	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.3

Trying to Identify BSOB Issue

Asked by WaywardS0n in Debugging Software for Development, System Diagnostic Software, Windows XP Operating System

Tags: BSOD, memory dump, Error 0x00000051

Trying to apply a group policy to a large group of machines. All models work just fine except our DELL 755's. The BSOB is recieved before log in.
I've included the memory dump. How can I put my finger on the file/driver/service that causing me headaches? When setting up the dump file, only choices I had were mini dump or Kernal memory, I expected to see a third option but didn't.

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [\\amedwamct7551\c$\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is: C:\WINDOWS\Symbols;srv*C:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.090206-1233
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Sep 3 15:39:33.371 2009 (GMT-4)
System Uptime: 0 days 0:02:08.921
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 51, {4, 1, e41d9638, e02d18}

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

REGISTRY_ERROR (51)
Something has gone badly wrong with the registry. If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 00000004, (reserved)
Arg2: 00000001, (reserved)
Arg3: e41d9638, depends on where Windows bugchecked, may be pointer to hive
Arg4: 00e02d18, depends on where Windows bugchecked, may be return code of
      HvCheckHive if the hive is corrupt.

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x51

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 8062f066 to 804f9e0b

STACK_TEXT:
a94cf91c 8062f066 00000051 00000004 00000001 nt!KeBugCheckEx+0x1b
a94cf940 80633f1d 0000002e 00e02d18 d97f9cbc nt!CmpAssignSecurityToKcb+0x40
a94cf968 8062cedc e2058008 02eb8cb8 d97f9cbc nt!CmpCreateKeyControlBlock+0x1b5
a94cf9b8 8062d8bc e2058008 02eb8cb8 d97f9cbc nt!CmpDoOpen+0xf4
a94cfbb0 805bd9a9 02eb8cb8 02eb8cb8 8a5635c0 nt!CmpParseKey+0x558
a94cfc28 805ba454 0000078c a94cfc68 00000040 nt!ObpLookupObjectName+0x119
a94cfc7c 80623673 00000000 8b491040 a94cfd01 nt!ObOpenObjectByName+0xea
a94cfd50 8054088c 00100d68 01060009 0080f318 nt!NtOpenKey+0x1af
a94cfd50 7c90e514 00100d68 01060009 0080f318 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0080f358 00000000 00000000 00000000 00000000 0x7c90e514

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80503990-80503997 8 bytes - nt!KiServiceTable+30
      [ ce 33 5d 80 7e 33 5d 80:f8 1e ba 8a 30 fe bd 8a ]
805039a4-805039a7 4 bytes - nt!KiServiceTable+44 (+0x14)
      [ 8e 75 5a 80:98 64 c6 8a ]
805039dc-805039df 4 bytes - nt!KiServiceTable+7c (+0x38)
      [ a4 30 5a 80:c0 b2 b8 8a ]
80503a0c-80503a0f 4 bytes - nt!KiServiceTable+ac (+0x30)
      [ 72 55 61 80:18 5b c5 8a ]
80503a34-80503a37 4 bytes - nt!KiServiceTable+d4 (+0x28)
      [ c8 f8 5c 80:5a 0e ba ac ]
80503a64-80503a67 4 bytes - nt!KiServiceTable+104 (+0x30)
      [ 8e 27 62 80:90 36 ed ac ]
80503aac-80503aaf 4 bytes - nt!KiServiceTable+14c (+0x48)
      [ f6 19 5b 80:e0 39 ee 8a ]
80503ac4-80503ac7 4 bytes - nt!KiServiceTable+164 (+0x18)
      [ 16 73 5f 80:08 87 c1 8a ]
80503acc-80503acf 4 bytes - nt!KiServiceTable+16c (+0x08)
      [ 52 60 5d 80:b0 28 bb 8a ]
80503b10-80503b13 4 bytes - nt!KiServiceTable+1b0 (+0x44)
      [ 7e 0a 5b 80:f0 82 be 8a ]
80503b28-80503b2b 4 bytes - nt!KiServiceTable+1c8 (+0x18)
      [ 5c cf 60 80:18 c9 c5 8a ]
80503b4c-80503b4f 4 bytes - nt!KiServiceTable+1ec (+0x24)
      [ d0 bf 5e 80:10 5d bc 8a ]
80503b64-80503b67 4 bytes - nt!KiServiceTable+204 (+0x18)
      [ ee bf 5e 80:10 ad ee 8a ]
80503c24-80503c27 4 bytes - nt!KiServiceTable+2c4 (+0xc0)
      [ e8 01 62 80:80 77 0b 8b ]
80503c98-80503c9b 4 bytes - nt!KiServiceTable+338 (+0x74)
      [ 0a 32 5d 80:58 3e bb 8a ]
80503cb4-80503cb7 4 bytes - nt!KiServiceTable+354 (+0x1c)
      [ 02 00 5d 80:c8 f0 42 8b ]
80503cf0-80503cf7 8 bytes - nt!KiServiceTable+390 (+0x3c)
      [ 54 c7 5c 80 d8 a9 5c 80:58 53 bf 8a 30 4f ee 8a ]
80503d3c-80503d3f 4 bytes - nt!KiServiceTable+3dc (+0x4c)
      [ ee 07 62 80:e0 38 ed ac ]
80503d54-80503d5b 8 bytes - nt!KiServiceTable+3f4 (+0x18)
      [ d2 32 5d 80 44 31 5d 80:38 45 1d 8b d8 f8 bc 8a ]
80503d64-80503d6b 8 bytes - nt!KiServiceTable+404 (+0x10)
      [ 32 12 5d 80 2c 14 5d 80:68 c8 bb 8a 50 9e 1b 8b ]
80503d8c-80503d8f 4 bytes - nt!KiServiceTable+42c (+0x28)
      [ 8c 18 5b 80:c8 87 b8 8a ]
80503db4-80503db7 4 bytes - nt!KiServiceTable+454 (+0x28)
      [ 0c 2e 5b 80:60 49 c6 8a ]
805a30a4-805a30a8 5 bytes - nt!NtConnectPort
      [ 8b ff 55 8b ec:e9 c5 33 70 39 ]
805bb014-805bb018 5 bytes - nt!NtMakeTemporaryObject (+0x17f70)
      [ 8b ff 55 8b ec:e9 41 b4 6e 39 ]
805be9b6-805be9ba 5 bytes - nt!NtSetSecurityObject (+0x39a2)
      [ 8b ff 55 8b ec:e9 8b 7a 6e 39 ]
805c9d0a-805c9d0e 5 bytes - nt!NtOpenProcess (+0xb354)
      [ 68 c4 00 00 00:e9 59 c5 6d 39 ]
805c9f96-805c9f9a 5 bytes - nt!NtOpenThread (+0x28c)
      [ 68 c0 00 00 00:e9 e1 c2 6d 39 ]
805cc754-805cc758 5 bytes - nt!NtSetInformationProcess (+0x27be)
      [ 68 fc 00 00 00:e9 75 9b 6d 39 ]
805cfa2a-805cfa2b 2 bytes - nt!NtCreateProcessEx (+0x32d6)
      [ 6a 0c:e9 89 ]
805cfa2d-805cfa30 4 bytes - nt!NtCreateProcessEx+3 (+0x03)
      [ e8 a8 4d 80:6d 39 90 90 ]
805cfae0-805cfae4 5 bytes - nt!NtCreateProcess (+0xb3)
      [ 8b ff 55 8b ec:e9 bf 67 6d 39 ]
80620536-8062053a 5 bytes - nt!NtRestoreKey (+0x50a56)
      [ 8b ff 55 8b ec:e9 cd 5e 68 39 ]
80620ab6-80620abc 7 bytes - nt!NtUnloadKey (+0x580)
      [ 6a 68 68 c8 08 4e 80:e9 23 59 68 39 90 90 ]
806212fc-80621302 7 bytes - nt!NtQueryMultipleValueKey (+0x846)
      [ 6a 4c 68 60 09 4e 80:e9 85 50 68 39 90 90 ]
80621b54-80621b5a 7 bytes - nt!NtRenameKey (+0x858)
      [ 6a 34 68 b0 09 4e 80:e9 db 47 68 39 90 90 ]
8062212e-80622132 5 bytes - nt!NtCreateKey (+0x5da)
      [ 68 c4 00 00 00:e9 d7 41 68 39 ]
806225be-806225c4 7 bytes - nt!NtDeleteKey (+0x490)
      [ 6a 38 68 18 0a 4e 80:e9 5b 3d 68 39 90 90 ]
8062296e-80622974 7 bytes - nt!NtEnumerateKey (+0x3b0)
      [ 6a 54 68 70 0a 4e 80:e9 3f 3a 68 39 90 90 ]
80622bd8-80622bde 7 bytes - nt!NtEnumerateValueKey (+0x26a)
      [ 6a 54 68 b0 0a 4e 80:e9 bf 37 68 39 90 90 ]
806234c4-806234c8 5 bytes - nt!NtOpenKey (+0x8ec)
      [ 68 94 00 00 00:e9 2d 2e 68 39 ]
806237e8-806237ee 7 bytes - nt!NtQueryKey (+0x324)
      [ 6a 60 68 60 0b 4e 80:e9 43 2c 68 39 90 90 ]
80623aa8-80623aae 7 bytes - nt!NtLoadKey2 (+0x2c0)
      [ 6a 68 68 a0 0b 4e 80:e9 1b 29 68 39 90 90 ]
80623d0e-80623d12 5 bytes - nt!NtReplaceKey (+0x266)
      [ 8b ff 55 8b ec:e9 09 27 68 39 ]
80623e28-80623e2c 5 bytes - nt!NtNotifyChangeKey (+0x11a)
      [ 8b ff 55 8b ec:e9 c7 25 68 39 ]
226 errors : !nt (80503990-80623e2c)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

View the Solution FREE for 30 Days

20091118-EE-VQP-93 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. jcgriff29,800
2. chris_bot...6,000
3. roman24,600
4. abel4,500
5. duncan_roe4,000
5. madprogr...4,000
7. epasquier3,000
8. emoreau2,500
8. meverest2,500
8. jkr2,500
8. ragi00172,500
8. TechSoEasy2,500
8. apresto2,500
8. doades2,500
15. nobus2,400
16. MrClyfar2,000
16. Jbamaral2,000
16. locke_a2,000
16. t0t02,000
16. Sethi2,000
16. rg202,000
16. joinaunion2,000
16. oBdA2,000
16. gtokas2,000
16. McKnife2,000
16. nsr812,000
16. Snarf00012,000
16. mwvisa12,000
16. dericstone2,000
16. TeraByte...2,000
16. p_davis2,000
16. David-Ho...2,000
16. Ray_Pas...2,000
16. EMB012,000
16. Gary_Th...2,000
16. Jones9112,000
16. oklit2,000
16. treeandrew2,000
16. hathehariken2,000
16. pcelba2,000
16. Aleksei_...2,000
16. leakim9712,000

1. jcgriff29,800
2. jkr8,500
3. chris_bot...6,000
4. roman24,600
5. abel4,500
6. Dhaest4,000
6. sunnycoder4,000
6. duncan_roe4,000
6. madprogr...4,000
10. meverest3,500
11. MrClyfar3,000
11. epasquier3,000
13. emoreau2,800
14. ragi00172,500
14. TechSoEasy2,500
14. apresto2,500
14. jgordos2,500
14. doades2,500
19. nobus2,400
20. Qlemo2,150
21. Jbamaral2,000
21. dbrunton2,000
21. locke_a2,000
21. ericpete2,000
21. t0t02,000
21. Sethi2,000
21. rg202,000
21. logudotcom2,000
21. joinaunion2,000
21. oBdA2,000
21. mrGreen2,000
21. twoboats2,000
21. basicinsti...2,000
21. johnb67672,000
21. scrathcyboy2,000
21. gtokas2,000
21. pmascari2,000
21. dampsey2,000
21. McKnife2,000
21. nsr812,000
21. mtz1of42,000
21. vadimrapp12,000
21. Snarf00012,000
21. mwvisa12,000
21. evilrix2,000
21. ororiole2,000
21. dericstone2,000
21. TeraByte...2,000
21. p_davis2,000
21. David-Ho...2,000
21. Ray_Pas...2,000
21. MrHusy2,000
21. pcsmitpra2,000
21. slam692,000
21. EMB012,000
21. Gary_Th...2,000
21. paulsolov2,000
21. Jones9112,000
21. oklit2,000
21. treeandrew2,000
21. hathehariken2,000
21. pcelba2,000
21. Aleksei_...2,000
21. leakim9712,000

Trying to Identify BSOB Issue

Asked by WaywardS0n in Debugging Software for Development, System Diagnostic Software, Windows XP Operating System

Tags: BSOD, memory dump, Error 0x00000051

About this solution