Hello, I have one Windows 7 Pro 64bit system that has repeated BSODs when connected to a SMB share on a Ubuntu server. We have several other identical systems that do not experience this issue. By identical, I mean they were all loaded from the same WDS automated deployment, and they are the same hardware, Dell Optiplex 390. I have swapped the hard drive into another Optiplex 390 to eliminate the chance of hardware problems. The problem occurs when I am connected for a period of time to the SMB server, usually over night (I have come in the last two mornings to a BSOD), although it has also occurred when I have been using the system. It does not occur when I am actively using the SMB share, only when I have files opened on the share for a period of time. They are usually log files opened in a text editor or PowerGREP. The system is fully patched. I manage a campus network, and none of my staff who use the same system build and also access this SMB share have seen this issue. I'm ready to just open a case with support, but thought I would check here first. There are several posts describing similar issues, but none seem to apply to my situation. The SMB server is using AD authentication to a Windows 2008 domain. I have followed the advice in the following threads to no avail. http://answers.microsoft.com/en-us/windows/forum/windows_7-system/windows-7-pro-x64-rdbsssys-rdr-file-system-causes/c207b5af-1265-4fd1-9af6-516fb3a72059 http://www.sevenforums.com/crashes-debugging/29959-bsod-when-connected-linux-samba-share-2.html#post353759 This one suggests disabling 'require 128bit encryption' in the local policy, but it describes a problem connecting to the SMB share; I don't have this issue, it works just fine, at least until I get the BSOD. http://www.tomshardware.com/forum/75-63-windows-samba-issue I have seen more BSODs with this issue than any other since NT 3.51...

Hello, Please start by installing this hotfix as it contains the latest version of RDBSS.SYS driver: http://support.microsoft.com/kb/2647452 If this does not help, consider disabling all security softwares and updating your NIC card drivers. If the problem persists then use Microsoft Skydrive to upload dump files (c:\windows\minidump). Once done, post a link here. You can also contact Microsoft CSS for assistance. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Hello, Please start by installing this hotfix as it contains the latest version of RDBSS.SYS driver: http://support.microsoft.com/kb/2647452 If this does not help, consider disabling all security softwares and updating your NIC card drivers. If the problem persists then use Microsoft Skydrive to upload dump files (c:\windows\minidump). Once done, post a link here. You can also contact Microsoft CSS for assistance. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer Thanks, I have applied this hotfix and will report back.

Just when I thought the hotfix had resolved the issue, I got another BSOD. Dell released a new driver 02/15, so I have installed that today.

Updating the NIC driver (2012-02-15 driver from Dell.ca) did not help. Got another BSOD today. dump files are here, the latest one is after the driver update: https://skydrive.live.com/redir.aspx?cid=ea01e0abff4faeab&resid=EA01E0ABFF4FAEAB!113&parid=EA01E0ABFF4FAEAB!109&authkey=!AIJ0aQPrpXL3jsE

Just had another BSOD a few minutes later. I'm going to pull another Optiplex 390 off the shelf, as I can't work like this. I must say, this is shaking my confidence in Windows 7. So far we've seen more BSODs in 7 than any version of Windows since win95. This is the only instance of repeatable BSODs, but we have seen numerous random occurrences amongst the 75 Win7 PCs we have, certainly far more than we are accustomed to seeing with our 275 XP machines.

Any luck fixing this issue?

******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff8a012a55000, 0, fffff8800432992e, 0} Unable to load image mfehidk.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for mfehidk.sys *** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys Could not read faulting driver name Probably caused by : rdbss.sys ( rdbss!RxIsSpecialShare+46 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff8a012a55000, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff8800432992e, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d03100 fffff8a012a55000 FAULTING_IP: rdbss!RxIsSpecialShare+46 fffff880`0432992e 0fb702 movzx eax,word ptr [rdx] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: mcshield.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff880070329b0 -- (.trap 0xfffff880070329b0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=000000000000fffe rdx=fffff8a012a55000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8800432992e rsp=fffff88007032b40 rbp=fffff88007032bf0 r8=000000000000fe90 r9=0000000000000000 r10=0000000000000000 r11=fffff88003180180 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac pe cy rdbss!RxIsSpecialShare+0x46: fffff880`0432992e 0fb702 movzx eax,word ptr [rdx] ds:fffff8a0`12a55000=???? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002a7c9fc to fffff80002ad0c40 STACK_TEXT: fffff880`07032848 fffff800`02a7c9fc : 00000000`00000050 fffff8a0`12a55000 00000000`00000000 fffff880`070329b0 : nt!KeBugCheckEx fffff880`07032850 fffff800`02aced6e : 00000000`00000000 fffff8a0`12a55000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4611f fffff880`070329b0 fffff880`0432992e : fffffa80`00000000 00000000`00000001 00000000`00000003 fffff880`04315800 : nt!KiPageFault+0x16e fffff880`07032b40 fffff880`0431d42c : 00000000`00000000 fffffa80`05f57260 fffffa80`07d65010 fffffa80`05e92150 : rdbss!RxIsSpecialShare+0x46 fffff880`07032b90 fffff880`0431a237 : fffffa80`63457852 fffff880`07032d78 fffff880`04311110 fffffa80`03a30d80 : rdbss!RxFindOrConstructVirtualNetRoot+0x938 fffff880`07032d30 fffff880`0431ee9b : fffffa80`03a30d80 fffffa80`03a30d80 fffff880`07032e20 fffffa80`03a30d00 : rdbss!RxCanonicalizeNameAndObtainNetRoot+0x397 fffff880`07032dc0 fffff880`042fa69c : 00000000`00000000 fffffa80`03a30d80 fffffa80`03a30ee0 00000000`00000000 : rdbss!RxCommonCreate+0x2cb fffff880`07032e80 fffff880`04317b34 : fffffa80`03a30d80 fffffa80`0532c300 00000000`00000000 00000000`00000801 : rdbss!RxFsdCommonDispatch+0x870 fffff880`07032f70 fffff880`049e92cc : fffffa80`03a30d80 00000000`c0000016 fffffa80`03a30ee0 fffffa80`0532c310 : rdbss!RxFsdDispatch+0x224 fffff880`07032fe0 fffff880`0196f271 : fffffa80`052eeee0 fffffa80`03a30d80 fffffa80`0405d6b0 fffff8a0`0015d730 : mrxsmb!MRxSmbFsdDispatch+0xc0 fffff880`07033020 fffff880`0196d138 : fffff8a0`0015d730 fffffa80`052eeee0 00000000`00000001 fffffa80`0445df20 : mup!MupiCallUncProvider+0x161 fffff880`07033090 fffff880`0196e64b : 00000000`00000000 fffff880`070331c0 fffffa80`0405d6b0 00000000`00000000 : mup!MupStateMachine+0x128 fffff880`070330e0 fffff880`010a6bcf : 00000000`00000000 fffffa80`03a30d80 00000000`00000000 fffffa80`0405d6b0 : mup!MupCreate+0x2bf fffff880`07033170 fffff880`010c62b9 : fffffa80`03a30d80 fffffa80`04a15010 fffffa80`03a30d00 fffffa80`0489fb30 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`07033200 fffff880`019ae0ad : fffffa80`048a6820 fffff880`07033500 fffffa80`0445df20 00000000`00000000 : fltmgr!FltpCreate+0x2a9 fffff880`070332b0 fffffa80`048a6820 : fffff880`07033500 fffffa80`0445df20 00000000`00000000 fffffa80`07cd8880 : mfehidk+0x350ad fffff880`070332b8 fffff880`07033500 : fffffa80`0445df20 00000000`00000000 fffffa80`07cd8880 fffffa80`07cd8920 : 0xfffffa80`048a6820 fffff880`070332c0 fffffa80`0445df20 : 00000000`00000000 fffffa80`07cd8880 fffffa80`07cd8920 00000000`07060000 : 0xfffff880`07033500 fffff880`070332c8 00000000`00000000 : fffffa80`07cd8880 fffffa80`07cd8920 00000000`07060000 fffff880`070332e8 : 0xfffffa80`0445df20 STACK_COMMAND: kb FOLLOWUP_IP: rdbss!RxIsSpecialShare+46 fffff880`0432992e 0fb702 movzx eax,word ptr [rdx] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: rdbss!RxIsSpecialShare+46 FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ecb1a52 FAILURE_BUCKET_ID: X64_0x50_rdbss!RxIsSpecialShare+46 BUCKET_ID: X64_0x50_rdbss!RxIsSpecialShare+46 Followup: MachineOwner --------- ---------------------------------------------- I think that mfehidk.sys is the cause of your issue. More about it: http://www.file.net/process/mfehidk.sys.html Disable this McCafee security module and check results. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer