Windows 2008 restrarts unexpectedly and I'm getting this message: Problem signature: Problem Event Name: BlueScreen OS Version: 6.0.6001.2.1.0.274.10 Locale ID: 1050 Additional information about the problem: BCCode: be BCP1: 000006427FB3F478 BCP2: 64D00000E1C9E025 BCP3: FFFFFA60051D4730 BCP4: 000000000000000A OS Version: 6_0_6001 Service Pack: 1_0 Product: 274_3 Files that help describe the problem: C:\Windows\Minidump\Mini031508-02.dmp C:\Users\exadmin.ERSTE\AppData\Local\Temp\2\WER-191046-0.sysdata.xml here is dump file: http://193.198.102.182:8080/dump/ Can anyone help? Thank you.

Hi, Please note the "blue death screen" issue is related to kernel crash. I suggest you contact Microsoft CSS (CUSTOMER SERVICE AND SUPPORT), which is the best resource to analyze the memory dump file and locate the root cause. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US please see http://support.microsoft.com for regional support phone numbers. Besides, Based on the error code 0x000000BE, it seems to be related with drivers. Did you encounter this issue after completing installing Windows server 2008? If so, please contact the device provider to ask the update drivers for Windows server 2008. And also, you can try the following steps to see if the issue can be solved: A. To resolve an error caused by a faulty device driver, system service, or BIOS 1. Restart your computer. 2. Press F8 at the character-based menu that displays the operating system choices. 3. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time. B. To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool 1. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error. 2. Try disabling memory caching of the BIOS. 3. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer. 4. Make sure the latest Service Pack is installed. 5. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination. 6. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/slave/stand-alone setting. Try removing all IDE devices except for hard disks. I hope this helps.

Hello Morgan, I noticed that two warning events happens priror to restarting w2k8 machine. (Btw, that machine is virtual machine). Those are about LSI_SCSI and storflt. Here is descriptio: Log Name: SystemSource: LSI_SCSIDate: 19.3.2008 18:29:26Event ID: 26Task Category: NoneLevel: WarningKeywords: ClassicUser: N/AComputer: EXBJNOD2.erste.hr Description:The driver has detected that device \Device\RaidPort0 has old or out-of-date firmware. Reduced performance may result. Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="LSI_SCSI" /> <EventID Qualifiers="32772">26</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2008-03-19T17:29:26.859Z" /> <EventRecordID>17775</EventRecordID> <Channel>System</Channel> <Computer>EXBJNOD2.erste.hr</Computer> <Security /> </System> <EventData> <Data>\Device\RaidPort0</Data> <Binary>0F00180001000000000000001A0004800000000000000000000000000000000000000000000000000000000000000000000000001A0004800000000000000000</Binary> </EventData></Event> and Log Name: SystemSource: storfltDate: 19.3.2008 18:29:27Event ID: 5Task Category: NoneLevel: WarningKeywords: ClassicUser: N/AComputer: EXBJNOD2.erste.hr Description:The Virtual Storage Filter Driver is disabled through the registry. It is inactive for all disk drives. Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="storflt" /> <EventID Qualifiers="32774">5</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2008-03-19T17:29:27.140Z" /> <EventRecordID>17778</EventRecordID> <Channel>System</Channel> <Computer>EXBJNOD2.erste.hr</Computer> <Security /> </System> <EventData> <Data> </Data> <Binary>00000000010000000000000005000680000000000000000000000000000000000000000000000000</Binary> </EventData></Event> Tnx.

One of my Windows 2008 EE x86 VM's did the exact same thing last night. I have two Windows 2008 guests running on a VMware ESX 3.5 server; one threw this error and crashed, the other did not. Both are using the LSI Logic SCSI disk driver.Has anyone else seen this behavior?

Has anyone found a resolution to this problem by any chance? I am running server 2k8 on an ESX 3.5 host and i'm experiencing this same issue (as well as terrible hard drive performance). I tried to update the raid driver on the client with no avail.

I would start with ensuring that you have applied the latest drivers for your devices. Out of date drivers are almost always the cause of these sorts of problems. If you are positive that you have the latest drivers installed, and you are still experiencing these problems, then I agree with Morgan than you should log a call with Microsoft. tgc

Hi all, is the problem already solved? I am running W2k8-Server on an ESX 3.5-Update1 host. Thank you, regards, Joachim

Driver faultTry to update all drivers at your Windows 2008 server and Update Operating SystemDo you use some removable device ot your server ?Here is the dump : kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ******************************************************************************** ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)An attempt was made to write to readonly memory. The guilty driver is on thestack trace (and is typically the current instruction pointer).When possible, the guilty driver's name (Unicode string) is printed onthe bugcheck screen and saved in KiBugCheckDriver.Arguments:Arg1: 000006427fb3f478, Virtual address for the attempted write.Arg2: 64d00000e1c9e025, PTE contents.Arg3: fffffa60051d4730, (reserved)Arg4: 000000000000000a, (reserved) Debugging Details:------------------ CUSTOMER_CRASH_COUNT: 2 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP BUGCHECK_STR: 0xBE PROCESS_NAME: Microsoft.Excha CURRENT_IRQL: 2 TRAP_FRAME: fffffa60051d4730 -- (.trap 0xfffffa60051d4730)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=00000000ff96f20c rbx=fffffa8000000aa8 rcx=00000000ff96f20drdx=fffffa80079fe010 rsi=0000000000000001 rdi=fffffa80075a5a40rip=fffffa6003510a0c rsp=fffffa60051d48c0 rbp=0000000000000000r8=fffffa8006d93ae2 r9=0000000000000002 r10=fffffa80079fe068r11=0000000000000001 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up ei ng nz na pe ncrdbss!RxCancelRoutine+0x44:fffffa60`03510a0c f00fb18bc8000000 lock cmpxchg dword ptr [rbx+0C8h],ecx ds:c1f0:fffffa80`00000b70=????????Resetting default scope LAST_CONTROL_TRANSFER: from fffff800016af28a to fffff800016a1390 STACK_TEXT: fffffa60`051d4638 fffff800`016af28a : 00000000`000000be 00000642`7fb3f478 64d00000`e1c9e025 fffffa60`051d4730 : nt!KeBugCheckExfffffa60`051d4640 fffff800`0169ff19 : 00000000`00000001 fffff800`016787f9 00000000`00000000 00000642`7fb3f3b0 : nt!MmAccessFault+0x28afffffa60`051d4730 fffffa60`03510a0c : fffffa60`013e0101 fffffa80`07626550 fffffa60`013df360 fffffa80`076c0011 : nt!KiPageFault+0x119fffffa60`051d48c0 fffff800`01653783 : fffffa80`079fe010 fffffa80`07624670 00000000`00000000 fffffa60`013e0011 : rdbss!RxCancelRoutine+0x44fffffa60`051d4900 fffff800`01708042 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IoCancelIrp+0x63fffffa60`051d4940 fffff800`01903e45 : fffffa80`00000001 fffffa80`06d93ae0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x27ce8fffffa60`051d49d0 fffff800`019222f1 : fffffa80`076245b0 fffff800`01781781 fffffa80`07c29f30 fffff800`017df160 : nt!IopCleanupProcessResources+0x25fffffa60`051d4a10 fffff800`0191f890 : 00000000`00000000 fffffa80`076245b0 fffff880`0510e8f0 00000000`00000000 : nt!IopCloseFile+0x251fffffa60`051d4aa0 fffff800`0191fc47 : fffff880`0510e8f0 fffffa80`00000001 fffffa80`06d93ae0 00000000`00000000 : nt!ObpDecrementHandleCount+0xc0fffffa60`051d4b30 fffff800`0191fe04 : fffff880`04e62510 fffff880`04e62500 00000000`00000001 00000000`00000a3c : nt!ObpCloseHandleTableEntry+0xb7fffffa60`051d4bd0 fffff800`016a0e33 : fffffa80`075a5a40 fffffa60`051d4ca0 00000000`1e77e570 00000000`00000000 : nt!ObpCloseHandle+0x94fffffa60`051d4c20 00000000`776f5b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x1300000000`1e77e248 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776f5b6a STACK_COMMAND: kb FOLLOWUP_IP: rdbss!RxCancelRoutine+44fffffa60`03510a0c f00fb18bc8000000 lock cmpxchg dword ptr [rbx+0C8h],ecx SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: rdbss!RxCancelRoutine+44 FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys DEBUG_FLR_IMAGE_TIMESTAMP: 479190bd FAILURE_BUCKET_ID: X64_0xBE_rdbss!RxCancelRoutine+44 BUCKET_ID: X64_0xBE_rdbss!RxCancelRoutine+44 Followup: MachineOwner

The only removable device is my DDS3-Tapedrive. But I dont use it in VMWare. I ve seen, there is an update (U2) for ESX-Server-3.5. This I will try. Thank you and regards, Joachim

I am seeing this issue after ESX 3.5 Update 2. It is a Server 2008 host with Sharepoint 2007 installed. Any help would be great.

We're seeing exactly the same issue - a Server 08 VM running on ESX 3.5 experiencing a crash in rdbss.sys. Has there been a resolution to this? If so, please share!Thanks -JB

Interesting. It looks like the same exact bugcheck can occurr on Hyper-V as well. Details are available at http://www.tutorials-win.com/WindowsServer/Windows-unexpected-109102/ . Has Microsoft root-caused this bug yet and is there a fix or workaround available?Thanks,Doug

I'm having the same problem here. VMWare request a 24 gb harddiskspace for a 64-bit 2008 server in there guest os guide. The diskspace on my resetting server is 20 GB and i have aextra sanlun attached with more space. Could that be the problem?

BUMP.. What procs are you are running? AMD or Intel? We are only experiencing this on our AMD esx server. http://support.microsoft.com/kb/956246 this link has a hotfix download for Vista but, doesn't include win2008 although...in the file information looks like file is the same for Vista and W2k8. Has anyone tried the Vista hotfix on W2k8? thanks, t For all supported 64-bit versions of Windows Server 2008 and of Windows Vista File name File version File size Date Time Platform Rdbss.sys 6.0.6001.22237 288,256 06-Aug-2008 01:24 x64

Vista and Windows Server 2008 share the same code base, so for this hot fix, you shouldn't have any problems as long as you select the right version of the download - x86, x64, IA64.tgc

Thanks Tim... wethought so...but, you would think that MS would be a little more clearer on the download page. We'll give it a try on Monday. Thanks for the reassurance. x64 it will be. Did you experience this problem and after applying the hotfix did it resolve the issue? tom

Same issue on a HyperV virtual running Win2008 x64 with an Exchange 2007 Client Access Server... anyone have any luck with the Vista x64 patch?rb

Robie,we applied the patches last Thursday - today is Monday:http://support.microsoft.com/kb/950772/ http://support.microsoft.com/kb/956246 and have had no bluescreens or crashes. We're running W2k8 x64 but, you apply the Vista patch - so we've been told. No issues yet. good luck

FYI, cross referencing this with the thread http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2virtualization/thread/2007eb67-191a-4576-813d-9ef6330e4b1a - in this thread, user dvdmchl continues having this issue after the application of those hotfixes. Unfortunately, I cannot corroborate this with my experience yet b/c when I follow the links for the kb, I get to an error screen "Hotfix Request The system is currently unavailable. Please try back later, or contact support if you want immediate assistance" </3 (^ my broken heart) perhaps those KBs have been outmoded with win2k8 Updates since October; so umbumb are you still seeing this issue ? I'm at the same place w/ seeing the win2k8 hyperv host crash frequently and fingering the rdbss.sys file. pritish.

Tried to apply both patches - received "this hotfix does not apply to your OS" error. Running Windows 2008 Server R2 x64 as host server and Windows 2008 Server x86 as VMware 2.0.2 server. VMware server is having the problems, not the host. Tried the appropriate patch for each OS - received error. Still having blue screen/reboot issues. Noticed the blue screen/reboot only happens when Windows Update tells me there are updates available for download/install. Turned off Windows Update automatically telling me and nothing has changed. Any help would be appreciated. Thx.