bsod many times with termserver

  • Thread starter Thread starter Keith Dowell
  • Start date Start date
K

Keith Dowell

ok heres a couple of dumps

1: kd> !analyze -v
***********************************************************
********************
*
*
* Bugcheck
Analysis *
*
*
***********************************************************
********************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely
invalid) address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 206461b9, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write
operation
Arg4: 80415026, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to read from 8047edb4
unable to read from 8047e864
unable to read from 8047e738
unable to read from 8046a85c
unable to read from 8047e750
unable to read from 8047e860
unable to read from 80471038
unable to read from 8047e8dc
unable to read from 8047ed80
206461b9

CURRENT_IRQL: 1c

FAULTING_IP:
nt!CcGetVirtualAddress+82
80415026 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 00000000 to 80468b6c

STACK_TEXT:
bb197a00 00000000 206461b9 0000001c 00000000 nt!
MiReserveSystemPtes+0x12c


FOLLOWUP_IP:
win32k!DrvProbeAndCaptureDevmode+31a
a00113a6 ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!DrvProbeAndCaptureDevmode+31a

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: fffffffe

STACK_COMMAND: kb

BUCKET_ID: 0xA_win32k!DrvProbeAndCaptureDevmode+31a

Followup: MachineOwner
---------



and another

0: kd> !analyze -v
***********************************************************
********************
*
*
* Bugcheck
Analysis *
*
*
***********************************************************
********************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely
invalid) address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000063, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write
operation
Arg4: 80415026, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to read from 8047edb4
unable to read from 8047e864
unable to read from 8047e738
unable to read from 8046a85c
unable to read from 8047e750
unable to read from 8047e860
unable to read from 80471038
unable to read from 8047e8dc
unable to read from 8047ed80
00000063

CURRENT_IRQL: 1c

FAULTING_IP:
nt!CcGetVirtualAddress+82
80415026 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 00000000 to 80468b6c

STACK_TEXT:
bddb7a3c 00000000 00000063 0000001c 00000000 nt!
MiReserveSystemPtes+0x12c


FOLLOWUP_IP:
win32k!DrvProbeAndCaptureDevmode+31a
a00113a6 ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!DrvProbeAndCaptureDevmode+31a

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3aa010b4

STACK_COMMAND: kb

BUCKET_ID: 0xA_win32k!DrvProbeAndCaptureDevmode+31a

Followup: MachineOwner
---------

and another from a while back

0: kd> !analyze -v
***********************************************************
********************
*
*
* Bugcheck
Analysis *
*
*
***********************************************************
********************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely
invalid) address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000063, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write
operation
Arg4: 80415026, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to read from 8047edb4
unable to read from 8047e864
unable to read from 8047e738
unable to read from 8046a85c
unable to read from 8047e750
unable to read from 8047e860
unable to read from 80471038
unable to read from 8047e8dc
unable to read from 8047ed80
00000063

CURRENT_IRQL: 1c

FAULTING_IP:
nt!CcGetVirtualAddress+82
80415026 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 00000000 to 80468b6c

STACK_TEXT:
bc672f20 00000000 00000063 0000001c 00000000 nt!
MiReserveSystemPtes+0x12c


FOLLOWUP_IP:
RDPWD!WD_Ioctl+136
bea6a06c ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: RDPWD!WD_Ioctl+136

MODULE_NAME: RDPWD

IMAGE_NAME: RDPWD.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3a66e4d0

STACK_COMMAND: kb

BUCKET_ID: 0xA_RDPWD!WD_Ioctl+136

Followup: MachineOwner
---------



now the question - do you see what seems common with these
crashes (I get 2-3 a day)

i.e. IRQ_NOT_LESS_OR_EQUAL
nt!MiReserveSystemPtes+0x12c
nt!CcGetVirtualAddress+82
CURRENT_IRQL: 1c
BUGCHECK_STR: 0xA


I have about 2-300 minidmps and no matter what module 2k
crapped out in, those things are always constant.

Now with those 5 above always remaining constant, no
matter what module, can anyone point me in the right
direction.

In other words, does this look like a memory problem (I
need to get some new sims), A hardware problem (I need a
new motherboard) or a driver problem (I will spend the
next two weeks updating drivers one by one and testing
possibly never solving this problem)

I sorta hope it's something like a memory problem. I have
searched deja and the knowledge base with those 5
constants as keywords and don't know which direction to
lean. Eaither I find nothing at all or nothing remotely
related to this problem.
 
IRQL_NOT_LESS_OR_EQUAL is typical of a bad driver,
unfortunately. Fortunately, a terminal server crashing
due to drivers is typical of a bad printer driver. If I
were you, I would remove all third party print drivers and
only use the printer drivers that came with the original
Windows 2000 disk. I would also edit the ntprint.inf file
to force your terminal server to use native print drivers
for printers that aren't supported. For instance, if you
have a LaserJet 4050, and those drivers didn't come
natively with the system, I would force the system to use
a LaserJet 4 driver instead, rather than loading an HP
4050 driver onto the terminal server.

-M
 
I agree, I found the following HP driver to be the cause of our BSOD on W2K TS various SPs with Citrix MetaFram "hpbfff2.dll" Check all of the printers installed on the TS and verify none of the drivers are using this dll as it will caused the server to crash after it is used approximately 13 times

Hope this helps,
Eric
 
Back
Top