I have a Server 2003 x 64 SP2 Server that reboots randomly and starts up with the following shutdown code. Error code 0000000000000027, parameter1 00000000baad0080, parameter2 fffffadf241f5f50, parameter3 fffffadf241f5960, parameter4 fffffadf26c8d6f1. I have also applied the Hotfix suggested in the following KB article and it didn't help. http://support.microsoft.com/kb/952185 There are no other Event ID errors or warning's to help me troubleshoot the cause of the problem. I have analysed the memory.dmp file and get the following. 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* RDR_FILE_SYSTEM (27) If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined as follows: RDBSS_BUG_CHECK_CACHESUP = 0xca550000, RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000, RDBSS_BUG_CHECK_CLOSE = 0xc10e0000, RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000, Arguments: Arg1: 00000000baad0080 Arg2: fffffadf241f5f50 Arg3: fffffadf241f5960 Arg4: fffffadf26c8d6f1 Debugging Details: ------------------ Page c8f26 not present in the dump file. Type ".hh dbgerr004" for details Page c34c7 not present in the dump file. Type ".hh dbgerr004" for details OVERLAPPED_MODULE: Address regions for 'HIDCLASS' and 'imapi.sys' overlap EXCEPTION_RECORD: fffffadf241f5f50 -- (.exr 0xfffffadf241f5f50) ExceptionAddress: fffffadf26c8d6f1 (rdbss!RxMarkFobxOnClose+0x0000000000000025) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000008 Attempt to read from address 0000000000000008 CONTEXT: fffffadf241f5960 -- (.cxr 0xfffffadf241f5960) rax=0000000000000000 rbx=fffffa800344ce80 rcx=fffffadf26c7bfc0 rdx=fffffadf26c61000 rsi=fffffadf26c9a4e0 rdi=0000000000000000 rip=fffffadf26c8d6f1 rsp=fffffadf241f6170 rbp=fffffadf241f6401 r8=0000000000000000 r9=fffffa800344ce80 r10=fffffadf34cd9a80 r11=0000000000000000 r12=fffffadf34eaf010 r13=fffffadf376b4e00 r14=fffffadf241f6b90 r15=0000000000000001 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 rdbss!RxMarkFobxOnClose+0x25: fffffadf`26c8d6f1 488b7008 mov rsi,qword ptr [rax+8] ds:002b:00000000`00000008=???????????????? Resetting default scope PROCESS_NAME: systartw.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000008 READ_ADDRESS: 0000000000000008 FOLLOWUP_IP: rdbss!RxMarkFobxOnClose+25 fffffadf`26c8d6f1 488b7008 mov rsi,qword ptr [rax+8] FAULTING_IP: rdbss!RxMarkFobxOnClose+25 fffffadf`26c8d6f1 488b7008 mov rsi,qword ptr [rax+8] BUGCHECK_STR: 0x27 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE LAST_CONTROL_TRANSFER: from fffffadf26c8bf3c to fffffadf26c8d6f1 STACK_TEXT: fffffadf`241f6170 fffffadf`26c8bf3c : fffffa80`00000008 00000000`00000000 fffffadf`26c9a4e0 fffffa80`0344c920 : rdbss!RxMarkFobxOnClose+0x25 fffffadf`241f61b0 fffffadf`26c62a77 : fffffadf`34cd9a80 fffffadf`00000000 00000000`00000000 fffffadf`376b4ca0 : rdbss!RxCommonClose+0x376 fffffadf`241f6260 fffffadf`26bae3e8 : fffffadf`26c7b280 fffffadf`241f6301 fffffadf`376b4e00 fffffadf`3765f4f0 : rdbss!RxFsdCommonDispatch+0x51c fffffadf`241f6360 fffffadf`290cd922 : fffffadf`376b4ca0 fffffadf`241f64a0 fffffadf`356bc040 fffffadf`3553bcf0 : mrxsmb!MRxSmbFsdDispatch+0x211 fffffadf`241f63b0 fffffadf`290cd542 : fffffadf`376b4ca0 fffffadf`241f64a0 fffffadf`376b4ca0 fffffadf`35070c00 : fltmgr!FltpDispatch+0x1c2 fffffadf`241f6410 fffffadf`290cd8df : fffffadf`241f6b90 fffffadf`376b4ca0 fffffadf`376b4c00 fffffadf`376b4ca0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2 fffffadf`241f6480 fffff800`012831c0 : fffffadf`241f6b90 fffffadf`376b4ca0 fffffadf`241f6b90 fffffadf`376b4ca0 : fltmgr!FltpDispatch+0x17f fffffadf`241f64e0 fffff800`0127c1da : 00000000`00000000 fffff800`01282190 fffffadf`241f6a80 fffffadf`241f6b90 : nt!IopDeleteFile+0x301 fffffadf`241f6580 fffff800`01280184 : fffffadf`3765f4f0 fffffadf`3765f4a0 fffffadf`241f68b0 00000000`00000001 : nt!IopParseDevice+0x15c4 fffffadf`241f6730 fffff800`012848a7 : 00000000`00000000 fffffadf`241f68a0 00000000`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x931 fffffadf`241f6840 fffff800`01294a5d : fffffadf`378d9d40 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x180 fffffadf`241f6a30 fffff800`0102e33d : fffffadf`34e19660 fffffadf`241f6cf0 fffffadf`34e19660 00000000`7ef38000 : nt!NtQueryAttributesFile+0x133 fffffadf`241f6c70 00000000`77ef0dca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3 00000000`0576e7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef0dca SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: rdbss!RxMarkFobxOnClose+25 FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4b853d99 STACK_COMMAND: .cxr 0xfffffadf241f5960 ; kb FAILURE_BUCKET_ID: X64_0x27_rdbss!RxMarkFobxOnClose+25 BUCKET_ID: X64_0x27_rdbss!RxMarkFobxOnClose+25 Followup: MachineOwner

Hi, the only track on internet I found is this http://www.3dbuzz.com/vbforum/showthread.php?151433-HTTP-SSL-service-related-crash HTHEdoardo Benussi - Microsoft MVP Management Infrastructure - Systems Administration https://mvp.support.microsoft.com/Profile/Benussi Windows Server Italian Forum Moderator edo[at]mvps[dot]org

I also have updated all drivers on the server as well. RAID, Video, NIC, Chipset, etc. Ran Hard drive disk checks as well and not problems found. Have not ran a memory test on the RAM yet. Could give that a try next.

Hi, Please also check if the symptom is similar to the one described in the KB article http://support.microsoft.com/kb/960092. If it is not the case, I suggest that you speak directly with a Microsoft Support Professional so that the crash dump can be analyzed. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, please go to the following address on the World Wide Web: http://support.microsoft.com/directory/overview.aspThis posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks for the suggestion but this is not related. I don't run Citrix Presentation Server on this server nor do I get a grey screen when I log on.

Hi, Thanks for your update. In order to troubleshoot the problem efficiently, I suggest that you contact Microsoft Customer Support Service for dump analysis. Thanks for your understanding. This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.