Hi, I have had a few of my servers having this "unexpected power loss" error and then restarting. Some are virtual and some are physical, and all are running Server 2008 R2 Standard. The Error's started on 11/19/10. Their are no major changes on that date. below are the minidumps. Thank you. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff880028bea97, 0, 10} Probably caused by : dfsc.sys ( dfsc!DfscSetMatchingTarget+1f ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff880028bea97, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 0000000000000010, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: dfsc!DfscSetMatchingTarget+1f fffff880`028bea97 488b5210 mov rdx,qword ptr [rdx+10h] EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000010 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800016be0e0 0000000000000010 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff88005fffa28 -- (.exr 0xfffff88005fffa28) ExceptionAddress: fffff880028bea97 (dfsc!DfscSetMatchingTarget+0x000000000000001f) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000010 Attempt to read from address 0000000000000010 TRAP_FRAME: fffff88005fffad0 -- (.trap 0xfffff88005fffad0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff8a011926610 rbx=0000000000000000 rcx=fffff8a00db22890 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880028bea97 rsp=fffff88005fffc60 rbp=fffff880028ad110 r8=fffff8a0109081d0 r9=0000000000000000 r10=fffff80001602420 r11=fffff88005fffc50 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc dfsc!DfscSetMatchingTarget+0x1f: fffff880`028bea97 488b5210 mov rdx,qword ptr [rdx+10h] ds:9260:00000000`00000010=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800014c0a39 to fffff80001486740 STACK_TEXT: fffff880`05fff258 fffff800`014c0a39 : 00000000`0000001e ffffffff`c0000005 fffff880`028bea97 00000000`00000000 : nt!KeBugCheckEx fffff880`05fff260 fffff800`01485d82 : fffff880`05fffa28 00000000`00000000 fffff880`05fffad0 fffff8a0`0db22890 : nt!KiDispatchException+0x1b9 fffff880`05fff8f0 fffff800`014848fa : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`028bca9a : nt!KiExceptionDispatch+0xc2 fffff880`05fffad0 fffff880`028bea97 : 00000000`00000002 fffff880`028b199b fffff880`05fffce0 fffff8a0`00b3a710 : nt!KiPageFault+0x23a fffff880`05fffc60 fffff880`028b1ab5 : 00000000`00000000 fffff880`028ad110 fffff8a0`0db22890 00000000`00000000 : dfsc!DfscSetMatchingTarget+0x1f fffff880`05fffcb0 fffff880`028b0a42 : fffff8a0`0fdfece0 fffff8a0`00b3a710 00000000`00000008 fffff8a0`0fdfece0 : dfsc!DfscValidateReferral+0x105 fffff880`05fffd30 fffff880`028b3f6d : 00000000`00000001 fffffa80`08216d80 fffff8a0`00b3a710 fffffa80`08216d80 : dfsc!DfscCmValidateState+0x7a fffff880`05fffd70 fffff880`028bf9a2 : fffff8a0`0fdfece0 00000000`00000000 00000000`00000001 fffffa80`08216d60 : dfsc!DfscSurrogateCreate+0x7d fffff880`05fffde0 fffff880`0185dc40 : fffffa80`08216cd0 00000000`00000001 fffffa80`08216d60 00000000`c0000016 : dfsc!DfscSurrogatePreProcess+0xb6 fffff880`05fffe10 fffff880`0185d157 : fffffa80`08216cd0 00000000`00000001 fffffa80`08ce51e0 fffffa80`06cd8070 : mup!MupCallSurrogatePrePost+0x120 fffff880`05fffe70 fffff880`0185e64b : 00000000`00000000 00000000`00000000 fffffa80`08ce51e0 00000000`00000000 : mup!MupStateMachine+0x147 fffff880`05fffec0 fffff880`012aa3a2 : 00000000`00000000 fffffa80`09540010 fffff8a0`1136a800 fffffa80`08ce51e0 : mup!MupCreate+0x2bf fffff880`05ffff50 fffff800`01789807 : 00000000`00000004 fffff800`01789260 fffffa80`08eb3870 00000000`00000000 : fltmgr!FltpCreate+0x392 fffff880`06000000 fffff800`0177fe84 : fffffa80`0404e060 00000000`00000000 fffffa80`0926a010 00000000`00000000 : nt!IopParseDevice+0x5a7 fffff880`06000190 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpLookupObjectName+0x585 STACK_COMMAND: kb FOLLOWUP_IP: dfsc!DfscSetMatchingTarget+1f fffff880`028bea97 488b5210 mov rdx,qword ptr [rdx+10h] SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: dfsc!DfscSetMatchingTarget+1f FOLLOWUP_NAME: MachineOwner MODULE_NAME: dfsc IMAGE_NAME: dfsc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc200 FAILURE_BUCKET_ID: X64_0x1E_c0000005_dfsc!DfscSetMatchingTarget+1f BUCKET_ID: X64_0x1E_c0000005_dfsc!DfscSetMatchingTarget+1f Followup: MachineOwner --------- ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff8800311fa97, 0, 10} Probably caused by : dfsc.sys ( dfsc!DfscSetMatchingTarget+1f ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff8800311fa97, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 0000000000000010, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: dfsc!DfscSetMatchingTarget+1f fffff880`0311fa97 488b5210 mov rdx,qword ptr [rdx+10h] EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000010 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800019050e0 0000000000000010 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff88004b7fa28 -- (.exr 0xfffff88004b7fa28) ExceptionAddress: fffff8800311fa97 (dfsc!DfscSetMatchingTarget+0x000000000000001f) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000010 Attempt to read from address 0000000000000010 TRAP_FRAME: fffff88004b7fad0 -- (.trap 0xfffff88004b7fad0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff8a003ead010 rbx=0000000000000000 rcx=fffff8a00386a8f0 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8800311fa97 rsp=fffff88004b7fc60 rbp=fffff8800310e110 r8=fffff8a00b4ec6c0 r9=0000000000000000 r10=fffff8800310e7a0 r11=fffff88004b7fc50 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc dfsc!DfscSetMatchingTarget+0x1f: fffff880`0311fa97 488b5210 mov rdx,qword ptr [rdx+10h] ds:0001:00000000`00000010=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80001707a39 to fffff800016cd740 STACK_TEXT: fffff880`04b7f258 fffff800`01707a39 : 00000000`0000001e ffffffff`c0000005 fffff880`0311fa97 00000000`00000000 : nt!KeBugCheckEx fffff880`04b7f260 fffff800`016ccd82 : fffff880`04b7fa28 00000000`00000000 fffff880`04b7fad0 fffff8a0`0386a8f0 : nt!KiDispatchException+0x1b9 fffff880`04b7f8f0 fffff800`016cb8fa : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`0311da9a : nt!KiExceptionDispatch+0xc2 fffff880`04b7fad0 fffff880`0311fa97 : 00000000`00000002 fffff880`0311299b fffff880`04b7fce0 fffff8a0`049ed170 : nt!KiPageFault+0x23a fffff880`04b7fc60 fffff880`03112ab5 : 00000000`00000000 fffff880`0310e110 fffff8a0`0386a8f0 00000000`00000000 : dfsc!DfscSetMatchingTarget+0x1f fffff880`04b7fcb0 fffff880`03111a42 : fffff8a0`04a4f320 fffff8a0`049ed170 00000000`00000008 fffff8a0`04a4f320 : dfsc!DfscValidateReferral+0x105 fffff880`04b7fd30 fffff880`03114f6d : 00000000`00000001 fffffa80`04e885d0 fffff8a0`049ed170 fffffa80`04e885d0 : dfsc!DfscCmValidateState+0x7a fffff880`04b7fd70 fffff880`031209a2 : fffff8a0`04a4f320 00000000`00000000 00000000`00000001 fffffa80`04e885b0 : dfsc!DfscSurrogateCreate+0x7d fffff880`04b7fde0 fffff880`0190fc40 : fffffa80`04e88520 00000000`00000001 fffffa80`04e885b0 00000000`c0000016 : dfsc!DfscSurrogatePreProcess+0xb6 fffff880`04b7fe10 fffff880`0190f157 : fffffa80`04e88520 00000000`00000001 fffffa80`04daa5b0 fffffa80`05289dd0 : mup!MupCallSurrogatePrePost+0x120 fffff880`04b7fe70 fffff880`0191064b : 00000000`00000000 00000000`00000000 fffffa80`04daa5b0 00000000`00000000 : mup!MupStateMachine+0x147 fffff880`04b7fec0 fffff880`012bc3a2 : 00000000`00000000 fffffa80`051abc60 fffff8a0`04329d00 fffffa80`04daa5b0 : mup!MupCreate+0x2bf fffff880`04b7ff50 fffff800`019d0807 : 00000000`00000004 fffff800`019d0260 fffffa80`04ecf900 00000000`00000000 : fltmgr!FltpCreate+0x392 fffff880`04b80000 fffff800`019c6e84 : fffffa80`04056790 00000000`00000000 fffffa80`04fd2700 00000000`00000000 : nt!IopParseDevice+0x5a7 fffff880`04b80190 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpLookupObjectName+0x585 STACK_COMMAND: kb FOLLOWUP_IP: dfsc!DfscSetMatchingTarget+1f fffff880`0311fa97 488b5210 mov rdx,qword ptr [rdx+10h] SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: dfsc!DfscSetMatchingTarget+1f FOLLOWUP_NAME: MachineOwner MODULE_NAME: dfsc IMAGE_NAME: dfsc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc200 FAILURE_BUCKET_ID: X64_0x1E_c0000005_dfsc!DfscSetMatchingTarget+1f BUCKET_ID: X64_0x1E_c0000005_dfsc!DfscSetMatchingTarget+1f Followup: MachineOwner --------- ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff88002d0aa97, 0, 10} Probably caused by : dfsc.sys ( dfsc!DfscSetMatchingTarget+1f ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff88002d0aa97, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 0000000000000010, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: dfsc!DfscSetMatchingTarget+1f fffff880`02d0aa97 488b5210 mov rdx,qword ptr [rdx+10h] EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000010 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800018f30e0 0000000000000010 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff88005b0ca28 -- (.exr 0xfffff88005b0ca28) ExceptionAddress: fffff88002d0aa97 (dfsc!DfscSetMatchingTarget+0x000000000000001f) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000010 Attempt to read from address 0000000000000010 TRAP_FRAME: fffff88005b0cad0 -- (.trap 0xfffff88005b0cad0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff8a015488230 rbx=0000000000000000 rcx=fffff8a00c853710 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff88002d0aa97 rsp=fffff88005b0cc60 rbp=fffff88002cf9110 r8=fffff8a013071b00 r9=0000000000000000 r10=fffff80001837420 r11=fffff88005b0cc50 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc dfsc!DfscSetMatchingTarget+0x1f: fffff880`02d0aa97 488b5210 mov rdx,qword ptr [rdx+10h] ds:b620:00000000`00000010=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800016f5a39 to fffff800016bb740 STACK_TEXT: fffff880`05b0c258 fffff800`016f5a39 : 00000000`0000001e ffffffff`c0000005 fffff880`02d0aa97 00000000`00000000 : nt!KeBugCheckEx fffff880`05b0c260 fffff800`016bad82 : fffff880`05b0ca28 00000000`00000000 fffff880`05b0cad0 fffff8a0`0c853710 : nt!KiDispatchException+0x1b9 fffff880`05b0c8f0 fffff800`016b98fa : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`02d08a9a : nt!KiExceptionDispatch+0xc2 fffff880`05b0cad0 fffff880`02d0aa97 : 00000000`00000002 fffff880`02cfd99b fffff880`05b0cce0 fffff8a0`151074e0 : nt!KiPageFault+0x23a fffff880`05b0cc60 fffff880`02cfdab5 : 00000000`00000000 fffff880`02cf9110 fffff8a0`0c853710 00000000`00000000 : dfsc!DfscSetMatchingTarget+0x1f fffff880`05b0ccb0 fffff880`02cfca42 : fffff8a0`0a7b7ea0 fffff8a0`151074e0 00000000`00000008 fffff8a0`0a7b7ea0 : dfsc!DfscValidateReferral+0x105 fffff880`05b0cd30 fffff880`02cfff6d : 00000000`00000001 fffffa80`086ba6c0 fffff8a0`151074e0 fffffa80`086ba6c0 : dfsc!DfscCmValidateState+0x7a fffff880`05b0cd70 fffff880`02d0b9a2 : fffff8a0`0a7b7ea0 00000000`00000000 00000000`00000001 fffffa80`086ba6a0 : dfsc!DfscSurrogateCreate+0x7d fffff880`05b0cde0 fffff880`00fedc40 : fffffa80`086ba610 00000000`00000001 fffffa80`086ba6a0 00000000`c0000016 : dfsc!DfscSurrogatePreProcess+0xb6 fffff880`05b0ce10 fffff880`00fed157 : fffffa80`086ba610 00000000`00000001 fffffa80`07bea950 fffffa80`06677070 : mup!MupCallSurrogatePrePost+0x120 fffff880`05b0ce70 fffff880`00fee64b : 00000000`00000000 00000000`00000000 fffffa80`07bea950 00000000`00000000 : mup!MupStateMachine+0x147 fffff880`05b0cec0 fffff880`012e03a2 : 00000000`00000000 fffffa80`05187650 fffff8a0`12c23200 fffffa80`07bea950 : mup!MupCreate+0x2bf fffff880`05b0cf50 fffff800`019be807 : 00000000`00000004 fffff800`019be260 fffffa80`08d67a50 00000000`00000000 : fltmgr!FltpCreate+0x392 fffff880`05b0d000 fffff800`019b4e84 : fffffa80`0406fae0 00000000`00000000 fffffa80`08735b10 00000000`00000000 : nt!IopParseDevice+0x5a7 fffff880`05b0d190 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpLookupObjectName+0x585 STACK_COMMAND: kb FOLLOWUP_IP: dfsc!DfscSetMatchingTarget+1f fffff880`02d0aa97 488b5210 mov rdx,qword ptr [rdx+10h] SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: dfsc!DfscSetMatchingTarget+1f FOLLOWUP_NAME: MachineOwner MODULE_NAME: dfsc IMAGE_NAME: dfsc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc200 FAILURE_BUCKET_ID: X64_0x1E_c0000005_dfsc!DfscSetMatchingTarget+1f BUCKET_ID: X64_0x1E_c0000005_dfsc!DfscSetMatchingTarget+1f Followup: MachineOwner --------- ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff880029f4a97, fffff88004f94e40, 0} Probably caused by : dfsc.sys ( dfsc!DfscSetMatchingTarget+1f ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff880029f4a97, Address of the instruction which caused the bugcheck Arg3: fffff88004f94e40, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: dfsc!DfscSetMatchingTarget+1f fffff880`029f4a97 488b5210 mov rdx,qword ptr [rdx+10h] CONTEXT: fffff88004f94e40 -- (.cxr 0xfffff88004f94e40) rax=fffff8a004b518e0 rbx=0000000000000000 rcx=fffff8a0015be4f0 rdx=0000000000000000 rsi=fffff8a0015be4f0 rdi=0000000000000002 rip=fffff880029f4a97 rsp=fffff88004f95810 rbp=fffff880029e3110 r8=fffff8a0048d0550 r9=0000000000000000 r10=fffff8000183a420 r11=fffff88004f95800 r12=fffff8a003c10100 r13=0000000000000001 r14=fffff880029e3110 r15=0000000000000001 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 dfsc!DfscSetMatchingTarget+0x1f: fffff880`029f4a97 488b5210 mov rdx,qword ptr [rdx+10h] ds:002b:00000000`00000010=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP BUGCHECK_STR: 0x3B PROCESS_NAME: explorer.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880029f4a97 STACK_TEXT: fffff880`04f95810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dfsc!DfscSetMatchingTarget+0x1f FOLLOWUP_IP: dfsc!DfscSetMatchingTarget+1f fffff880`029f4a97 488b5210 mov rdx,qword ptr [rdx+10h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: dfsc!DfscSetMatchingTarget+1f FOLLOWUP_NAME: MachineOwner MODULE_NAME: dfsc IMAGE_NAME: dfsc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc200 STACK_COMMAND: .cxr 0xfffff88004f94e40 ; kb FAILURE_BUCKET_ID: X64_0x3B_dfsc!DfscSetMatchingTarget+1f BUCKET_ID: X64_0x3B_dfsc!DfscSetMatchingTarget+1f Followup: MachineOwner ---------

Hi, According to the debug information, the possible cause is dfsc.sys. Dfsc.sys is a DFS Client MUP surrogate driver. Based on the current situation, I would like to suggest you install the hotfix the Microsoft KB983620 article provides. This client-side hotfix contains the most current version of dfsc.sys. You cannot access a DFS share through a mapped network drive on a computer that is running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/983620 If the issue persists, I would like to suggest you contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Just posting to let you know (MS) that I have an entire office of over 80 machines crashing with this same error. The memory dumps all end in the same manner with dfsc!DfscSetMatchingTarget+0x1f at the end of the trace. My terminal server in that office fails as well. Other offices have not been affected. I tried the updated dfsc.sys file that seems to be from SP2(yet to be released) and it doesn't help. I'm going to call MS about this, but this is really bad. Over a year later and this bug still manifests itself.

Hi Tesfaye_SI, did you ever get an answer back from MS about this? We have had this problem off and on for the last 6 months in our office with almost 200 machines. It's really frustrating to have to tell our users to just "get used to it" as we have no control over it and cannot predict when it is about to happen. Please let me know if you've gotten any solution for this :)

The short version is that there are a couple of bugs in DFSC.sys. After a few days of phone calls and traces with Microsoft Support, the engineer that examined the data sent me his notes which showed a race condition in one of the functions that check referral validity (or something like that, it's been a while). Microsoft has not been able to tell me what is triggering this bug in our environment. I traveled to the affected office and spent a week there troubleshooting the problem and found that DNS was not right for most of the servers including the DFS server listed in the stack dump. Around the time that the errors started occurring our AD engineer demoted a Windows 2003 AD controller which also happened to be the only valid DNS server in the IP configuration for most of the servers in that office (we were moving from 2003 controllers to 2008 R2). We were also having issues with heavy loads on our pipe between the affected office and our main office which has the AD controller with the PDC emulator role installed (DFS contacts the server with the PDC emulator to update its cache). After clearing up the DNS issue the problem stopped occurring. Very recently (over a month and a half later), our AD engineer accidentally rebooted all of our servers at once while working with Symantec on a deployment issue. Sure enough the same error popped up in the remote site. This time it wasn't across the board and only some machines were affected. After we rebooted the DFS server things seemed to return to normal. I also changed the behavior for that site to allow the machines to utilize other folder targets, that may help, I'm not sure. We have multiple offices (AD sites) but only one domain. I don't have this problem in any other site. Most of our remote sites have two DC, all of them are GCs, our main office has four DCs. Outside of this issue in our remote office, we don't have AD issues. Replications aren't an issue, group policy, authentication, etc. are all functioning just fine and we are Windows 2008/R2 for all of our domain controllers. We just raised the functional level to Windows 2008. It would be nice to know why DFSC.sys fails when the DFS and AD servers are available AND I'm able to access the folder target for that site. I can see why it would fail and then blue screen due to the bug if the DFS server (only DFS root for that site) and or the AD controller (PDC in another site) were unreachable, but during this last round of bug checks neither scenario was the case. My only advice is to contact Microsoft about the issue so you can get a case opened and maybe they will release a patch since they know it's a bug in thier code causing the bug checks. I pushed them to check the status of DFSC.sys in Windows 8 and they claim that this bug is not present in the Windows 8 code base. We shall see. I'm rarely ever truly stressed at work but this particular issue had me stressed out.