advice. The server is a XenServer VM so BIOS upgrade is not possible. I've tried reading the minidump using the instructions in the kb article but haven't had a lot of luck. Would this be the correct syntax on a x64 server? c:\Program Files\Debugging Tools for Windows (x64)>windbg -y srv*c:\symbols*http://msdl.microsoft.com/download/symbols -i c:\windows -z c:\windows\minidump\Mini111810-01.dmp It launches the gui but only seems to get this far... Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [c:\windows\minidump\Mini111810-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: c:\windows Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x64 Product: Server, suite: TerminalServer SingleUserTS Built by: 6002.18267.amd64fre.vistasp2_gdr.100608-0458 Machine Name: Kernel base = 0xfffff800`01c5f000 PsLoadedModuleList = 0xfffff800`01e23dd0 Debug session time: Thu Nov 18 05:33:30.026 2010 (UTC + 0:00) System Uptime: 0 days 17:58:06.677 Loading Kernel Symbols . Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. .............................................................. ................................................................ .... Loading User Symbols Loading unloaded module list .... of course I could simply be quite impatient and need to wait longer...... ?

It would appear that I have an inability to read things correctly; having done !analyze -v I have some results. It would appear that srv2.sys is the issue. 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffff80000003, The exception code that was not handled Arg2: fffff80001cb3750, The address that the exception occurred at Arg3: fffffa6004ca4a98, Exception Record Address Arg4: fffffa6004ca4470, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid FAULTING_IP: nt!DbgBreakPoint+0 fffff800`01cb3750 cc int 3 EXCEPTION_RECORD: fffffa6004ca4a98 -- (.exr 0xfffffa6004ca4a98) ExceptionAddress: fffff80001cb3750 (nt!DbgBreakPoint) ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 1 Parameter[0]: 0000000000000000 CONTEXT: fffffa6004ca4470 -- (.cxr 0xfffffa6004ca4470) rax=fffffa800ea45af0 rbx=fffffa800d63c570 rcx=fffffa800d63c570 rdx=000063c300000000 rsi=fffffa800a7e4c60 rdi=fffffa800d63c580 rip=fffff80001cb3750 rsp=fffffa6004ca4cd8 rbp=0000000000000004 r8=fffffa6004ca4d28 r9=0000000003a0ea1e r10=0000000000000000 r11=0000000000000000 r12=0000000000000004 r13=0000000000000000 r14=fffffa80063b43d0 r15=fffffa60019e7cc0 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286 nt!DbgBreakPoint: fffff800`01cb3750 cc int 3 Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP BUGCHECK_STR: 0x7E PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached. EXCEPTION_PARAMETER1: 0000000000000000 LAST_CONTROL_TRANSFER: from fffffa60051b4b45 to fffff80001cb3750 STACK_TEXT: fffffa60`04ca4cd8 fffffa60`051b4b45 : fffffa80`0e016500 00000000`00000000 fffffa60`04ca4d28 fffffa80`00000001 : nt!DbgBreakPoint fffffa60`04ca4ce0 fffffa60`051cfdb5 : fffffa80`0a7e4c60 fffffa80`0a7e4c60 fffffa80`0a7e4c60 fffffa80`0d63c580 : srv2!SrvMdlReadCompleteComplete+0x25 fffffa60`04ca4d10 fffff800`01ec3f57 : fffffa80`0a7e6bb0 00000000`00000080 fffffa80`0a7e4c60 fffffa80`063b43d0 : srv2!SrvProcWorkerThread+0x175 fffffa60`04ca4d50 fffff800`01cf6656 : fffffa60`019e4180 fffffa80`0a7e6bb0 fffffa60`019edd40 fffffa60`019e47f0 : nt!PspSystemThreadStartup+0x57 fffffa60`04ca4d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 FOLLOWUP_IP: srv2!SrvMdlReadCompleteComplete+25 fffffa60`051b4b45 488bcb mov rcx,rbx SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: srv2!SrvMdlReadCompleteComplete+25 FOLLOWUP_NAME: MachineOwner MODULE_NAME: srv2 IMAGE_NAME: srv2.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4c8509de STACK_COMMAND: .cxr 0xfffffa6004ca4470 ; kb FAILURE_BUCKET_ID: X64_0x7E_srv2!SrvMdlReadCompleteComplete+25 BUCKET_ID: X64_0x7E_srv2!SrvMdlReadCompleteComplete+25 Followup: MachineOwner ---------

I'm not sure if this is any use; 0: kd> lmvm srv2 start end module name fffffa60`051a4000 fffffa60`051d6000 srv2 (pdb symbols) c:\symbols\srv2.pdb\9AE47AD1C6924BEF86A9AD1F1B84D47F2\srv2.pdb Loaded symbol image file: srv2.sys Mapped memory image file: c:\windows\System32\drivers\srv2.sys Image path: \SystemRoot\System32\DRIVERS\srv2.sys Image name: srv2.sys Timestamp: Mon Sep 06 16:33:50 2010 (4C8509DE) CheckSum: 0002DC5D ImageSize: 00032000 File version: 6.0.6002.18306 Product version: 6.0.6002.18306 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: SRV2.SYS OriginalFilename: SRV2.SYS ProductVersion: 6.0.6002.18306 FileVersion: 6.0.6002.18306 (vistasp2_gdr.100906-0403) FileDescription: Smb 2.0 Server driver LegalCopyright: © Microsoft Corporation. All rights reserved.

Hi, The possible cause WinDbg found is Microsoft SMB 2.0 server driver (Srv2.sys). Based on the current situation, I would like to suggest you try the following hot fix: The hot fix for your issue has been packaged and placed on an HTTP site for you to download. WARNING: This fix is not publicly available through the Microsoft website as it has not gone through full Microsoft regression testing. If you would like confirmation that this fix is designed to address your specific problem, or if you would like to confirm whether there are any special compatibility or installation issues associated with this fix, you are encouraged to speak to a Support Professional in Product Support Services. The package is password protected so be sure to enter the appropriate password for each package. To ensure the right password is provided cut and paste the password from this mail. NOTE: Passwords expire every 7 days so download the package within that period to insure you can extract the files. If you receive two passwords it means you are receiving the fix during a password change cycle. Use the second password if you download after the indicated password change date. Package: ----------------------------------------------------------- KB Article Number (s) : 978491 Language: All (Global) Platform: x64 Location: ( http://hotfixv4.microsoft.com/Windows%207/WindowsServer%202008%20R2/sp1/Fix298815/7600/free/403959_intl_x64_zip.exe ) Password: 05c3EpL128 Password Changes On: 11/24/2010 Next Password: r-qzjja NOTE: Be sure to include all text between '(' and ')' when navigating to this hot fix location! Thanks!Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.