Troubleshooting Memory Dump

  • Upload
    krana26

  • View
    249

  • Download
    0

Embed Size (px)

Citation preview

  • 8/12/2019 Troubleshooting Memory Dump

    1/54

    C H A P T E R 1 0

    When a computer running MicrosoftWindows Serer!"00# detects an une$pected pro%&em

    from which it cannot recoer' a Stop error occurs( A Stop error seres to protect the integrit) ofthe s)stem %) immediate&) stopping a&& processing( A&though it is theoretica&&) possi%&e for

    Windows Serer "00# to continue functioning when it detects that a core component has

    e$perienced a serious pro%&em' the integrit) of the s)stem wou&d %e *uestiona%&e' which cou&d

    &ead to securit) io&ations' s)stem corruption' and ina&id transaction processing( When a Stop

    error occurs' Windows Serer "00# disp&a)s a Stop message' sometimes referred to as a +%&ue

    screen', which is a te$t-mode error message that reports information a%out the condition( A %asic

    understanding of Stop errors and their under&)ing causes improes )our a%i&it) to &ocate and

    understand technica& information or perform diagnostic procedures re*uested of )ou %) technica&

    support personne&(

    In This Chapter

    Stop Errors Overview.............................................................................................3

    Memory Dump Files...............................................................................................8

    Stop Errors Recorded in the System Log.............................................................1

    !eing "rep#red $or Stop Errors............................................................................%&

    'ommon Stop Mess#ges......................................................................................%%

    (ddition#l Resources...........................................................................................)%

    *rou+leshooting StopErrors

  • 8/12/2019 Troubleshooting Memory Dump

    2/54

    % Chapter 10 Troubleshooting Stop Errors

    The information contained in this document represents the current

    view of Microsoft Corporation on the issues discussed as of thedate of publication. Because Microsoft must respond to changingmarket conditions, it should not be interpreted to be a commitmenton the part of Microsoft, and Microsoft cannot guarantee theaccuracy of any information presented after the date of publication.

    This document is for informational purposes only. MICR!"TM#$%! & '#RR#&TI%!, %()R%!! R IM)*I%+, #! T T%I&"RM#TI& I& TI! +C-M%&T.

    Complying with all applicable copyright laws is the responsibility ofthe user. 'ithout limiting the rights under copyright, no part of thisdocument may be reproduced, stored in or introduced into aretrieval system, or transmitted in any form or by any meanselectronic, mechanical, photocopying, recording, or otherwise/, orfor any purpose, without the e0press written permission of MicrosoftCorporation.

    Microsoft may have patents, patent applications, trademarks,copyrights, or other intellectual property rights covering sub1ectmatter in this document. %0cept as e0pressly provided in anywritten license agreement from Microsoft, the furnishing of thisdocument does not give you any license to these patents,trademarks, copyrights, or other intellectual property.

    23445 Microsoft Corporation. #ll rights reserved.

    Microsoft, 'indows, 'indows !erver3445, and the 'indows logoare either registered trademarks or trademarks of MicrosoftCorporation in the -nited !tates and6or other countries.

    The names of actual companies and products mentioned hereinmay be the trademarks of their respective owners.

  • 8/12/2019 Troubleshooting Memory Dump

    3/54

    Common Stop Mess#ges 3

    Stop Errors OverviewStop errors on&) occur when a pro%&em cannot %e hand&ed %) using the higher-&ee& error-

    hand&ing mechanisms in the MicrosoftWindows Serer!"00# operating s)stem( .orma&&)'

    when an error occurs in an app&ication' the app&ication interprets the error message and proides

    detai&ed information to the s)stem administrator( Howeer' Stop errors are hand&ed %) the /erne&'

    and Windows Serer "00# is on&) a%&e to disp&a) %asic information a%out the error' write the

    contents of memor) to the dis/ if memor) dumps are ena%&ed' and ha&t the s)stem( This %asic

    information' /nown as a Stop message' is descri%ed in more detai& in +Stop Messages, in this

    chapter(

    As a resu&t of the minima& information proided in a Stop message' and the fact that the operating

    s)stem stops a&& processing' Stop errors can %e difficu&t to trou%&eshoot( 2ortunate&)' the) tend to

    occur er) rare&)( When the) do occur' the) are a&most a&wa)s caused %) drier pro%&ems'hardware pro%&ems' or fi&e inconsistencies(

    Identifying the Stop Error

    There are man) different t)pes of Stop errors( Each has its own possi%&e causes and re*uires a

    uni*ue trou%&eshooting process( Therefore' the first step in trou%&eshooting a Stop error is to

    identif) the Stop error( 3ou need the fo&&owing information a%out the Stop error to %egin

    trou%&eshooting4

    Stop error number. This num%er uni*ue&) identifies the Stop error(

    Stop error parameters. These parameters proide additiona& information a%out the

    Stop error( Their meaning is specific to the Stop error num%er(

    Driver information. When aai&a%&e' the drier information identifies the most&i/e&) source of the pro%&em(

    This information is often disp&a)ed as part of the Stop message( 5f possi%&e' write it down to use

    as a reference during the trou%&eshooting process( 5f the operating s)stem restarts %efore )ou can

    write down the information' )ou can often retriee the information from the S)stem &og in Eent

    6iewer( 2or more information' see +Stop Errors Recorded in the S)stem 7og, &ater in this

    chapter(

    5f )ou are una%&e to gather the Stop error num%er from the Stop message and the S)stem &og' )ou

    can retriee it from a memor) dump fi&e( 8) defau&t' Windows Serer "00# is configured to

    create a memor) dump wheneer a Stop error occurs( 5f no memor) dump fi&e was created'

    configure the s)stem to create a memor) dump fi&e( Then' if the Stop error reoccurs' )ou wi&& %e

    a%&e to e$tract the necessar) information from the memor) dump fi&e( 2or information a%out

    using dump fi&es' see +Memor) 9ump 2i&es, &ater in this chapter(2igure 10(1 i&&ustrates the process of identif)ing the Stop error information needed for further

    trou%&eshooting(

  • 8/12/2019 Troubleshooting Memory Dump

    4/54

    , Chapter 10 Troubleshooting Stop Errors

    Figure 1&.1 -denti$ying the Stop Error

    Finding Troubleshooting Information

    Each Stop error re*uires a different trou%&eshooting techni*ue( Therefore' after )ou identif) the

    Stop error and gather the associated information' search the fo&&owing sources for

    trou%&eshooting information specific to that Stop error4

    +Common Stop Messages, &ater in this chapter

    Microsoft 9e%ugging Too&s for Windows He&p

    Microsoft :now&edge 8ase

    2igure 10(" shows the process for identif)ing detai&ed trou%&eshooting information specific to

    )our Stop error' after )ou hae identified the Stop message num%er and parameters(

  • 8/12/2019 Troubleshooting Memory Dump

    5/54

    Common Stop Mess#ges )

    Figure 1&.% Finding Stop ErrorSpeci$ic *rou+leshooting -n$orm#tion

    +Common Stop Messages, &ater in this chapter is intended as a reference for trou%&eshooting

    Stop errors; howeer' it does not inc&ude eer) possi%&e Stop error( 5f the Stop error num%er )ou

    are trou%&eshooting is not &isted in +Common Stop Messages', refer to the 9e%ugging Too&s for

    Windows He&p( 2ina&&)' the Microsoft :now&edge 8ase inc&udes time&) artic&es a%out a &imited

  • 8/12/2019 Troubleshooting Memory Dump

    6/54

    / Chapter 10 Troubleshooting Stop Errors

    su%set of Stop errors( Stop error information in the Microsoft :now&edge 8ase is often specific

    to a particu&ar drier or hardware component' and genera&&) inc&udes step-%)-step instructions for

    reso&ing the pro%&em( A&though it is rare&) necessar)' )ou can a&so consu&t Microsoft ProductSupport Serices for trou%&eshooting serices to reso&e Stop errors(

    Microsoft Knowledge ase

    2or re&ated information' see the Microsoft :now&edge 8ase &in/ on the We% Resources pageat

    http4

  • 8/12/2019 Troubleshooting Memory Dump

    7/54

    Common Stop Mess#ges 0

    Figure 1&.3 Stop Mess#ge

  • 8/12/2019 Troubleshooting Memory Dump

    8/54

    8 Chapter 10 Troubleshooting Stop Errors

    As shown in 2igure 10(#' a Stop message screen has four ma=or sections' which disp&a) the

    fo&&owing information4

    Recommended user action

    Technica& information

    9rier information

    9e%ug port and dump status information

  • 8/12/2019 Troubleshooting Memory Dump

    9/54

    Common Stop Mess#ges

    %ecommended user action

    The Recommended user action section informs the user that a pro%&em has occurred and that

    Windows was shut down( 5t a&so proides the s)m%o&ic name of the Stop error( 5n 2igure 10(#'

    the s)m%o&ic name is 9R56ER>5R?7>.@T>7ESS>@R>E?A7( 5t a&so attempts to descri%e

    the pro%&em and &ists suggestions for recoer)( 5n some cases' restarting the computer might %e

    sufficient %ecause the pro%&em is not &i/e&) to recur( 8ut if the Stop error persists after )ou restart

    the operating s)stem' )ou must determine the root cause to return the operating s)stem to an

    opera%&e state( This process might ino&e undoing recent changes' rep&acing hardware' or

    updating driers to e&iminate the source of the pro%&em( 5f )ou hae ena%&ed Emergenc)

    Management Serices' )ou can restart and trou%&eshoot )our computer remote&)(

    Technical information

    The Technica& informationsection &ists the Stop error num%er as the first parameter' fo&&owed %)

    up to four Stop error-specific codes disp&a)ed as he$adecima& num%ers enc&osed in parentheses'

    which identif) re&ated parameters( Stop message codes contain a +0$, prefi$' which indicates that

    the num%er is in he$adecima& format( 2or e$amp&e' in 2igure 10(#' the Stop error he$adecima&

    code is 0$00000091 often written as 0$91(

    !river information

    The 9rier information section identifies the drier associated with the Stop error( 5f a fi&e is

    specified %) name' )ou can use Recoer) Conso&e or Safe Mode to erif) that the drier is

    signed or has a date stamp that coincides with other driers( 5f necessar)' )ou can rep&ace the fi&e

    manua&&) in Recoer) Conso&e or in Safe Mode' or use Ro&& 8ac/ 9rier to reert to a preious

    ersion(!ebug port and dump status information

    The 9e%ug port and dump status information section &ists C@M port parameters that a /erne&

    de%ugger uses' if ena%&ed( 5f )ou hae ena%&ed memor) dump fi&e saes' this section a&so

    indicates whether one was successfu&&) written( As a dump fi&e is %eing written to the dis/' the

    percentage shown after Dumping physical memory to diskis incremented to 100( A a&ue of

    100 indicates that the memor) dump was successfu&&) saed(

    2or more information a%out insta&&ing and using /erne& de%uggers' see +sing S)m%o& 2i&es and

    9e%uggers, &ater in this chapter(

    Memory !ump FilesWhen a Stop error occurs' Windows Serer "00# disp&a)s information that can he&p )ou ana&)Bethe root cause of the pro%&em( Windows Serer "00# writes the information to the paging fi&e

    Pagefi&e(s)s on thesystemdriveroot %) defau&t( When )ou restart the computer in Start

    Windows .orma&&) mode common&) ca&&ed +norma& mode, or Safe Mode after a Stop error

    oteIf the video display drivers have stopped functioning, the kernel might not

    be able to fully display all the Stop message contents; in such a case,

    only the first line ill be visible!

  • 8/12/2019 Troubleshooting Memory Dump

    10/54

    1& Chapter 10 Troubleshooting Stop Errors

    occurs' Windows Serer "00# uses the paging fi&e information to create a memor) dump fi&e in

    thesystemrootorsystemrootMinidump fo&der( Ana&)Bing dump fi&es can proide more

    information a%out the root cause of a pro%&em and &ets )ou perform off&ine ana&)sis %) runningana&)sis too&s on another computer(

    Configuring Memory !ump Files3ou can configure )our s)stem to generate one of three different t)pes of dump fi&es4

    Small memory dump files.Sometimes referred to as +mini, dump fi&es' these dump

    fi&es contain the &east information( Sma&& memor) dump fi&es can %e written to dis/

    *uic/&)' which minimiBes serer downtime %) a&&owing the operating s)stem to

    restart sooner(

    Kernel memory dump files.Records the contents of /erne& memor)( :erne&

    memor) dump fi&es re*uire a &arger paging fi&e on the %oot deice than sma&& memor)dump fi&es and ta/e &onger to create when a fai&ure has occurred( Howeer' the)

    record significant&) more information and are more usefu& when )ou need to perform

    in-depth ana&)sis(

    Complete memory dump files.Records the entire contents of ph)sica& memor)

    when the Stop error occurred( A comp&ete memor) dump fi&eDs siBe wi&& %e s&ight&)

    &arger than the amount of ph)sica& memor) insta&&ed at the time of the error( This

    option is not aai&a%&e for computers with more than " giga%)tes 8 of RAM(

    8) defau&t' Windows Serer "00# is configured to create comp&ete memor) dump fi&es( 3ou can

    change the &ocations of the dump fi&es %) using System in Contro& Pane&( 8) defau&t' sma&&

    memor) dump fi&es are saed in thesystemrootMinidump fo&der' and /erne& and comp&ete

    memor) dump fi&es are saed to a fi&e namedsystemrootMemor)(dmp(

    Serers that use Ph)sica& Address E$tensions PAE can create on&) sma&& and /erne& memor)

    dump fi&es( PAE ena%&es $FG-%ased computers running Windows Serer "00#' Enterprise Edition

    to access up to #" 8 of memor) %) using the

  • 8/12/2019 Troubleshooting Memory Dump

    11/54

    Common Stop Mess#ges 11

    information a%out the Error Reporting Serice' see +sing Memor) 9ump 2i&es to Ana&)Be Stop

    Errors, &ater in this chapter(

    A sma&& memor) dump fi&e records the sma&&est set of information that might identif) the cause

    of the s)stem stopping une$pected&)( 2or e$amp&e' the sma&& memor) dump inc&udes some of the

    fo&&owing information4

    Stop message information.5nc&udes the error num%er and additiona& parameters that

    descri%e the Stop error(

    A list of drivers running on the system.5dentifies the modu&es in memor) when the

    Stop error occurred( This deice drier information inc&udes the fi&e name' date'

    ersion' siBe' and manufacturer(

    Processor contet information for the process that stopped.5nc&udes the

    processor and hardware state' performance counters' mu&tiprocessor pac/et

    information' deferred procedure ca&& information' and interrupts(

    Kernel contet information for the process that stopped.5nc&udes offset of the

    director) ta%&e and the page frame num%er data%ase' which descri%es the state of

    eer) ph)sica& page in memor)(

    Kernel contet information for the thread that stopped.5dentifies registers and

    interrupt re*uest &ee&s' and inc&udes pointers to operating s)stem data structures(

    Kernel!mode call stack information for the thread that stopped.Consists of a

    series of memor) &ocations' and inc&udes a pointer to the initia& &ocation(

    A sma&& memor) dump fi&e re*uires a paging fi&e of at &east " M8 on the %oot o&ume( The

    operating s)stem saes each dump fi&e with a uni*ue fi&e name eer) time a Stop error occurs(

    The fi&e name inc&udes the date the Stop error occurred( 2or e$amp&e' Mini01100#-0"(dmp is the

    second sma&& memor) dump generated on Ianuar) 10' "00#(

    Sma&& memor) dump fi&es are usefu& when space is &imited or when )ou are using a s&owconnection to send information to technica& support personne&( 8ecause of the &imited amount of

    information that can %e inc&uded' these dump fi&es do not inc&ude errors that were not direct&)

    caused %) the thread that was running when the pro%&em occurred(

    To configure "indows Server &''( to generate only a small memory dump file

    )* 5n Contro& Pane&' dou%&e-c&ic/ System' and then c&ic/ the Advancedta%(

    &* nder Startup and "ecovery' c&ic/ Settings(

    (* 5n the #rite debugging information &ist' c&ic/ Small memory dump(

    +* C&ic/ $Ktwice' and then restart the operating s)stem if prompted(

    8) defau&t' Windows Serer "00# saes sma&& memor) dump fi&es to thesystemrootMinidump

    fo&der( 3ou can change the fo&der &ocation %) t)ping a new path in the Small dump directory%o$ under the #rite debugging information&ist(

  • 8/12/2019 Troubleshooting Memory Dump

    12/54

    1% Chapter 10 Troubleshooting Stop Errors

    Configuring Kernel Memory !ump Files8) defau&t' Windows Serer "00# s)stems create /erne& memor) dump fi&es( The /erne& memor)

    dump fi&e is an intermediate-siBe dump fi&e that records on&) /erne& memor) and can occup)

    seera& mega%)tes M8 of dis/ space( :erne& memor) dumps ta/e &onger to create than a sma&&

    dump fi&e' and thus increase the downtime associated with a s)stem fai&ure( @n most s)stems' the

    increase in downtime is minima&( :erne& memor) dumps contain additiona& information that

    might assist trou%&eshooting the pro%&em( When a Stop error occurs' Windows Serer "00# saes

    a /erne& memor) dump fi&e to a fi&e namedsystemrootMemor)(dmp and creates a sma&& memor)dump fi&e in thesystemrootMinidump fo&der(

    A /erne& memor) dump fi&e records on&) /erne& memor) information' which e$pedites the dump

    fi&e creation process( The /erne& memor) dump fi&e does not inc&ude una&&ocated memor) or an)

    memor) a&&ocated to user-mode programs( 5t inc&udes on&) memor) a&&ocated to the E$ecutie'

    /erne&' hardware a%straction &a)er HA7' and fi&e s)stem cache' in addition to nonpaged poo&

    memor) a&&ocated to /erne&-mode driers and other /erne&-mode routines(

    The siBe of the memor) dump fi&e wi&& ar)' %ut is a&wa)s &ess than the siBe of the s)stem

    memor)( When Windows Serer "00# creates the dump fi&e' it first writes the information to the

    paging fi&e( Therefore' the paging fi&e might grow to the siBe of the ph)sica& memor)( 7ater' the

    dump fi&e information is e$tracted from the paging fi&e to the actua& memor) dump fi&e( To

    ensure that )ou hae sufficient free space' erif) that the s)stem drie wou&d hae free space

    greater than the siBe of ph)sica& memor) if the paging fi&e were e$tended to the siBe of ph)sica&memor)(

    2or most purposes' a /erne& memor) dump fi&e is sufficient for trou%&eshooting Stop errors( 5t

    contains more information than a sma&& memor) dump fi&e and is sma&&er than a comp&ete

    memor) dump fi&e( 5t omits those portions of memor) that are un&i/e&) to hae %een ino&ed in

    the pro%&em( Howeer' there are pro%&ems that re*uire a comp&ete memor) dump for

    trou%&eshooting( 5f )ou hae configured a /erne& memor) dump and )ou e$perience a Stop error

    that re*uires a comp&ete memor) dump to iso&ate the pro%&em' )ou must specif) that the

    operating s)stem generate a comp&ete memor) dump and reproduce the Stop error to continue

    trou%&eshooting(

    To configure "indows Server &''( to generate a ,ernel memory dump file

    )* 5nContro& Pane&%dou%&e-c&ic/ System' and then c&ic/ the Advancedta%(

    &* nder Startup and "ecovery' c&ic/ Settings(

    (* 5n the #rite debugging information&ist' c&ic/ Kernel memory dump(

    +* C&ic/ $Ktwice' and then restart the operating s)stem if prompted(

    ote"hen debugging "indos Server #00$, it is useful to kno the memory

    range the kernel occupies to identify components that run ithin that

    space! %n $#&bit systems, the kernel occupies memory from

    0'(0000000 to 0'))))))))! %n *+&bit systems, the kernel occupies

    0'*)C0000000000000 to 0'))))))))00000000!

  • 8/12/2019 Troubleshooting Memory Dump

    13/54

    Common Stop Mess#ges 13

    8) defau&t' Windows Serer "00# saes a /erne& memor) dump fi&e tosystemrootMemor)(dmp(

    3ou can change the defau&t output &ocation %) t)ping a new a&ue in the Dump file%o$ under the

    #rite debugging information&ist(

    Configuring Complete Memory !ump FilesA comp&ete memor) dump fi&e' sometimes referred to as a +fu&&, dump fi&e' contains eer)thing

    that was in ph)sica& memor) when the Stop error occurred( This inc&udes a&& of the information

    inc&uded in a /erne& memor) dump fi&e' p&us user-mode memor)( Therefore' comp&ete memor)dump fi&es can %e e$amined to reea& the contents of memor) contained within app&ications'

    a&though this is rare&) necessar) or feasi%&e when trou%&eshooting app&ication pro%&ems(

    5f )ou choose to use comp&ete memor) dump fi&es' )ou must hae aai&a%&e space on the

    systemdrivepartition &arge enough to ho&d the contents of the ph)sica& RAM( Additiona&&)' )ou

    must hae a paging fi&e e*ua& to the siBe of )our ph)sica& RAM( Comp&ete memor) dump fi&es

    for 5tanium-%ased s)stems t)pica&&) re*uire more dis/ space than comp&ete dump fi&es for $FG-

    %ased s)stems( 2or information a%out iewing the paging fi&e siBe' see +Ensuring 9ump 2i&e

    Saes, &ater in this chapter(

    When a Stop error occurs' the operating s)stem saes a comp&ete memor) dump fi&e to a fi&e

    namedsystemrootMemor)(dmp and creates a sma&& memor) dump fi&e in the

    systemrootMinidump fo&der( A Microsoft technica& support engineer might as/ )ou to change

    this setting to faci&itate data up&oads oer s&ow connections( 9epending on the speed of )our5nternet connection' up&oading the data might not %e practica& and )ou might %e re*uested to

    proide the memor) dump fi&e on remoa%&e media(

    To configure "indows Server &''( to generate a complete memory dump file

    )* 5n Contro& Pane&' dou%&e-c&ic/ System' and then c&ic/ the Advancedta%(

    &* nder Startup and "ecovery' c&ic/ Settings(

    (* 5n the #rite debugging information&ist' c&ic/ Complete memory dump(

    +* C&ic/ $Ktwice' and then restart the operating s)stem if prompted(

    8) defau&t' Windows Serer "00# saes a comp&ete memor) dump fi&e to

    systemrootMemor)(dmp( 3ou can change the defau&t &ocation %) t)ping in a new path in the

    Dump file%o$ of the #rite debugging information &ist(

    otey default, a ne kernel memory dump file overrites an e'isting one!

    To change the default setting, clear the Overwrite #ny e2isting $ilecheck bo'. -ou can also archive or move an e'isting dump file toanother location prior to troubleshooting!

  • 8/12/2019 Troubleshooting Memory Dump

    14/54

    1, Chapter 10 Troubleshooting Stop Errors

    Ensuring !ump File SavesTo he&p ensure that )our operating s)stem can proper&) sae memor) dump fi&es' erif) that the

    s)stem drie has ade*uate free space' chec/ for ade*uate hard dis/ space' and chec/ for dis/

    corruption(

    -erifying System !rive Free Space

    6erif) that ade*uate free space e$ists on thesystemdriveto accommodate the ma$imum paging

    fi&e siBe for the se&ected dump fi&e( 2or e$amp&e' for comp&ete memor) dump fi&es' the aai&a%&e

    space must %e at &east e*ua& to the amount of ph)sica& memor) present(

    To view the ma.imum paging file si/e for each dis, volume

    )* 5n Contro& Pane&' dou%&e-c&ic/ System' and then c&ic/ the Advancedta%(

    &* nder Performance' c&ic/ Settings(

    (* 5n the Performance $ptionsdia&og %o$' c&ic/ the Advancedta%(

    +* nder &irtual memory' c&ic/ Change(

    0* 5n the &irtual 'emorydia&og %o$' iew the paging fi&e information( nder (otal

    paging file si)e for all drives' the Currently allocateda&ue indicates the paging

    fi&e dis/ space used(

    5f )ou c&ic/ Custom si)e' )ou can specif) different paging fi&e siBes %) entering a&ues for

    *nitial si)e +',-and 'aimum si)e +',-(1* 6erif) thatsystemdrivehas ade*uate dis/ space aai&a%&e to accommodate the

    ma$imum paging fi&e siBe specified(

    To aoid dis/ fragmentation when creating a memor) dump' set the *nitial si)e to a a&ue greater

    than that re*uired %) the memor) dump fi&e' so that the paging fi&e does not hae to %e e$panded

    whi&e the memor) dump is created(

    Chec,ing for 2de3uate #ard !is, Space

    6erif) that the memor) dump fi&e path %) defau&t'systemrootMemor)(dmp contains sufficient

    free space to store the memor) dump fi&e( 2or more information a%out specif)ing dis/ dump fi&e

    &ocations' see +Configuring Memor) 9ump 2i&es, ear&ier in this chapter(

    Chec,ing for !is, Corruption

    6erif) thatsystemdrive,the o&ume containing the memor) dump fi&e' is not corrupted( To test

    hard dis/ or o&ume integrit)' fo&&ow the instructions proided in +Stop 0$000000" or

    .T2S>257E>S3STEM, &ater in this chapter(

    otey default, ne complete memory dump files overrite e'isting files! To

    change this, clear the Overwrite #ny e2isting $ile check bo'. -ou canalso choose to archive or move a dump file prior to troubleshooting!

  • 8/12/2019 Troubleshooting Memory Dump

    15/54

    Common Stop Mess#ges 1)

    4sing Memory !ump Files to 2naly/e Stop ErrorsMemor) dump fi&es record detai&ed information a%out the state of )our operating s)stem when

    the Stop error occurred( 3ou can ana&)Be memor) dump fi&es manua&&) %) using de%ugging too&s

    or %) using automated processes proided %) Microsoft( The information )ou o%tain can he&p

    )ou understand more a%out the root cause of the pro%&em(

    3ou can use the Error Reporting Serice to up&oad )our memor) dump fi&e information to

    Microsoft( 3ou can a&so use the fo&&owing de%ugging too&s to manua&&) ana&)Be )our memor)

    dump fi&es4

    Microsoft :erne& 9e%ugger :d(e$e

    Microsoft Win9%g 9e%ugger Win9%g(e$e

    As an additiona& trou%&eshooting option' )ou can configure )our s)stem to write an entr) in the

    S)stem &og when a Stop error occurs(

    4sing the Error %eporting ServiceWhen ena%&ed' the Error Reporting Serice monitors )our operating s)stem for fau&ts re&ated to

    operating s)stem components and app&ications( sing the Error Reporting Serice ena%&es )ou to

    o%tain more information a%out the pro%&em or condition that caused the Stop error(

    When a Stop error occurs' Windows Serer "00#disp&a)s a Stop message andwrites diagnosticinformation to the memor) dump fi&e specified on the Advanced ta% of the System Properties

    dia&og %o$ as descri%ed in JConfiguring Memor) 9ump 2i&esJ ear&ier in this chapter( 2or

    reporting purposes' the operating s)stem a&so saes a sma&& memor) dump fi&e( The ne$t time

    )ou start )our s)stem %) using norma& mode or Safe Mode with .etwor/ing and &og on to

    Windows Serer "00# as an Administrator' the Error Reporting Serice gathers information

    a%out the pro%&em and performs the fo&&owing actions(

    Shutdown Event Trac,er appears

    The Shutdon /vent (racker' a&though it is not direct&) re&ated to the Error Reporting Serice'

    appears immediate&) after an administrator authenticates to the s)stem after a Stop error or other

    une$pected shutdown( This dia&og %o$ a&&ows the administrator to add information a%out the

    Stop error to the eent( The Stop error num%er and parameters are automatica&&) added to the

    Commentfie&d( After the administrator c&ic/s $K' an eent with the information is added to the

    S)stem &og with an Eent 59 of 10KG( The norma& &ogon process %egins after the Shutdown

    Eent Trac/er is c&osed(

    !isplays an alert

    @nce the des/top enironment has started' the Error Reporting Serice disp&a)s a dia&og %o$

    stating that the s)stem has recoered from a serious error($rovides the option to send a problem report

    3ou can c&ic/ Send /rror "eport or Dont Send( 3ou a&so hae the option to iew the data the

    error report contains and can een iew the &ocation of the LM7 fi&e that wi&& %e transmitted to

    Microsoft( This LM7 report contains the ersion and &anguage of Windows Serer "00# )ou are

  • 8/12/2019 Troubleshooting Memory Dump

    16/54

    1/ Chapter 10 Troubleshooting Stop Errors

    using' and a &ist of a&& deices and driers &oaded in the s)stem at the time the Stop error

    occurred(

    5f )ou c&ic/ Send /rror "eport' the Error Reporting Serice anon)mous&) sends the report'

    which inc&udes the sma&& memor) dump fi&e that was =ust generated and the LM7 report' to

    Microsoft %) using a Secure Soc/et 7a)er SS7 encr)pted session( 3ou might %e prompted to

    proide additiona& information to comp&ete )our error report( An error report contains

    information a%out what )our operating s)stem was doing when the pro%&em occurred( Microsoft

    uses error report information to improe the *ua&it) of Windows Serer "00# in the form of

    product updates or future software reisions(

    After the report has %een up&oaded' )ou are directed to the @n&ine Crash Ana&)sis We% site( 5f

    aai&a%&e' an ana&)sis of the Stop error is proided( 9epending on the nature of the error' )ou

    might %e a%&e to trac/ the status of the Stop error( 2or more information a%out this We% site' see

    +sing the @n&ine Crash Ana&)sis We% Site, &ater in this chapter(

    To enable the Error %eporting Service for Stop errors

    )* 5n Contro& Pane&' dou%&e-c&ic/ System' and then c&ic/ the Advancedta%(

    &* C&ic/ /rror "eportingto disp&a) the /rror "eportingdia&og %o$ shown in

    2igure 10((

    Figure 1&., Error Reporting Di#log !o2

    (* C&ic/ /nable error reporting(

    +* Ma/e sure the #indos operating systemchec/ %o$ is se&ected(

  • 8/12/2019 Troubleshooting Memory Dump

    17/54

    Common Stop Mess#ges 10

    The operating s)stem a&wa)s writes a supp&ementa& sma&& memor) dump fi&e when a Stop error

    occurs( Therefore' the Error Reporting Serice can send a pro%&em report with sma&& memor)

    dump fi&e information' een if )ou hae configured )our s)stem to generate /erne& or comp&etememor) dump fi&es(

    The roup Po&ic) @%=ect Editor can customiBe the Error Reporting Serice in seera& usefu&

    wa)s( @ne of the most usefu& wa)s to customiBe the Error Reporting Serice is to configure it to

    up&oad error reports without prompting an administrator( Error reports can %e stored on a shared

    fo&der' which is usefu& for ana&)Bing errors that occur across seera& different serers(

    Administrators can then ana&)Be errors that occur across seera& different serers and fi&ter which

    reports are sent to Microsoft for ana&)sis( 2or more information a%out additiona& reporting

    options proided %) the Error Reporting Serice' see +S)stem and program error reporting

    oeriew, in He&p and Support Center for Windows Serer "00#(

    4sing the Online Crash 2nalysis "eb Site3ou can use the Windows @n&ine Crash Ana&)sis We% site to trac/ the status of unreso&ed error

    reports up&oaded to Microsoft %) the Error Reporting Serice( 2or more information a%out the

    Error Reporting Serice' see +sing the Error Reporting Serice, ear&ier in this chapter(

    To isit the Windows @n&ine Crash Ana&)sis We% site' c&ic/ the @n&ine Crash Ana&)sis We% Site

    &in/ on theWe% Resources pageat http4

  • 8/12/2019 Troubleshooting Memory Dump

    18/54

    18 Chapter 10 Troubleshooting Stop Errors

    Kernel!mode call stack information for the interrupted thread.Consists of a

    series of memor) &ocations and inc&udes a pointer to the initia& &ocation(

    5f )ou need an immediate response %efore ana&)sis of )our dump fi&e is comp&ete' )ou can search

    the Microsoft :now&edge 8ase or su%mit a re*uest to the Microsoft Product Support Serices

    We% site( 2or more information a%out Microsoft Product Support Serices' see the Microsoft

    Product Support Serices&in/ on theWe% Resources pageat

    http4

  • 8/12/2019 Troubleshooting Memory Dump

    19/54

    Common Stop Mess#ges 1

    &* @n the 2i&e menu' c&ic/ S)m%o& 2i&e Path(

    (* 5n the Symbol path%o$' t)pe4

    SRV*localpath*http://msdl.microsoft.com/download/symbols

    where localpathis a path on the hard dis/ that the de%ugger wi&& use to store the

    down&oaded s)m%o& fi&es( The de%ugger wi&& automatica&&) create localpathwhen )ou

    ana&)Be a dump fi&e(

    2or e$amp&e' to store the s)m%o& fi&es in C4We%s)m%o&s' set the s)m%o& fi&e path to

    SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols (A&ternatie&)' )ou can down&oad the s)m%o& fi&es to )our s)stem for de%ugging when )ou

    hae disconnected from the 5nternet(

    To download symbol files for offline use

    )* o to the 9rier 9ee&opment :its &in/ on the We% Resources pageat

    http4

  • 8/12/2019 Troubleshooting Memory Dump

    20/54

    %& Chapter 10 Troubleshooting Stop Errors

    The Command window disp&a)s feed%ac/ from the de%ugger and a&&ows )ou to issue

    additiona& commands( When a crash dump is opened' the Command window automatica&&)

    disp&a)s the output of the !analyzecommand( 5n man) cases' this defau&t information is

    sufficient to iso&ate the cause of the Stop error( 2or more detai&ed information a%out the Stop

    error' t)pe !analyze -vin the kd%o$ of the Command window' and then press E.TER(

    This command wi&& show the Stop message' which inc&udes a description of the Stop error

    and the Stop error parameters(

    Stop Errors %ecorded in the System5og

    3ou can use Eent 6iewer Eentwr(msc to iew entries in the S)stem &og that descri%e Stop

    errors that hae occurred( Stop error information is automatica&&) added to the S)stem &og with

    the Eent 59 100#( The S)stem &og is the simp&est wa) to iew the Stop error num%er and

    parameters after a s)stem has restarted( As shown in 2igure 10(G' the eent information contains

    on&) the error num%er and parameters( 2or trou%&eshooting information specific to an error' find

    the error num%er in +Common Stop Messages, &ater in this chapter( To gather additiona&

    information a%out the Stop error' see +sing Memor) 9ump 2i&es to Ana&)Be Stop Errors,

    ear&ier in this chapter(

  • 8/12/2019 Troubleshooting Memory Dump

    21/54

    Common Stop Mess#ges %1

    Figure 1&./ Stop Error um+ers #nd "#r#meters (v#il#+le ithin the System Log

    eing $repared for Stop ErrorsSome usefu& software and hardware-re&ated techni*ues can he&p )ou prepare for Stop errors when

    the) occur( Stop messages do not a&wa)s pinpoint the root of the pro%&em' %ut the) do proide

    important c&ues that )ou or a trained support technician can use to identif) and trou%&eshoot the

    cause(

    $revent System %estarts 2fter a Stop Error

    When a Stop error occurs' Windows Serer "00# disp&a)s a Stop message re&ated to the pro%&em'

    fo&&owed %) one of these eents4

    Windows Serer "00# %ecomes unresponsie(

    Windows Serer "00# automatica&&) restarts(

  • 8/12/2019 Troubleshooting Memory Dump

    22/54

    %% Chapter 10 Troubleshooting Stop Errors

    8) defau&t' Windows Serer "00# automatica&&) restarts after a Stop error occurs' un&ess the

    s)stem %ecomes unresponsie( 5f Windows Serer "00#restarts )our s)stem immediate&) after a

    Stop error occurs' )ou might not hae enough time to record Stop message information that canhe&p )ou ana&)Be the cause of a pro%&em( Additiona&&)' )ou might miss the opportunit) to change

    startup options or start the operating s)stem in Safe Mode( 9isa%&ing the defau&t restart %ehaior

    a&&ows )ou to record Stop message te$t' information that can he&p )ou ana&)Be the root cause of a

    pro%&em if memor) dump fi&es are not accessi%&e( 9isa%&ing the automatic restart causes a fai&ed

    s)stem to remain off&ine unti& an administrator manua&&) restarts the s)stem( Therefore' )ou

    shou&d ena%&e automatic restart on mission-critica& serers and on remote serers that cannot %e

    manua&&) restarted(

    To disable the 2utomatically restart option

    )* 5n Contro& Pane&' dou%&e-c&ic/ System' and then c&ic/ the Advancedta%(

    &* nder Startup and "ecovery' c&ic/Settings(

    (* 5n the System failure%o$' c&ear theAutomatically restart chec/ %o$(5f )ou cannot start )our computer in norma& mode' )ou can perform the preceding steps in Safe

    Mode(

    %ecord and Save Stop Message Information

    With the automatic restart %ehaior disa%&ed' )ou must restart )our computer manua&&) after a

    Stop message appears( Stop messages proide diagnostic information' such as Stop error

    num%ers and drier names' which )ou can use to reso&e the pro%&em( Howeer' this information

    disappears from the screen when )ou restart )our computer( enera&&)' this information can %e

    retrieed after the s)stem is restarted %) iewing the S)stem &og' as descri%ed in +Stop Errors

    Recorded in the S)stem 7og, ear&ier in this chapter' or e$amining the memor) dump fi&e' as

    descri%ed in +sing Memor) 9ump 2i&es to Ana&)Be Stop Errors, ear&ier in this chapter( There

    are situations where Stop error information is not successfu&&) &ogged' and therefore it is

    important to record the information disp&a)ed in the Stop message for future reference( 8efore

    restarting the s)stem' ta/e the fo&&owing actions to ensure that )ou hae saed important

    information' which )ou can reference when using the resources &isted in this chapter(

    To record and save Stop message information

    )* Record data that is disp&a)ed in the (echnical informationand Driver information

    sections of the Stop message for &ater reference( These sections are descri%ed in +Stop

    Messages, ear&ier in this chapter(

    &* Record and ea&uate suggestions in the "ecommended user actionsection( Stop

    messages t)pica&&) proide trou%&eshooting tips re&eant to the error(

    (* Chec/ the Debug port and dump file status section to erif) that

    Windows Serer "00#successfu&&) created a memor) dump fi&e(+* 5f a memor) dump fi&e does e$ist' cop) the fi&e to remoa%&e media' another dis/

    o&ume' or a networ/ &ocation for safe/eeping( 3ou can use Recoer) Conso&e to

    cop) the dump fi&e if )ou are not a%&e to start Windows Serer "00# in norma& mode

    or Safe Mode(

  • 8/12/2019 Troubleshooting Memory Dump

    23/54

    Common Stop Mess#ges %3

    Ana&)Bing memor) dump fi&es can assist )ou with identif)ing root causes %) proiding )ou with

    detai&ed information a%out the s)stem state when the Stop error occurred( The preceding steps

    ena%&e )ou to sae important information that )ou can refer to when using the resources &isted inJStop MessagesJ ear&ier in this chapter( 2or more information a%out creating and ana&)Bing

    memor) dump fi&es' see +Memor) 9ump 2i&es, ear&ier in this chapter(

    Chec, Software !is, Space %e3uirements

    6erif) that ade*uate free space e$ists on )our dis/ o&umes for irtua& memor) paging fi&es and

    app&ication data fi&es( 5nsufficient free space might cause Stop errors and other s)mptoms'

    inc&uding dis/ corruption( To determine the amount a&&ocated to paging fi&es' see +Memor)

    9ump 2i&es, ear&ier in this chapter(

    3ou can moe' de&ete' or compress unused fi&es manua&&) or %) using 9is/ C&eanup

    C&eanmgr(e$e to increase free space on dis/ o&umes(

    To run !is, Cleanup

    )* 5n the "un dia&og %o$' t)pe4

    cleanmgr

    &* 5f )ou hae more than one &ogica& drie' se&ect a dis/ o&ume to c&ean from the Select

    Drive dia&og %o$' and then c&ic/ $K( 5f )ou hae on&) one &ogica& drie' s/ip to step

    #(

    (* C&ic/ the Disk Cleanupor the 'ore $ptionsta% to specif) fi&es to compress or

    de&ete(

    2or more information a%out 9is/ C&eanup' see +9is/ C&eanup, in He&p and Support Center for

    Windows Serer "00#(

    Install a Kernel !ebugger and Symbol Files

    3ou can use a /erne& de%ugger to gather more information a%out the pro%&em( The 9e%ugging

    Too&s for Windows He&p contains instructions and e$amp&es that can he&p )ou find additiona&

    information a%out the Stop error affecting )ou( 2or more information a%out insta&&ing and using

    de%ugging too&s' see +Stop Messages, and +sing Memor) 9ump 2i&es to Ana&)Be Stop Errors,

    ear&ier in this chapter(

    Common Stop MessagesThe fo&&owing Stop message descriptions contain detai&s that he&p )ou trou%&eshoot or &earn more

    a%out specific Stop errors( 2or information a%out the format of Stop messages as disp&a)ed on the

    screen' see +Stop Messages, ear&ier in this chapter(

    The &ist of Stop messages in this chapter is not comprehensie( 2or information a%out additiona&

    Stop messages' see He&p in the Microsoft 9e%ugging Too&s for Windows' which contains a more

    e$tensie &ist of Stop messages' is updated regu&ar&)' and might hae additiona& information that

    can he&p )ou trou%&eshoot a Stop error( Search %) using the num%er of the Stop message in the

    format bug check 0xA(

  • 8/12/2019 Troubleshooting Memory Dump

    24/54

    %, Chapter 10 Troubleshooting Stop Errors

    2or another source of information a%out indiidua& Stop messages' see the Microsoft :now&edge

    8ase &in/ on theWe% Resources pageat

    http4

  • 8/12/2019 Troubleshooting Memory Dump

    25/54

    Common Stop Mess#ges %)

    **Address 0xZZZZZZZZ has base at -

    5f the third parameter is the same as the first parameter' a specia& condition e$ists in which as)stem wor/er routine' carried out %) a wor/er thread to hand&e %ac/ground tas/s /nown as wor/

    items' returned at a higher 5R?7( 5n that case' some of the four parameters ta/e on new

    meanings' as shown in Ta%&e 10("(

    *#+le 1&.% Speci#l "#r#meters $or the &2( Mess#ge

    $arameter !escription

    $arameter ) 2ddress of the wor,er routine

    $arameter & Kernel I%65

    $arameter ( 2ddress of the wor,er routine

    $arameter + 2ddress of the wor, item

    Troubleshooting the Stop '.2 Error

    2irst' use the Eent 6iewer to reiew the S)stem &og for error eents that identif) the pro%&em(

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    !evice driver issues

    A Stop 0$A message might occur after )ou insta&& a fau&t) or outdated deice drier' s)stem

    serice' or firmware( 5f a Stop message &ists a drier %) name' and that drier has %een recent&)

    rep&aced' use 9eice Manager to ro&& %ac/ the drier to correct the pro%&em( 5f the deice is not

    critica& to the functiona&it) of the s)stem for e$amp&e' the C9-R@M drier' )ou can a&so

    uninsta&& or disa%&e the drier(

    #ardware issuesA Stop 0$A message might a&so %e caused %) fai&ing or defectie hardware( 5f a Stop message

    points to a categor) of deices ideo or dis/ contro&&er adapters' for e$amp&e' tr) remoing or

    rep&acing the hardware to determine if it is causing the pro%&em(

    Software compatibility issues

    5f )ou encounter a Stop 0$A message whi&e upgrading to Windows Serer "00#' the pro%&em

    might %e caused %) an incompati%&e drier' s)stem serice' irus scanner' or %ac/up( To aoid

    pro%&ems whi&e upgrading' simp&if) )our hardware configuration and remoe a&& third-part)

    deice driers and s)stem serices inc&uding irus scanners prior to running Setup( After )ou

    hae successfu&&) insta&&ed Windows Serer "00#' contact the hardware manufacturer to o%tain

    compati%&e updates(

  • 8/12/2019 Troubleshooting Memory Dump

    26/54

    %/ Chapter 10 Troubleshooting Stop Errors

    Stop '.)E orKMO!E7E;CE$TIO878OT7#28!5E!

    The Stop 0$1E message indicates that the Windows Serer "00# /erne& detected an i&&ega& or

    un/nown processor instruction( The pro%&ems that cause Stop 0$1E messages share simi&arities

    with those that generate Stop 0$A errors' in that the) can %e caused %) ina&id memor) and

    access io&ations( The defau&t Windows Serer "00# error hand&er t)pica&&) intercepts these

    pro%&ems if error-hand&ing routines are not present in the code itse&f(

    Interpreting the Stop '.)E Message

    This Stop message has four parameters' as &isted in Ta%&e 10(#(

    *#+le 1&.3 "#r#meters $or the Stop &21E Mess#ge

    $arameter !escription

    $arameter ) E.ception code that was not handled

    $arameter & 2ddress at which the e.ception occurred

    $arameter ( $arameter ' of the e.ception

    $arameter + $arameter ) of the e.ception

    The first parameter identifies the e$ception generated( Common e$ception codes are &isted in

    Ta%&e 10((

    *#+le 1&., 'ommon E2ception 'odes $or "#r#meter 1

    E.ception Code !escription

    '.8ME8T

    2n unaligned data reference was encountered* The trapframe supplies additional information* >enerally? Stop errorswith this e.ception code are resolved by replacing the drivernamed in the Stop message*

    '.

  • 8/12/2019 Troubleshooting Memory Dump

    27/54

    Common Stop Mess#ges %0

    2or a comp&ete &ist of e$ception codes' see the .tstatus(hfi&e &ocated in the 5nc director) of the

    Windows 9rier 9ee&opment :it 99:( 2or more information a%out the 99:' see the 9rier

    9ee&opment :its &in/ on the We% Resources pageathttp4

  • 8/12/2019 Troubleshooting Memory Dump

    28/54

    %8 Chapter 10 Troubleshooting Stop Errors

    Stop '.&+ or 8TFS7FI5E7S=STEMThe Stop 0$" message indicates that a pro%&em occurred within .tfs(s)s' the drier fi&e that

    a&&ows the s)stem to read and write to .T2S fi&e s)stem dries( A simi&ar Stop message' 0$"#'

    e$ists for the fi&e a&&ocation ta%&e 2AT#" fi&e s)stems(

    Interpreting the Stop '.&+ Message

    This Stop message has four parameters' as &isted in Ta%&e 10((

    *#+le 1&.) "#r#meters $or the Stop &2%, Mess#ge

    $arameter !escription

    $arameter ) Source file and line number*

    $arameter & 2 non/ero value that contains the address of the e.ception record @optionalA*

    $arameter ( 2 non/ero value that contains the address of the conte.t record @optionalA*

    $arameter + This parameter is reserved @set aside for future useA*

    Parameters for this Stop message are usefu& on&) to Microsoft technica& support personne& who

    hae access to Windows Serer "00#source code( Stop errors caused %) fi&e s)stem issues haethe source fi&e and the &ine num%er within the source fi&e that generated the error encoded in their

    first parameter( The first four he$adecima& digits a&so /nown as the high 1G %its after the +0$,

    identif) the source fi&e num%er' and the &ast four he$adecima& digits the &ow 1G %its identif) the

    source &ine in the fi&e where the error occurred(

    Troubleshooting the Stop '.&+ Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    #ard dis, issues

    2i&e s)stem corruption in the form of %ad sectors on the hard dis/ can cause Stop 0$" errors(

    Ma&functioning dis/ hardware or dis/ driers can a&so aderse&) affect the s)stemDs a%i&it) to

    read and write to dis/' causing errors( Chec/ for ca%&ing and termination pro%&ems %etween the

    contro&&er and the dis/s( Remoe and rep&ace dis/ contro&&er cards to ensure a&& connections are

    so&id(

    To test hard dis, or volume integrity

    'ethod 17

    )* 5n the "undia&og %o$' t)pe4

    cmd

    &* At the command prompt' t)pe4

    chkdsk drive: /f

    'ethod 87

  • 8/12/2019 Troubleshooting Memory Dump

    29/54

    Common Stop Mess#ges %

    )* 5n Windows E$p&orer' se&ect the hard dis/ )ou want to chec/(

    &* @n the 3ilemenu' c&ic/ Properties' and then c&ic/ the (oolsta%(

    (* 5n the /rror!checking%o$' c&ic/ Check 6o(

    +* nder Check disk options' se&ect the Scan for and attempt recovery of bad

    sectorschec/ %o$( 3ou can a&so se&ect the Automatically fi file system errors

    chec/ %o$(

    5f the o&ume )ou are chec/ing is in use' a message as/s whether )ou want to de&a) dis/ error

    chec/ing unti& the ne$t time )ou restart )our computer( When )ou restart' dis/ error chec/ing

    runs and the o&ume chosen is not aai&a%&e to run other tas/s during this process( 5f )ou cannotrestart the computer in norma& mode %ecause of the error' use Safe Mode or Recoer) Conso&e(

    System and application problems

    Periodica&&) chec/ Eent 6iewer for error messages re&ated to sma&& computer s)stem interface

    SCS5 or 2AST2AT in the S)stem &og or Autoch/ in the App&ication &og( 6erif) that serices or

    other software that runs in the %ac/ground O such as irus scanners' %ac/up programs' or dis/

    defragmenters O are compati%&e with Windows Serer "00#( Some dis/s and adapters come

    pac/aged with diagnostic software that )ou can use to run hardware tests( 2or more information

    a%out diagnostic too&s usage and compati%i&it)' see the ownerDs manua& for )our computer' hard

    dis/' or contro&&er(

    Stop '.&E or !2T274S7E%%O%The Stop 0$"E message indicates a s)stem memor) parit) error( The cause is t)pica&&) fai&ed or

    defectie RAM inc&uding memor) on the mother%oard' 7ee& " cache' or ideo adapter'

    incompati%&e or mismatched memor) hardware' or a deice drier attempting to access an

    address in the 0$Fxxxxxxxrange that does not e$ist that is' it does not map to a ph)sica&

    address( A Stop 0$"E message can a&so indicate hard dis/ damage caused %) a irus or other

    pro%&ems(

    Interpreting the Stop '.&E Message

    This Stop message has four parameters' as &isted in Ta%&e 10(G(

    *#+le 1&./ "#r#meters $or the Stop &2%E Mess#ge

    $arameter !escription$arameter ) -irtual address that caused the fault

    $arameter & $hysical address that caused the fault

    $arameter ( $rocessor status register

    '#ution.o not use tools meant for other operating systems on

    "indos Server #00$ partitions, or you might lose file information!

  • 8/12/2019 Troubleshooting Memory Dump

    30/54

    3& Chapter 10 Troubleshooting Stop Errors

    $arameter + Faulting instruction register

    Troubleshooting the Stop '.&E Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    Memory hardware issues

    Stop 0$"E is t)pica&&) caused %) defectie' ma&functioning' or fai&ed memor) hardware' such as

    memor) modu&es' 7ee& " 7" cache memor)' or ideo adapter RAM( 5f )ou added new

    hardware recent&)' remoe and rep&ace it to determine if it is causing or contri%uting to the

    pro%&em( Run diagnostics software supp&ied %) the s)stem manufacturer to determine if the

    component has fai&ed(

    !river and service issues

    Stop 0$"E messages can a&so occur after )ou insta&& fau&t) driers or s)stem serices( 5f a fi&e

    name is gien' )ou can disa%&e' remoe' or ro&& %ac/ that drier( 9isa%&e the serice or

    app&ication and confirm that this reso&es the error( 5f it does' contact the hardware manufacturer

    a%out a possi%&e update( sing updated software is especia&&) important for %ac/up programs'

    mu&timedia app&ications' antiirus scanners' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    31/54

    Common Stop Mess#ges 31

    Stop error' run the hardware diagnostics program inc&uded with )our deices or rep&ace them

    with new parts( 5f s)stem fi&es hae recent&) %een rep&aced' restoring those s)stem fi&es might

    preent the fai&ure( A&so' erif) that )our mother%oard firmware and periphera& firmwareersions are current(

    5f )ou cannot iso&ate an) specific hardware pro%&ems' tr) running Windows Serer "00# Setup

    again( 5f the same error message appears' record the information in the Stop message and contact

    a Microsoft support technician(

    Stop '.(& or $#2SE)7I8ITI25IB2TIO87F2I5E!The Stop 0$#" message indicates that s)stem startup fai&ed during Phase 1 of the E$ecutie

    initia&iBation( 9uring Phase 1' interrupts are ena%&ed' deice driers are initia&iBed' and those

    E$ecutie components that were not initia&iBed during Phase 0 are initia&iBed( E$ecutie

    components initia&iBed in Phase 1 inc&ude the power manager and the 5

  • 8/12/2019 Troubleshooting Memory Dump

    32/54

    3% Chapter 10 Troubleshooting Stop Errors

    The s)stem Page Ta%&e Entries PTEs are fragmented %ecause the s)stem performed

    a &arge num%er of input

  • 8/12/2019 Troubleshooting Memory Dump

    33/54

    Common Stop Mess#ges 33

    E.cessive demands for system $TEs

    Another cause is e$cessie demands for s)stem PTE %) app&ications( Microsoft

    Windows"000 Serer and Windows Serer "00# inc&ude a registr) entr) that )ou can modif)

    to increase the num%er of PTEs a&&ocated( PTE &imitations shou&d cause pro%&ems on&) on #"-%it

    s)stems(

    To increase the number of $TEs allocated on (&bit systems

    )* 5n the "undia&og %o$' t)pe4

    regedit

    &* 5n the registr) editor' naigate to the SystemPagesentr) in

    H:E3>7@CA7>MACH5.ES3STEMCurrentContro&SetContro&Session

    ManagerMemor) Management(

    (* 6iew the a&ues for the PagedPoolSi)e and SystemPages entries(

    5f the a&ue of the PagedPoolSi)eentr) is not Bero' dou%&e-c&ic/ PagedPoolSi)e

    and change the a&ue in the &alue data%o$ to 0(

    5f the a&ue of the SystemPagesentr) is not Bero' dou%&e-c&ic/ SystemPagesand

    increase the a&ue in the &alue data%o$ to a higher num%er than what appears(

    Setting this a&ue to 0$2222222 causes Windows Serer "00# to automatica&&)

    configure the ma$imum num%er of PTEs possi%&e' which reduces the space aai&a%&e for

    the fi&e s)stem cache( The defau&t a&ue is 0(

    +* C&ic/ $K' and then c&ose the registr) editor(

    0* Restart )our computer(

    1* 5f this procedure does not so&e the pro%&em on the first tr)' repeat the procedure and

    increase the a&ue for the SystemPagesentr)(

    Other suggestions

    se the 9rier 6erifier to identif) the fau&t) drier( 2or more information a%out identif)ing the

    drier causing the pro%&em' search for +8ug Chec/ 0$#2, in 9e%ugging Too&s for Windows

    He&p( To down&oad 9e%ugging Too&s for Windows' go to the 9e%ugging Too&s &in/ on the We%

    Resources pageat http4

  • 8/12/2019 Troubleshooting Memory Dump

    34/54

    3, Chapter 10 Troubleshooting Stop Errors

    Stop '.0' or$2>E7F245T7I878O8$2>E!72%E2

    The Stop 0$0 message indicates that re*uested data was not in memor)( The s)stem generates

    an e$ception error when using a reference to an ina&id s)stem memor) address( 9efectie

    memor) inc&uding main memor)' 7" cache memor)' and ideo RAM or incompati%&e software

    inc&uding remote contro& and antiirus software might cause Stop 0$0 messages(

    Interpreting the Stop '.0' Message

    This Stop message has four parameters' as &isted in Ta%&e 10((

    *#+le 1&. "#r#meters $or the Stop &2)& Mess#ge

    $arameter !escription

    $arameter ) Memory address referenced*

    $arameter & Type of access9

    '.'''''''' : read operation

    '.''''''') : write operation

    $arameter ( If not /ero? the instruction address that referenced the address in $arameter )*

    $arameter + This parameter is reserved @set aside for future useA*

    Troubleshooting the Stop '.0' Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    8ew hardware issues

    5f )ou added new hardware recent&)' remoe and rep&ace the hardware to determine if it is

    causing or contri%uting to the pro%&em( Run diagnostics software supp&ied %) the hardware

    manufacturer to determine if the component has fai&ed(

    !river and system service issues

    Stop 0$0 messages can a&so occur after )ou insta&& fau&t) driers or s)stem serices( 5f the fi&e

    &isted is a drier' use 9rier 6erifier to a&idate that the reported drier is causing the pro%&em(

    @nce )ou hae identified the pro%&ematic drier' use 9eice Manager to ro&& %ac/ or update the

    drier to correct the pro%&em( 5f the deice is not critica& to the functiona&it) of the s)stem for

    e$amp&e' the /e)%oard drier' )ou can a&so uninsta&& or disa%&e the drier(

    5f )ou hae recent&) added a serice or app&ication' disa%&e the recent&) insta&&ed serice or

    app&ication to determine if this reso&es the error( 5f this does not reso&e the pro%&em' contact the

    hardware manufacturer for updates( sing updated driers and software is especia&&) important

    for networ/ adapters' ideo adapters' %ac/up programs' mu&timedia app&ications' antiirus

    scanners' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    35/54

    Common Stop Mess#ges 3)

    printer causes Stop 0$0 errors' using a printer drier meant for a Mode& 1100A or Mode& 11008

    might temporari&) reso&e the pro%&em(

    Stop '.1 or$%OCESS)7I8ITI25IB2TIO87F2I5E!

    The Stop 0$G8 message indicates that s)stem startup fai&ed during Phase 1 of the E$ecutie

    initia&iBation( 9uring Phase 1' interrupts are ena%&ed' deice driers are initia&iBed' components

    initia&iBed in Phase 0 continue the initia&iBation process' and those E$ecutie components that

    were not initia&iBed during Phase 0 are initia&iBed( E$ecutie components initia&iBed in Phase 1

    inc&ude the power manager and the 5

  • 8/12/2019 Troubleshooting Memory Dump

    36/54

    3/ Chapter 10 Troubleshooting Stop Errors

    Interpreting the Stop '.DD Message

    The parameters for this Stop message hae one of two different meanings( The a&ue of the first

    parameter determines the meaning of parameters "' #' and ( 5f parameter 1 is an)thing other than

    0$0' 0$1' or 0$"' the parameters shou&d %e interpreted as shown in Ta%&e 10(11(

    *#+le 1&.11 "#r#meters $or the Stop &200 Mess#ge

    $arameter !escription

    $arameter ) Status code*

    $arameter & IO status code

    $arameter ( $aging file number

    $arameter + Offset into paging file

    2re*uent&)' the cause of this error can %e determined from the 5enerally indicates bad bloc,s @sectorsA on the hard dis,*

    '.C'''''!9

    ST2T4S7!E-ICE78OT7CO88ECTE!

    Indicates defective or loose data or power cables? a problemwith SCSI termination? or improper controller or hard dis,configuration*

    '.C'''')129

    ST2T4S7!ISK7O$E%2TIO87F2I5E!

    Indicates bad bloc,s @sectorsA on the hard dis,*

    '.C'''')

  • 8/12/2019 Troubleshooting Memory Dump

    37/54

    Common Stop Mess#ges 30

    $arameter ( This value is '.'''''''' @/eroA*

    $arameter + 2ddress of signature on ,ernel stac,*

    These are the most common codes for which specific causes hae %een determined( 2or

    information a%out other possi%&e status codes that can %e returned' see the .tstatus(h fi&e of the

    Windows Serer "00# 9rier 9ee&opment :it 99:( 2or more information a%out the 99:'

    see the 9rier 9ee&opment :it &in/ on theWe% Resources pageat

    http4

  • 8/12/2019 Troubleshooting Memory Dump

    38/54

    38 Chapter 10 Troubleshooting Stop Errors

    ACP5 firmware settings were changed after Windows Serer "00# was insta&&ed( 2or

    e$amp&e' an administrator might hae insta&&ed Windows Serer "00# on an $FG-

    %ased computer with the firmware ACP* enableoption ena%&ed' and &ater decided todisa%&e it(

    Mismatched sing&e-processor and mu&tiprocessor configuration fi&es are copied to the

    s)stem(

    The operating s)stem &oader is an o&der ersion than the operating s)stem /erne&; for

    e$amp&e' the Windows "000 Serer &oader is used to &oad the Windows Serer "00#

    /erne& %ecause Windows "000 Serer was insta&&ed after Windows Serer "00#(

    Interpreting the Stop '.D Message

    The content of the information proided %) a 0$K Stop message aries according to the a&ue of

    parameter 1( Ta%&e 10(1 &ists the different a&ues for parameter 1(

    *#+le 1&.1, "#r#meters $or the Stop &20 Mess#ge$arameter ) $arameter & $arameter ( $arameter + !escription

    '.''''''') %elease level of8tos,rnl*e.e

    %elease level of#al*dll

    This value is'.'''''''' @/eroA*

    $%C releaselevel mismatch

    '.'''''''& uild type of8tos,rnl*e.e

    uild type of #al*dll This value is'.'''''''' @/eroA*

    uild typemismatch

    '.'''''''( Si/e of the loaderparametere.tension

    MaGor-ersion of theloader parametere.tension

    Minor-ersion of theloader parametere.tension

    The 8tldr and#25 versionsmismatch

    When the a&ue of parameter 1 is set to 0$0000000"' the %ui&d t)pe codes shown in Ta%&e 10(1

    %ecome effectie for parameter " and parameter #(*#+le 1&.1) 'ommon !uild *ype 'odes $or "#r#meter %

    uild Type Code !escription

    '.'''''''' Multiprocessorenabled free build

    '.''''''') Multiprocessorenabled chec,ed build

    '.'''''''& Singleprocessor free build

    Troubleshooting the '.D Stop Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    Incorrect versions of 8tos,rnl*e.e or #al*dll files

    A Stop 0$K message occurs when the operating s)stem is using out-of-date .tos/rn&(e$e or

    Ha&(d&& fi&es( This can occur after manua& repairs that ino&e cop)ing incorrect fi&es to the

    operating s)stem( This error a&so occurs when cop)ing mismatched fi&es' such as a

    mu&tiprocessor HA7 to an operating s)stem that uses a sing&e-processor /erne& or ice ersa(

  • 8/12/2019 Troubleshooting Memory Dump

    39/54

    Common Stop Mess#ges 3

    The /erne& and HA7 fi&es for sing&e-processor and mu&tiprocessor s)stems are stored on the

    Windows Serer "00# operating s)stem C9 %) using two different fi&e names4 .tos/rn&(e$e and

    .t/rn&mp(e$e' respectie&)( Setup copies either .tos/rn&(e$e or .t/rn&mp(e$e to )our s)stem as.tos/rn&(e$e(

    5n Recoer) Conso&e' it is possi%&e to use the Copycommand to cop) the correct .t&dr' HA7' or

    /erne& fi&es from the operating s)stem C9 to the appropriate fo&der on the hard dis/( 2or more

    information a%out Recoer) Conso&e' see +Recoer) Conso&e oeriew, in He&p and Support

    Center for Windows Serer "00#(

    Incorrect firmware settings

    5f )ou e$perience Stop 0$K messages after changing firmware settings' restore the origina&

    settings used during Windows Serer "00# Setup(

    Stop '.D2 or KE%8E57!2T27I8$2>E7E%%O%The Stop 0$KA message indicates that a page of /erne& data was not found in the paging irtua&memor) fi&e and cou&d not %e read into memor)( The causes of this might %e incompati%&e dis/

    or contro&&er driers' outdated firmware' or a hardware pro%&em(

    Interpreting the Stop '.D2 Message

    The parameters for this Stop message hae two sets of meanings( The a&ue of parameter 1

    determines the meaning of parameters "' #' and (

    5f parameter 1 is 0$1' 0$"' or 0$#' the parameters shou&d %e interpreted as shown in Ta%&e 10(1G(

    This Stop message has four parameters' as &isted in Ta%&e 10(1G(

    *#+le 1&.1/ "#r#meters $or the Stop &20( Mess#ge

    $arameter !escription

    $arameter ) 5oc, type value

    '.''''''')

    '.'''''''&

    '.'''''''( or $TE address

    $arameter & Error status @ typically an IO status codeA*

    $arameter ( If the loc, type is '.''''''') or '.'''''''&? this parameter represents thecurrent process*

    If the loc, type is '.'''''''(? this parameter represents the virtual address*

    $arameter + The virtual address that could not be paged into memory*

    5f parameter 1 does not hae a a&ue of 0$1' 0$"' or 0$#' the parameters &isted in Ta%&e 10(1K

    app&)(

    *#+le 1&.10 Second#ry "#r#meters $or the Stop &20( Mess#ge

    $arameter !escription

  • 8/12/2019 Troubleshooting Memory Dump

    40/54

    ,& Chapter 10 Troubleshooting Stop Errors

    2re*uent&)' the cause of this error can %e determined from the 5257E>S3STEM, ear&ier in this chapter(

    http://go.microsoft.com/fwlink/?linkid=291http://go.microsoft.com/fwlink/?linkid=291
  • 8/12/2019 Troubleshooting Memory Dump

    41/54

    Common Stop Mess#ges ,1

    Memory hardware issues

    Another cause of Stop 0$KA messages is defectie' ma&functioning' or fai&ed memor) hardware'

    such as memor) modu&es' 7ee& " 7" SRAM cache' or ideo adapter RAM( 5f )ou added new

    hardware recent&)' remoe and rep&ace it to determine if it is causing or contri%uting to the

    pro%&em( Run diagnostics software supp&ied %) the s)stem manufacturer to determine if the

    component has fai&ed(

    Firmware and driver issues

    Chec/ the hardware manufacturerDs We% site for updates to dis/ adapter firmware or driers that

    improe compati%i&it)( 6erif) that )our firmware' dis/s' and contro&&er support the same set of

    adanced features' such as higher transfer rates( 5f necessar)' se&ect a s&ower transfer rate if an

    update is not )et aai&a%&e( Consu&t )our hardware or deice documentation for more

    information(

    Motherboard issues

    The pro%&em might a&so %e caused %) crac/s' scratched traces' or defectie components on the

    mother%oard( 5f a&& e&se fai&s' ta/e the s)stem mother%oard to a repair faci&it) for diagnostic

    testing(

    Stop '.D or I82CCESSI5E7OOT7!E-ICEThe Stop 0$K8 message indicates that Windows Serer "00# has &ost access to the s)stempartition or %oot o&ume during the startup process( There are seera& circumstances that can

    cause this4

    A hard dis/ or dis/ contro&&er has fai&ed(

    A 8oot(ini fi&e is configured incorrect&)( This often occurs when dis/s or contro&&ers

    are added and change the ARC mapping of e$isting dis/s(

    5ncorrect dis/ contro&&er deice driers are insta&&ed( This might happen %ecause

    incorrect driers were &oaded during Setup' or )ou are using a s)stem image created

    %) using different hardware(

    The dis/ su%s)stem deice drier is fau&t)(

    The s)stem has a irus infection(

    Interpreting the Stop '.D Message

    This Stop message has four parameters' as &isted in Ta%&e 10(1(

    -mport#nt-ou can install disk controller drivers that are not present on the

    "indos Server #00$ operating system C. by responding to the

    folloing message shortly after starting setup =9ress )* if you need to

    install a third party SCSI or 6I. driver!> "hen you see this message,

    press )*, and hen prompted, provide the appropriate storage controller

    driver ?6T6 or SCSI@ supplied by the manufacturer!

  • 8/12/2019 Troubleshooting Memory Dump

    42/54

    ,% Chapter 10 Troubleshooting Stop Errors

    *#+le 1&.1 "#r#meters $or the Stop &20! Mess#ge

    $arameter !escription

    $arameter ) The address of the device obGect that could not be mounted? or the4nicode string of 2%C name*

    $arameter & This value is '.'''''''' @/eroA*

    $arameter ( This value is '.'''''''' @/eroA*

    $arameter + This value is '.'''''''' @/eroA*

    The a&ue of parameter 1 determines whether the parameter is a pointer to an ARC name string

    ARC names are a generic method of identif)ing deices within the ARC enironment or a

    deice o%=ect' %ecause a nicode string neer has an odd num%er of %)tes' and a deice o%=ect

    a&wa)s has a T)pe code of 000#(

    Troubleshooting the Stop '.D Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    #ardware issues

    9uring 5

  • 8/12/2019 Troubleshooting Memory Dump

    43/54

    Common Stop Mess#ges ,3

    #ard dis, issues

    Hard dis/ corruption can a&so cause this Stop error( 2or more information a%out chec/ing hard

    dis/ integrit)' see the instructions proided in +Stop 0$000000" or .T2S>257E>S3STEM,ear&ier in this chapter(

    Other suggestions

    5n addition to the potentia& causes &isted a%oe' iruses can cause the 0$K8 Stop error( Pro%&ems

    that cause 0$K8 errors might a&so cause Stop 0$G8 or Stop 0$E9 errors( 2or more information

    a%out 0$E9 Stop errors' see +Stop 0$000000E9 or [email protected]>8@@T>6@7ME, &ater

    in this chapter(

    Stop '.DF or48E;$ECTE!7KE%8E57MO!E7T%2$

    The Stop 0$K2 message indicates that one of two t)pes of pro%&ems occurred in /erne&-mode4

    A condition that the /erne& is not a&&owed to hae or intercept a&so /nown as a bound

    trap(

    A fau&t occurred whi&e processing an ear&ier fau&t a&so /nown as a double fault(

    Interpreting the Stop '.DF Message

    This Stop message has four parameters' as &isted in Ta%&e 10("0(

    *#+le 1&.%& "#r#meters $or the Stop &20F Mess#ge

    $arameter !escription

    $arameter ) $rocessor e.ception code*

    $arameter & This value is '.'''''''' @/eroA*

    $arameter ( This value is '.'''''''' @/eroA*

    $arameter + This value is '.'''''''' @/eroA*

    Parameter 1 is the most important parameter and can hae seera& different a&ues' indicating

    different causes of this error( 3ou can find a&& conditions that cause a Stop 0$K2 in an) $FG

    microprocessor reference manua& %ecause the) are specific to the $FG p&atform( Ta%&e 10("1 &ists

    some of the most common e$ception codes(

    *#+le 1&.%1 'ommon E2ception 'odes $or the Stop &20F Mess#ge

    E.ception Code !escription

    '.''''''''9

    !ivide by Bero Error

    Occurs when a divide @!I-A instruction is run in a ,ernel process and thedivisor is '* Memory corruption? other hardware failures? or software problemscan cause this error message*

  • 8/12/2019 Troubleshooting Memory Dump

    44/54

    ,, Chapter 10 Troubleshooting Stop Errors

    '.'''''''+9

    Overflow

    Occurs when the processor carries out a call to an interrupt handler when theoverflow @OFA flag is set*

    '.'''''''09

    ounds Chec, Fault

    Indicates that the processor? while carrying out a O48! instruction? foundthat the operand e.ceeded the specified limits* O48! instructions ensurethat a signed array inde. is within a certain range*

    '.'''''''19

    Invalid Opcode

    >enerated when the processor attempts to run an invalid instruction* Thistypically occurs when a hardware memory problem corrupts the instructionpointer? which then points to a wrong location*

    '.'''''''

  • 8/12/2019 Troubleshooting Memory Dump

    45/54

    Common Stop Mess#ges ,)

    Motherboard issues

    The pro%&em might a&so %e caused %) crac/s' scratched traces' or defectie components on the

    mother%oard( 5f a&& e&se fai&s' ta/e the s)stem mother%oard to a repair faci&it) for diagnostictesting(

    Software incompatibility issues

    Stop 0$K2 messages can occur after )ou insta&& incompati%&e app&ications' driers' or s)stem

    serices( Contact the software manufacturer a%out possi%&e Windows Serer "00#Nspecific

    updates( sing updated software is especia&&) important for %ac/up programs' mu&timedia

    app&ications' antiirus scanners' and C925E bit*

    Child device obGect Child deviceobGect

    $arent deviceobGect

    http://go.microsoft.com/fwlink/?linkid=291http://go.microsoft.com/fwlink/?linkid=291
  • 8/12/2019 Troubleshooting Memory Dump

    46/54

    ,/ Chapter 10 Troubleshooting Stop Errors

    This Stop message t)pica&&) occurs during eents that ino&e power state transitions' such as the

    fo&&owing4

    Shutting down

    Suspending or resuming from stand%) mode

    Suspending or resuming from hi%ernate mode

    Troubleshooting the '.F Stop Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    2pplication? driver? or system services issues

    Stop 0$2 messages can occur after )ou insta&& fau&t) app&ications' driers' or s)stem serices( 5f

    a fi&e is &isted %) name and )ou can associate it with an app&ication' uninsta&& the app&ication( 2or

    driers' disa%&e' remoe' or ro&& %ac/ the drier to determine if this reso&es the error( 5f it does'

    contact the hardware manufacturer for a possi%&e update( sing up-to-date software is especia&&)important for %ac/up programs' mu&timedia app&ications' antiirus scanners' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    47/54

    Common Stop Mess#ges ,0

    $arameter + This parameter is reserved @set aside for future useA*

    Troubleshooting the Stop '.E ErrorThe fo&&owing section descri%es the most common sources for this Stop error and suggests a

    trou%&eshooting so&ution(

    !river and system services issues

    A Stop 0$8E message might occur after )ou insta&& a fau&t) deice drier' s)stem serice' or

    firmware( 5f a Stop message &ists a drier %) name' disa%&e' remoe' or ro&& %ac/ the drier to

    correct the pro%&em( 5f disa%&ing or remoing driers reso&es the issues' contact the

    manufacturer a%out a possi%&e update( sing updated software is especia&&) important for

    mu&timedia app&ications' antiirus scanners' 969 p&a)%ac/' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    48/54

    ,8 Chapter 10 Troubleshooting Stop Errors

    freed* the pool bloc, header

    '.'''''''< 2ttempt to allocate poolat invalid I%65* Current I%65 $ool type Si/e of allocation

    '.''''''' 2ttempt to free pool atinvalid I%65*

    Current I%65 $ool type 2ddress of pool

    '.'''''''2 The current threadattempted to free poolmemory by using thewrong tag*

    2ddress of pool 2llocatorJs tag Tag being used

    '.'''''''?'.'''''''C?or'.'''''''!

    The current threadattempted to release a3uota on a corrupted poolallocation*

    2ddress of pool $oolallocationJstag

    ad 3uotaprocess pointer

    '.''''''+' 2ttempt to free ,ernelpool at user modeaddress*

    Starting address Start ofsystemaddressspace

    This value isalways /ero

    '.''''''+) 2ttempt to free a nonallocated nonpaged pooladdress*

    Starting address $hysical pageframe

    #ighest physicalpage frame

    '.''''''+& or'.''''''+(

    2ttempt to free a virtualaddress that was never inany pool*

    2ddress beingfreed

    This value isalways /ero

    This value isalways /ero

    '.''''''0' 2ttempt to free a nonallocated paged pool

    address*

    Starting address Start offset inpages from

    beginning ofpaged pool

    Si/e in bytes ofpaged pool

    '.''''''1' The current threadattempted to free aninvalid contiguousmemory address*

    Starting address This value isalways /ero

    This value isalways /ero

    '.'''''' 2ttempt to free pool withinvalid address orcorruption in pool header*

    2ddress beingfreed

    This value isalways /ero

    This value isalways /ero

    '.''''''2 2ttempt to allocate wasmar,edM4ST7S4CCEE!*

    $ool type Si/e ofallocation inbytes

    2llocations pooltag

    '.'''''' The current threadattempted to allocate apool with a tag of /ero*

    $ool type Si/e ofallocation inbytes

    CallerJs address

    '.''''''C The current threadattempted to allocate a

    $ool type Si/e ofallocation in

    CallerJs address

  • 8/12/2019 Troubleshooting Memory Dump

    49/54

    Common Stop Mess#ges ,

    pool with a tag of I>* bytes

    Troubleshooting the Stop '.C& Error

    The fo&&owing sections &ist the most common sources for this Stop error and suggest some

    trou%&eshooting so&utions(

    !river? system services? and firmware issues

    A Stop 0$C" message might occur after insta&&ing a fau&t) deice drier' s)stem serice' or

    firmware( 5f a Stop message &ists a drier %) name' disa%&e' remoe' or ro&& %ac/ the drier to

    correct the pro%&em( 5f disa%&ing or remoing driers reso&es the issues' contact the

    manufacturer a%out a possi%&e update( sing updated software is especia&&) important for

    mu&timedia app&ications' antiirus scanners' 969 p&a)%ac/' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    50/54

    )& Chapter 10 Troubleshooting Stop Errors

    *#+le 1&.%/ "#r#meters $or the Stop &2'E Mess#ge

    $arameter !escription

    $arameter ) Memory address referenced*

    $arameter & Type of access9

    '.'''''''' : read operation

    '.''''''') : write operation

    $arameter ( If non/ero? the address of the instruction that referenced the incorrect memorylocation*

    $arameter + This parameter is reserved @set aside for future useA*

    Troubleshooting the Stop '.CE Error

    The fo&&owing section descri%es the most common source for this Stop error and suggests a

    trou%&eshooting so&ution(

    !river and system services issues

    Stop 0$CE messages can occur after insta&&ing fau&t) driers or s)stem serices( 5f a drier is

    &isted %) name' disa%&e' remoe' or ro&& %ac/ that drier to confirm that this reso&es the error( 5f

    it does' contact the manufacturer a%out a possi%&e update( sing updated software is especia&&)

    important for %ac/up programs' mu&timedia app&ications' antiirus scanners' 969 p&a)%ac/' and

    C9

  • 8/12/2019 Troubleshooting Memory Dump

    51/54

    Common Stop Mess#ges )1

    *#+le 1&.%0 "#r#meters $or the Stop &2D1 Mess#ge

    $arameter !escription

    $arameter ) Memory referenced

    $arameter & I%65 at time of reference

    $arameter ( Type of access9

    '.'''''''' : read operation

    '.''''''') : write operation

    $arameter + 2ddress that referenced memory

    Troubleshooting the Stop '.!) Error

    The fo&&owing section descri%es the most common source for this Stop error and suggests a

    trou%&eshooting so&ution(!river and system services issues

    Stop 0$91 messages can occur after )ou insta&& fau&t) driers or s)stem serices( 5f a drier is

    &isted %) name' disa%&e' remoe' or ro&& %ac/ that drier to confirm that this reso&es the error( 5f

    it does' contact the manufacturer a%out a possi%&e update( sing updated software is especia&&)

    important for %ac/up programs' mu&timedia app&ications' antiirus scanners' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    52/54

    )% Chapter 10 Troubleshooting Stop Errors

    Troubleshooting the Stop '.!< Error

    2or suggestions a%out reso&ing pro%&ems re&ated to inade*uate PTEs' see +Stop 0$000000#2 or

    .@>M@RE>S3STEM>PTES, ear&ier in this chapter(

    Stop '.E2 orT#%E2!7ST4CK7I87!E-ICE7!%I-E%

    A deice drier pro%&em is causing the operating s)stem to pause indefinite&)( T)pica&&)' this

    pro%&em is caused %) a disp&a) drier waiting for the ideo hardware to enter an id&e state( This

    might indicate a hardware pro%&em with the ideo adapter or a fau&t) ideo drier(

    Interpreting the Stop '.E2 Message

    This Stop message has four parameters' as &isted in Ta%&e 10("(

    *#+le 1&.% "#r#meters $or the Stop &2E( Mess#ge

    $arameter !escription

    $arameter ) $ointer to the thread obGect that is caught in an infinite loop*

    $arameter & $ointer to a !EFE%%E!7"2TC#!O> obGect*This pointer is useful when youuse a ,ernel debugger to find out more information about this problem*

    $arameter ( The name of the driver that caused the Stop error*

    $arameter + "hen viewing the Stop message in the ,ernel debugger? this is the cumulativenumber of times the '.E2 bug chec, was intercepted* "hen viewing the Stopmessage on the computer screen? this parameter is always '.''''''')*

    Troubleshooting the Stop '.E2 Error

    The fo&&owing section descri%es the most common source for this Stop error and suggests a

    trou%&eshooting so&ution(

    !river and system services issues

    Stop 0$EA messages can occur after )ou insta&& fau&t) driers especia&&) ideo driers or

    s)stem serices( 5f a drier is &isted %) name' disa%&e' remoe' or ro&& %ac/ that drier to confirm

    that this reso&es the error( 5f it does' contact the manufacturer a%out a possi%&e update( sing

    updated software is especia&&) important for %ac/up programs' mu&timedia app&ications' antiirus

    scanners' 969 p&a)%ac/' and C9

  • 8/12/2019 Troubleshooting Memory Dump

    53/54

    Common Stop Mess#ges )3

    Interpreting the Stop '.E! Message

    This Stop message has two parameters' as &isted in Ta%&e 10(#0(

    *#+le 1&.3& "#r#meters $or the Stop O2ED Mess#ge

    $arameter !escription

    $arameter ) !evice obGect of the boot volume*

    $arameter & Status code from the file system describing why it failed to mount the volume*

    $arameter ( This parameter is reserved @set aside for future useA*

    $arameter + This parameter is reserved @set aside for future useA*

    Troubleshooting the '.E! Stop Error

    The fo&&owing section descri%es the most common source for this Stop error and suggests a

    trou%&eshooting so&ution(

    !is, controller and throughput issues

    6erif) that )our computer firmware' dis/ contro&&er' and ca%&ing support the storage s)stem( 2or

    e$amp&e' using an F0-wire ca%&e is optiona& for transfer rates up to and inc&uding ##(# mega%)tes

    per second' %ut is mandator) for higher transfer rates( The additiona& grounded pins are re*uired

    to preent data &oss( 6erif) that the ca%&es and hard dis/s are connected according to the hard

    dis/ manufacturerDs specifications(

    S