RDR_FILE_SYSTEM CSC.sys Blue Screen with Offline Files & Folder Redirection GPO
Hello all.
Due to a server change I had to redirect all users documents and desktop to a location on a new server. Redirection was already enabled but I changed the policy to the following and enabled offline files for all users.
Allow or Disallow use of the Offline Files feature > Enabled
Prohibit user configuration of Offline Files > Enabled
Setting: Basic (Redirect everyone's folder to the same location) > Path: \\newserver\Desktop\%USERNAME%\Desktop
Grant user exclusive rights to Desktop > Enabled
Move the contents of Desktop to the new location > Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems > Enabled
Policy Removal Behavior > Leave contents
Setting: Basic (Redirect everyone's folder to the same location) > Path: \\newserver\Documents\%USERNAME%\My Documents
Grant user exclusive rights to Documents > Enabled
Move the contents of Documents to the new location > Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems > Enabled
Policy Removal Behavior > Leave contents
Now, on LOTS of my Windows 7 Professional machines I am getting the error above. RDR_FILE_SYSTEM blue screen mentioning CSC.sys.
I have already tried the hotfix Windows6.1-KB981109-x86 even though it didnt completely describe my problem, and sure enough it didnt help.
Can anybody suggest what I should do to fix the issue? Have tried disabling the folder redirection & offline files policy, but that has no effect. Was thinking about disabling the offline files part of the policy for all users but thought I would ask
here first.
Thanks in advance!
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0073
Arg2: 966973d8
Arg3: 96696fb0
Arg4: 8d20f2ab
Debugging Details:
------------------
EXCEPTION_RECORD: 966973d8 -- (.exr 0xffffffff966973d8)
ExceptionAddress: 8d20f2ab (csc!CscEnpMainAcquireShared+0x00000036)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000040
Attempt to read from address 00000040
CONTEXT: 96696fb0 -- (.cxr 0xffffffff96696fb0)
eax=8d22f340 ebx=9669752c ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=8d20f2ab esp=966974a0 ebp=966974a8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
csc!CscEnpMainAcquireShared+0x36:
8d20f2ab ff7640 push dword ptr [esi+40h] ds:0023:00000040=????????
Resetting default scope
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000040
READ_ADDRESS: 00000040
FOLLOWUP_IP:
csc!CscEnpMainAcquireShared+36
8d20f2ab ff7640 push dword ptr [esi+40h]
FAULTING_IP:
csc!CscEnpMainAcquireShared+36
8d20f2ab ff7640 push dword ptr [esi+40h]
BUGCHECK_STR: 0x27
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 8d237675 to 8d20f2ab
STACK_TEXT:
966974a8 8d237675 00000000 00000000 8d22e000 csc!CscEnpMainAcquireShared+0x36
966974c8 8d20f1ff 00000000 00000000 9669752c csc!CscEnQueryInformationEntry+0xbf
966974fc 8d24ad20 00000000 00000000 9669752c csc!CscStoreQueryInformationEntryEx+0x9e
96697690 8d2308ee 8664d008 96697760 001cf9ec csc!CscBackPatchObject+0x1f6
96697784 8b974bfb 8664d008 bb3c9008 8664d008 csc!CscCreate+0x8e9
966977b0 8b9752d8 0164d008 015c1ba8 bb3c9008 rdbss!RxCollapseOrCreateSrvOpen+0x44e
96697848 8b973920 8664d008 865c1ba8 96697868 rdbss!RxCreateFromNetRoot+0x478
9669787c 8b95afb1 00000000 865c1ba8 1dffccbb rdbss!RxCommonCreate+0x2ae
96697904 8b975e2b 8b96b240 865c1ba8 84aa3c48 rdbss!RxFsdCommonDispatch+0x646
96697934 90edd298 86451a68 005c1ba8 865c1c60 rdbss!RxFsdDispatch+0x1ab
96697950 8288d4bc 86451a68 015c1ba8 865c1c84 mrxsmb!MRxSmbFsdDispatch+0x9a
96697968 88536bb0 00000103 84966110 84aa3c48 nt!IofCallDriver+0x63
96697984 88535b52 84966110 c0000016 865c1c60 mup!MupiCallUncProvider+0x10f
9669799c 88535f5b 84966110 1e3a3977 00000000 mup!MupStateMachine+0x9b
966979e8 8288d4bc 85515030 865c1ba8 865c1ba8 mup!MupCreate+0x109
96697a00 82fc020c 865c1ba8 00000000 865c1c84 nt!IofCallDriver+0x63
96697a24 82fd38c9 96697a44 85515578 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
96697a70 8288d4bc 85515578 85546008 84aa3ca4 fltmgr!FltpCreate+0x2db
96697a88 82a916ad b1ecf59a 96697c30 00000000 nt!IofCallDriver+0x63
96697b60 82a7226b 85515030 857e3eb0 8486c880 nt!IopParseDevice+0xed7
96697bdc 82a982d9 00000000 96697c30 00000040 nt!ObpLookupObjectName+0x4fa
96697c38 82a9062b 0176f844 847e3eb0 00002301 nt!ObOpenObjectByName+0x165
96697cb4 82a9bf42 0176f9dc 00100081 0176f844 nt!IopCreateFile+0x673
96697d00 8289444a 0176f9dc 00100081 0176f844 nt!NtCreateFile+0x34
96697d00 775e64f4 0176f9dc 00100081 0176f844 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0176f8a8 00000000 00000000 00000000 00000000 0x775e64f4
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: csc!CscEnpMainAcquireShared+36
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: csc
IMAGE_NAME: csc.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4b907982
STACK_COMMAND: .cxr 0xffffffff96696fb0 ; kb
FAILURE_BUCKET_ID: 0x27_csc!CscEnpMainAcquireShared+36
BUCKET_ID: 0x27_csc!CscEnpMainAcquireShared+36
Followup: MachineOwner
---------
August 26th, 2010 12:18pm
Hi,
please request this hotfix:
"0x00000027" Stop error when you try to log on a client computer that is running Windows 7 or Windows Server 2008 R2
Click on the link "View and request hotfix downloads ", select the platform (x86 or x64) and type in your email twice and type in the captcha ad click request hotfix.
After 1 minute you have an email with the link to download an exe. Use the password which is included inside the email to extract the update.
Install the update and reboot, now the issue is fixed.
best regards
André"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
Free Windows Admin Tool Kit Click here and download it now
August 26th, 2010 2:57pm
Thanks, but as I mentioned above I have already tried that hotfix and it did not work.
'You enable the client-side caching (CSC) feature and the Encrypt the offline files cache Group Policy setting.' - I have not enabled the encryption.
I configured a GPO after posting this to disable offline files for all users who are blue screening which seems to have worked round the issue, but this is not a fix as some of these mcahines are laptops and require offine files to be enabled.
I have dumps etc if required.
Thanks for your help.
August 26th, 2010 3:51pm
This part could be the problem:
Move the contents of Desktop to the new location > Enabled
We had a similar
issue when we moved servers, and found it easiest to not move the contents, and just have users do a full sync before we add them to the GPO, and then full sync again after the gpo is applied.
We had users that had well over 10GB of offline files, and moving the csc contents was a horrible idea, that well... did not work very well :) as some users took over 4 hours to login :)
At that point we decided to stop testing and remove the move contents policy.
We split our users into manageable groups (migrated, notmigrated), placed everyone in the notmigrated group, and then used per group document redirection. The notmigrated group was still associated with the old server, and migrated was the
new server. We had 10-15 users at a time complete a full sync, then log off, then we moved their files to the new server, and then we moved them to the new GPO. had them restart their machines twice without logging in, and then they logged
in. After they logged in all their files where in the correct location, and were then able to do a full sync again (some took a while).
sorry - wordy...
-Dan
Free Windows Admin Tool Kit Click here and download it now
August 26th, 2010 4:31pm
In hidsight you are very much correct. Quite a few users took nearly an hour to log in, but its mostly done now so cant be undone.
The Windows 7 users in question who are having the blue screen problems (at least the ones I have had time to check) have all migrated successfully to the new server. Their old redirected folders are empty now.
It really seems to be something to do with the offline files policies:
Allow or Disallow use of the Offline Files feature > Enabled
Prohibit user configuration of Offline Files > Enabled
I have disabled both of the above for users having the problem and the blue screens no longer happen but this is in no way an acceptable fix.
I guess I should disable those one at a time to test further, but in a production environment with no Windows 7 test machines this will proove hard. Guess I will just need to nicely ask somebody to be my guinea pig!
August 26th, 2010 4:54pm
Hi
In this case contact the MS support directly:
http://support.microsoft.com/gethelp/default.aspx?content=ph;en-us;14019
I have no idea how we (this is a users are helping users forum) can help you with this issue. This can only be done by Microsoft.
André"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
Free Windows Admin Tool Kit Click here and download it now
August 26th, 2010 6:26pm
Couldnt convince the boss to pay £200 so no idea what the problem is... although disabling the offline files GPO setting for the effected users fixed the problem.
How a 'contact Microsoft' answer can be marked as the correct answer by a MSFT mod without even an official comment is beyond me, but ok.
Im tempted to try the SP1 beta to see if that fixes the issue. I will post back if I do.
August 30th, 2010 6:09pm
Im tempted to try the SP1 beta to see if that fixes the issue. I will post back if I do.
Microsoft can only fix what they know. "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
Free Windows Admin Tool Kit Click here and download it now
August 30th, 2010 11:48pm
Couldnt convince the boss to pay £200 so no idea what the problem is... although disabling the offline files GPO setting for the effected users fixed the problem.
How a 'contact Microsoft' answer can be marked as the correct answer by a MSFT mod without even an official comment is beyond me, but ok.
Im tempted to try the SP1 beta to see if that fixes the issue. I will post back if I do.
Just remember you dont pay anything if its a bug, or can not be resolved.
I have called MS support over 20 times and never paid a dime, because they were bugs, and could not be resolved at the current time... But soon a patch came out to fix the problem. I am not sure if I was part of that process, but I am sure it
didnt hurt.
-Dan
August 31st, 2010 12:51am