• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 970
  • Last Modified:

HELP!!!!!!!.....Windows 2003 crashing without warning

I have two servers...one is a primary domain controller and other is a backup domain controller using active directory.

1.) Windows Small Business 2003 server with exchange and SQl server and about 15 users
2.) Windows Server 2003 with about 4 users

Each server is running Mcafee Virusscan 8.0 with on-access scanning enabled (which scans files each time there accessed (read and write))

My server just crashes to blue screen and dumps....It's not crashing from any pattern and the event viewer doesn't highlight anything unusuall.

Plus no data is being lost...yet!!  The other server with windows 2003 standard is running just fine but the small business server crashes.

What could be causing this problem
0
brian_leighty
Asked:
brian_leighty
  • 26
  • 14
  • 12
  • +4
1 Solution
 
Dan_KimCommented:
This is just a guess, but if everything was running fine at one point and you can find nothing in the logs to explain the BSOD it might be a hardware problem.

My first guess would be you have a bad stick of RAM.

0
 
brian_leightyAuthor Commented:
Well the server is dual zeon 3.0Ghz with two sticks of 512 running dual channel
I did have to replace a stick earlier when I was building this server



I get  PFN_List_Corrupt in one blue screen

0
 
tonyteriCommented:
How much earlier.  Try removing the stick you replaced, and run that for a day

/TT
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 
Dan_KimCommented:
http://support.microsoft.com/?kbid=291806&sd=RMVP

Also try this, it looks like that error is a driver BSOD.

hope this helps.
0
 
cpc2004Commented:
When Windows crashes with blue screen, it writes a system event 1001 and a minidump to the folder \winnt\minidump. Check system event 1001 and it has the content of the blue screen

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content and paste it back here

Zip 3 to 4 minidumps and attach the zip files at any webspace. I will study the dump and find out the culprit.
0
 
brian_leightyAuthor Commented:

System Event:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000004e (0x00000007, 0x00035343, 0x00000001, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
cpc2004Commented:
Maybe bad ram or faulty CPU.
http://www.experts-exchange.com/Hardware/Q_21215008.html#12856682

I can't help you if you would not provide the minidump (ie. C:\windows\minidump) or Drwatson log C:\Documents and Settings\AllUsers\Documents\DrWatson\drwtsn32.log
0
 
brian_leightyAuthor Commented:
I'm setting up a account with streamload for the minidumps
0
 
Seelan NaidooMicrosoft Systems AdminCommented:
try disabling your Virus Scan for a day and see what happens.
You can also scan the server from another machine.
0
 
brian_leightyAuthor Commented:
go to   www.streamload.com

log in name is:        terabyte_junki
password is:         ih28lgih28lg


the minidumps are there
0
 
cpc2004Commented:
Hi Brian,

When I try to download and it asks for confirmation of your email address. Would you fix iit.
 
Sorry, but this function is disabled until you either verify your email address or subscribe to Streamload.

We sent you an email confirmation when you first signed up, but you haven't clicked the link in that email to verify your address yet.
0
 
brian_leightyAuthor Commented:
working on it brb
0
 
brian_leightyAuthor Commented:
try this again i verified my email
0
 
brian_leightyAuthor Commented:
cpc2004 where you able to log in to streamload
0
 
cpc2004Commented:
Two  debug report indicates that it is probably caused by naiavf5x.sys. De-install Virus Scan Enterprise 7.0 or upgrade it to the most current patch.

Only one minidumps crashes with bugcheck code C2 and allare crash with 4E.
0
 
brian_leightyAuthor Commented:
what does that mean c2 and 4e

Im not good with debugging
0
 
cpc2004Commented:
Bugcheck code is same as stop code
Mini042205-01.dmp
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 000173a1, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Mini032805-01.dmp
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000a, Attempt to free some other component's protected pool.
Arg2: 84c5a000, Address of pool
Arg3: 20206f49, Pool allocation's tag
Arg4: 00000000, Quota process pointer (bad).
0
 
brian_leightyAuthor Commented:
what does this mean and how do i fix it...

thanks
b
0
 
cpc2004Commented:
Two debug reports indicate that the crashes are probably caused by naiavf5x.sys. De-install Virus Scan Enterprise 7.0 or upgrade it to the most current patch.
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Did you install Server 2003 SP1???  If so, it wasn't intended for SBS  http://www.microsoft.com/downloads/details.aspx?familyid=244af252-2cf3-4a84-bc79-57ec3db2dea9&displaylang=en

You can possibly uninstall it, or troubleshoot as described above.  Here's more info:  http://seanda.blogspot.com/2005/03/official-windows-server-2003-sp1-on.html

Jeff
TechSoEasy
0
 
brian_leightyAuthor Commented:
PFN_LIST_CORRUPT (4e)

can you verify if this is a hardware issue or a software issue cpc2004

I have seen this in a blue screen before but it's been a while..

Thanks
0
 
cpc2004Commented:
At my previuos post and my comment it is a software error at Virus Scan Enterprise 7.0. If it is a hardware error, you  have a huge Dr Watson log and you can find it at C:\Documents and Settings\All Users\Documents\DrWatson\drwtsn32.log
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
I would ask again... Did you just install SP1?

Please see this:  http://www.mcse.ms/message1567959.html

Jeff
TechSoEasy
0
 
brian_leightyAuthor Commented:
I don't think so  It doesnt show up in remove programs
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
You would probably remember if you installed SP1, as it's a major update... but checking add/remove programs isn't necessarily authoritative because if it was a faulty install it may not be there...

Take a look at this directory: C:\WINDOWS\system32\drivers and see if there are any files which have a modified date that is recent (within the last few weeks or so).  

Also... you didn't specify whether you troubleshot the issue as prescribed in the above mentioned KB's... while it isn't fully operational yet, you may want to know that the link shown in your error messages (http://go.microsoft.com/fwlink/events.asp) SHOULD be clicked on and will take you directly to pertinent KB articles in the Help & Support center of your server.

Jeff
TechSoEasy
0
 
brian_leightyAuthor Commented:

The server crashed again I have uploaded the minidump the same account as used earlier..........
Could you please examine this dmp file and let me know what it is that happened.......
The dump file is        Mini051205-01.dmp

stop code: 0x0000004e (0x00000007, 0x00033182, 0x00000001, 0x00000000)

thanks
0
 
cpc2004Commented:
Have you de-install Virus Scan Enterprise 7.0 or upgrade it to the most current patch? Do you find a huge Dr Watson log?
0
 
brian_leightyAuthor Commented:
have uninstalled antivirus but cannot find dr watson log

0
 
cpc2004Commented:
When did you un-install the antivirus?
0
 
brian_leightyAuthor Commented:
I did have protectionpilot which is a program that came with the antivirus.  this program controls all the antivirus agents throughout the network.  When I uninstall the antivirus the protectionpilot manager would install it again eventually, and they have to exist together.  So after uninstalling the protection pilot I can then officially uninstall anitvirus.  The first time I uninstalled anitvirus it shoulded up again after the weekend.  Yesterday I uninstalled antivirus officially but the server needed a restart.... I believe so that naiavf5x.sys probably was still in the system's memory....this morning i noticed the logon screen because it crashed and rebooted..  I hope that now it will not crash....


what did the minidump say???


brian
0
 
cpc2004Commented:
The latest dump is the same as the previous dump
Bugcheck code 4E and the naiavf5x.sys was in the memory. I'e searched microsft Website and no known problem of bugcheck code 4E at Windows 2003. I think de-install the antivirus software may resolve the problem

Summary of your last 5 dumps.
                                                                                                   probably cause by
Mini042205-01.dmp 4E (00000007, 000173A1, 00000001, 00000000) nt!MmUnlockPages+2a6
Mini042205-02.dmp 4E (00000007, 00039759, 00000001, 00000000) nt!MmUnlockPages+2a6
Mini042505-01.dmp 4E (00000007, 000100eb, 00000001, 00000000) naiavf5x+7fc6
Mini043005-01.dmp 4E (00000007, 0000e20d, 00000001, 00000000) nt!MmUnlockPages+2a6
Mini051205-01.dmp 4E (00000007, 00033182, 00000001, 00000000) nt!MmUnlockPages+2a6
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Brian,

You said your server is a dual Xeon... is it a whitebox? or is there a brand and model #?

Jeff
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
After reading through all of this thread again... it really looks like you have some faulty RAM.  If you run MemTest86+ (http://www.memtest.org/) it will tell you right away.

Jeff
TechSoEasy
0
 
brian_leightyAuthor Commented:
hey guys I have used all memory testers I could find including the one from above and no errors where found...

I have uploaded two more mini dumps to www.streamload.com   password and login are the same

If somebody could take a look and tell me whats going on....oh ya I even switched out the memory for different sticks of ECC 333MHz  

thanks
0
 
brian_leightyAuthor Commented:
the files are dated 5-18 and 5-22
0
 
brian_leightyAuthor Commented:
HELLO!!!!
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Is ECC enabled in your BIOS?
0
 
brian_leightyAuthor Commented:
I'm not really sure!!!

Is that a option!!
0
 
brian_leightyAuthor Commented:
THere is no place were it asks for ECC I'm assuming that it is on

All BIOS updates have been flashed
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
what's the BIOS name and version?
0
 
brian_leightyAuthor Commented:
What is this saying:  This is from the last shutdown.


STACK_TEXT:  
f6261a0c 805304ed 0000004e 00000007 00038422 nt!PoRunDownDeviceObject+0x9f
f6261aec 804fc718 e1365008 e1365014 e1365014 nt!FsRtlUninitializeOplock+0x4c
f6261b34 804fbfb9 85e275a0 00000000 00003000 nt!memmove+0x188
f6261bbc f71d5845 00003000 00000000 00000000 nt!_aulldvrm+0x81
f6261be8 f71d568c 8516b630 e14b61a0 00000000 Ntfs!NtfsRestartRemoveAttribute+0x7
f6261c58 f71d58ff 8516b630 851c4008 851c4008 Ntfs!NtfsGetDelWindow+0x45
f6261cbc 804f0473 85e87020 851c4008 86325018 Ntfs!NtfsLookupCachedLcnByLength+0x25
f6261ce0 8058c549 85e87020 851c4018 85ed6028 nt!PoCallDriver+0x8f
f6261d54 804dfd24 00001994 00f9fa2c 00000000 nt!ObpObjectTypes+0x29
f6261d64 00000000 00000000 00000000 00000000 nt!`string'+0x10



How do I get the bios name and version without restarting computer I cannot shutdown right now....

I have a replacement motherboard on the way..it's the exact same motherboard.....I think that the RAM is ok becasue it's been replaced and problem still exists...

I got to get this server running...

Thanks
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Start > All Programs > Accessories > System Tools > System Information

The system summary on the right side will have your BIOS version.

Jeff
TechSoEasy
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Can you also tell me what VIDEO driver/s you have installed??

Thanks.
0
 
brian_leightyAuthor Commented:
Intel Corporation SE7320SP20.86B.P.06.00.0031.111920041138    11/19/2004
0
 
brian_leightyAuthor Commented:
ATI RAGE XL onboard video   I have microsoft's default driver installed.
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Well, there is a more recent driver out (4/15/2005): http://downloadfinder.intel.com/scripts-df-external/filter_results.aspx?strTypes=all&ProductID=1660&OSFullName=Windows*+Server+2003&lang=eng&strOSs=84&submit=Go%21


The complete Mobo specs are here:  http://www.intel.com/design/servers/boards/se7320sp2/

It does spec this RAM:  Registered ECC DDR 266/333 SDRAM 72-bit, 184-pin gold-plated DIMMs


Otherwise... have you submitted your .dmp file to the Microsoft Online Crash Analysis yet?  You should be getting that option when the dump report completes... don't say "no" and it will upload to MS.  SEE http://oca.microsoft.com for more info.  It really makes sense for you to use that resolution resource since the knowledgebase resides there.

Jeff
TechSoEasy
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Re, the video driver... having MS's default installed should be fine then... there are some video drivers that are rather sensitive to sharing IRQs.
0
 
brian_leightyAuthor Commented:
can it be done after the fact....I just don't want to wait until it crashes again to send in a report
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
no, I don't think so... did you check to make sure that your RAM is exactly as specified by Intel?  Also, there were a few other updated drivers that you may want to use...  every indication is that you have a device conflict of some sort (or improper/bad RAM)... so just make sure that you have the right drivers and there are no obviously bad conflicts in the System Information report.

0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
One other question... since I reread your initial question... you say... SBS with 15 users and Server 2003 standard with 4 users??? What do you mean by that?

Do you have more than one domain?
0
 
brian_leightyAuthor Commented:
one domain  I really mean that certain shares on specific servers are for the users....they all login the SBS server but engineering uses the file serving ability on the standard....
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
okay... was just checking to be sure...
0
 
brian_leightyAuthor Commented:
could a bad network cable have something to do with the BSOD
0
 
cpc2004Commented:
Brian,
I think antivirus software is the culprit and you haven't responsed to my comment
0
 
juleslamondCommented:
I have this prob where after leaving the SB server 2003 on for couple hours or overnight, it gives me a blank screen and I can't CTRL+ALT+DEL. I can only move the mouse. Checking event viewer I found the following errors in the application log:

Product: Microsoft SQL Server Desktop Engine - Update '{1F506503-186B-4D88-81B3-7113B9457C9D}' could not be installed. Error code 1603.

Reporting queued error: faulting application lsass.exe, version 5.2.3790.0, faulting module kerberos.dll, version 5.2.3790.0, fault address 0x0000cff7.
0
 
cpc2004Commented:
This is a hardware problem.  The author opened another problem and you can refer the following url
http://www.experts-exchange.com/Operating_Systems/Windows_Server_2003/Q_21477515.html
0
 
brian_leightyAuthor Commented:
6 hours on phone with microsft guys .....ear is numb but think it was a processor issue.....don't make since but that what those guys are there for...
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

  • 26
  • 14
  • 12
  • +4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now