2003 server event id 1003

Posted on 2006-05-23
Last Modified: 2012-06-21
I have been having a problem with a 2003 server DC rebooting and am trying to resolve the problem.
I recently transferred AD from a 2000 server, followed all the usual things - adprep the 2000 box and moved all the roles. The old 2000 server is now only a member server. The 2003 box spontaneously reboots and I am having a problem trying to find what is causing it.

The system errors event id 1003  I get are different

Error code 00000024, parameter1 0019033c, parameter2 f78c2ae4, parameter3 f78c27e0, parameter4 bafb4933.

on one occation, and

Error code 0000000a, parameter1 01dc341c, parameter2 00000002, parameter3 00000001, parameter4 8083dee3.

these feel like hardware, but can anyone help me?

I also had a  master browser error just before the unexpected shutdown

The master browser has received a server announcement from the computer CCTST001 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{CF4BAB1D-3678-4450-. The master browser is stopping or an election is being forced.

CCTST001 is the name of the old server. I have changed the registry entry IsDomainMaster on the new 2003 server to TRUE which I believe will force the new box as the preferred Browser. I have also disabled the Browser service on the 2000 member server.
Question by:smelliesavage
    LVL 48

    Expert Comment

    Hi smelliesavage,

    sounds like hardware for sure, lets start with your RAM as its the most common thing to die...

    run this and see what you find
    LVL 48

    Expert Comment


    also, whats the exact error you get in your logs regarding that 1003 error

    Author Comment

    codes at the bottom of the error are (don't know if this helps)

    0000: 74737953 45206d65 726f7272 72452020
    0010: 20726f72 65646f63 30303020 30303030
    0020: 50202061 6d617261 72657465 31302073
    0030: 34336364 202c6331 30303030 32303030
    0040: 3030202c 30303030 202c3130 33383038
    0050: 33656564

    source: System Error

    also had a save dump before the 1003 error "Error code 0000000a, parameter1 01dc341c, parameter2 00000002, parameter3 00000001, parameter4 8083dee3."

    details of the save dump:
    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x01dc341c, 0x00000002, 0x00000001, 0x8083dee3). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

    I will try to swap out the ram and test it. The box has been running fine before we dcpromo'd it. Perhaps as a dc it puts more strain on it.

    Can I memtest86 in windows, I do have a metest utility by HCI Design which runs in windows. The reason is I am trying to diagnose this remotely

    Author Comment

    am running the memtest in windows
    LVL 48

    Expert Comment

    unfortuntely no, you have to run memtest from boot

    have a look at this tool though, i think there may be a faulty driver on your server;en-us;244617

    this will at least help to diagnose if it is......
    LVL 48

    Expert Comment


    this is a good read too, lots and lots of exciting dribble :) :) :)
    LVL 28

    Expert Comment

    Following this article you can configure your system to not automatically restart next time it crashes. This gives you the chance to examine the blue screen. This info can help to determine the faulty driver/system component. Disadavantage: you have to go there to reboot it.

    Anyway turn on at least the creation of a mini dump file or even the full dump file and analyze it, see here for how to do it:

    The code  0000000a error points into the direction of a faulty driver. found nothing regarding the 00000024 stop code...

    Author Comment

    Had another crash. followed the instructions for the analysis tool to create debuglog.txt which is as follows (this time a d1 error)

    Opened log file 'c:\debuglog.txt'
    kd> .sympath srv*c:\symbols*
    Symbol search path is: srv*c:\symbols*
    WARNING: Whitespace at end of path element
    kd> .sympath srv*c:\symbols*
    Symbol search path is: srv*c:\symbols*
    kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arg1: 00000000, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: baf3683f, address which referenced memory

    Debugging Details:

    *** ERROR: Module load completed but symbols could not be loaded for m4cxw2k3.sys

    READ_ADDRESS:  00000000


    baf3683f 8b4508           mov     eax,[ebp+0x8]



    LAST_CONTROL_TRANSFER:  from baf3683f to 80886099

    808944a8 baf3683f badb0d00 00000000 00000000 nt!KiTrap0E+0x2a1
    8089451c bac394ac 89d572b0 89d57004 89d57104 NDIS!NdisInterlockedIncrement+0x5
    WARNING: Stack unwind information not available. Following frames may be wrong.
    89d57004 00000000 0000de00 0000de00 00000100 m4cxw2k3+0xc4ac


    bac394ac 83f801           cmp     eax,0x1



    FOLLOWUP_NAME:  MachineOwner

    SYMBOL_NAME:  m4cxw2k3+c4ac

    MODULE_NAME:  m4cxw2k3

    IMAGE_NAME:  m4cxw2k3.sys


    FAILURE_BUCKET_ID:  0xD1_VRF_m4cxw2k3+c4ac

    BUCKET_ID:  0xD1_VRF_m4cxw2k3+c4ac

    Followup: MachineOwner

    eax=ffdff13c ebx=00000002 ecx=00000001 edx=00000000 esi=ffdff120 edi=00000000
    eip=80886099 esp=80894490 ebp=808944a8 iopl=0         nv up ei ng nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
    80886099 833d80f3898000 cmp dword ptr [nt!KiFreezeFlag (8089f380)],0x0 ds:0023:8089f380=00000000
    ChildEBP RetAddr  Args to Child              
    808944a8 baf3683f badb0d00 00000000 00000000 nt!KiTrap0E+0x2a1 (FPO: [0,0] TrapFrame @ 808944a8)
    8089451c bac394ac 89d572b0 89d57004 89d57104 NDIS!NdisInterlockedIncrement+0x5 (FPO: [Non-Fpo])
    WARNING: Stack unwind information not available. Following frames may be wrong.
    89d57004 00000000 0000de00 0000de00 00000100 m4cxw2k3+0xc4ac
    start    end        module name
    80800000 80a47000   nt       ntkrnlpa.exe Fri Mar 25 00:28:04 2005 (42435B14)
    80a47000 80a73000   hal      halaacpi.dll Fri Mar 25 00:28:37 2005 (42435B35)
    b766c000 b767f000   sysaudio sysaudio.sys Fri Mar 25 00:40:23 2005 (42435DF7)
    b767f000 b769a000   wdmaud   wdmaud.sys   Fri Mar 25 00:40:49 2005 (42435E11)
    b781a000 b7828000   ipfltdrv ipfltdrv.sys Fri Mar 25 00:33:57 2005 (42435C75)
    b782a000 b7857000   RDPWD    RDPWD.SYS    Wed Jun 15 16:33:14 2005 (42B04A3A)
    b7a7f000 b7a8a000   TDTCP    TDTCP.SYS    Fri Mar 25 00:27:15 2005 (42435AE3)
    b7cdf000 b7cf3000   nwlnkspx nwlnkspx.sys Fri Mar 25 00:33:30 2005 (42435C5A)
    b7eab000 b7f09000   srv      srv.sys      Wed May 04 03:44:01 2005 (427836F1)
    b802b000 b803f000   nwlnknb  nwlnknb.sys  Tue Mar 25 07:10:07 2003 (3E8000CF)
    b8067000 b8082000   nwlnkipx nwlnkipx.sys Fri Mar 25 00:33:26 2005 (42435C56)
    b82d2000 b82db000   ndisuio  ndisuio.sys  Fri Mar 25 00:33:16 2005 (42435C4C)
    ba302000 ba31e000   dump_atapi dump_atapi.sys Fri Mar 25 00:28:49 2005 (42435B41)
    ba31e000 ba333000   Cdfs     Cdfs.SYS     Fri Mar 25 00:40:55 2005 (42435E17)
    ba365000 ba376000   Fips     Fips.SYS     Fri Mar 25 00:40:33 2005 (42435E01)
    ba376000 ba3ec000   mrxsmb   mrxsmb.sys   Fri Mar 25 00:41:13 2005 (42435E29)
    ba3ec000 ba41c000   rdbss    rdbss.sys    Fri Mar 25 00:40:49 2005 (42435E11)
    ba41c000 ba446000   afd      afd.sys      Fri Mar 25 00:40:43 2005 (42435E0B)
    ba446000 ba477000   netbt    netbt.sys    Fri Mar 25 00:40:31 2005 (42435DFF)
    ba477000 ba4d8000   tcpip    tcpip.sys    Fri Jan 13 02:12:43 2006 (43C70C9B)
    ba4d8000 ba4f1000   ipsec    ipsec.sys    Fri Mar 25 00:40:49 2005 (42435E11)
    ba60b000 ba61f000   usbhub   usbhub.sys   Fri Mar 25 00:30:46 2005 (42435BB6)
    ba667000 ba6a7000   update   update.sys   Fri Mar 25 00:40:27 2005 (42435DFB)
    ba6cf000 ba706000   rdpdr    rdpdr.sys    Fri Mar 25 00:30:20 2005 (42435B9C)
    ba786000 ba790000   Dxapi    Dxapi.sys    Tue Mar 25 07:06:01 2003 (3E7FFFD9)
    ba796000 ba79f000   dump_WMILIB dump_WMILIB.SYS Tue Mar 25 07:13:00 2003 (3E80017C)
    ba7a6000 ba7b9000   raspptp  raspptp.sys  Fri Mar 25 00:40:43 2005 (42435E0B)
    ba7b9000 ba7d3000   ndiswan  ndiswan.sys  Fri Mar 25 00:40:46 2005 (42435E0E)
    ba7d3000 ba7e8000   rasl2tp  rasl2tp.sys  Fri Mar 25 00:40:29 2005 (42435DFD)
    ba7e8000 ba7fb000   i8042prt i8042prt.sys Fri Mar 25 00:41:05 2005 (42435E21)
    ba7fb000 ba813000   parport  parport.sys  Fri Mar 25 00:28:25 2005 (42435B29)
    ba813000 ba828000   serial   serial.sys   Fri Mar 25 00:28:29 2005 (42435B2D)
    ba828000 ba83d000   drmk     drmk.sys     Fri Mar 25 00:30:34 2005 (42435BAA)
    ba83d000 ba866000   portcls  portcls.sys  Fri Mar 25 00:40:46 2005 (42435E0E)
    ba866000 bac2ccc0   ALCXWDM  ALCXWDM.SYS  Mon Mar 20 06:45:48 2006 (441E4F9C)
    bac2d000 bac64900   m4cxw2k3 m4cxw2k3.sys Thu Mar 10 13:11:15 2005 (42304773)
    bac65000 bac8d000   ks       ks.sys       Fri Mar 25 00:41:03 2005 (42435E1F)
    bac8d000 baca1000   redbook  redbook.sys  Fri Mar 25 00:28:46 2005 (42435B3E)
    baca1000 bacb6000   cdrom    cdrom.sys    Fri Mar 25 00:28:57 2005 (42435B49)
    bacb6000 bace0000   USBPORT  USBPORT.SYS  Fri Mar 25 00:30:43 2005 (42435BB3)
    bace0000 bacfb000   VIDEOPRT VIDEOPRT.SYS Fri Mar 25 00:29:53 2005 (42435B81)
    bacfb000 bae7e000   ati2mtag ati2mtag.sys Wed Mar 22 03:56:21 2006 (4420CAE5)
    baf16000 baf35000   Mup      Mup.sys      Fri Mar 25 00:40:49 2005 (42435E11)
    baf35000 baf6b000   NDIS     NDIS.sys     Fri Mar 25 00:40:26 2005 (42435DFA)
    baf6b000 bb000000   Ntfs     Ntfs.sys     Fri Mar 25 00:40:29 2005 (42435DFD)
    bf800000 bf9d0000   win32k   win32k.sys   Thu Oct 06 01:37:08 2005 (434471B4)
    bf9d0000 bf9e6000   dxg      dxg.sys      Fri Mar 25 00:27:25 2005 (42435AED)
    bf9e6000 bfa29000   ati2dvag ati2dvag.dll Wed Mar 22 03:56:42 2006 (4420CAFA)
    bfa29000 bfa68000   ati2cqag ati2cqag.dll Wed Mar 22 03:12:22 2006 (4420C096)
    bfa68000 bfa9e000   atikvmag atikvmag.dll Wed Mar 22 03:18:34 2006 (4420C20A)
    bfa9e000 bfd28120   ati3duag ati3duag.dll Wed Mar 22 03:40:09 2006 (4420C719)
    bfd29000 bfe3d100   ativvaxx ativvaxx.dll Wed Mar 22 03:33:39 2006 (4420C593)
    bff60000 bff7e000   RDPDD    RDPDD.dll    Fri Mar 25 02:30:48 2005 (424377D8)
    f7244000 f726b000   KSecDD   KSecDD.sys   Fri Mar 25 00:28:53 2005 (42435B45)
    f726b000 f7290000   fltMgr   fltMgr.sys   Fri Mar 25 00:30:25 2005 (42435BA1)
    f7290000 f72a3000   CLASSPNP CLASSPNP.SYS Fri Mar 25 00:40:23 2005 (42435DF7)
    f72a3000 f72bf000   atapi    atapi.sys    Fri Mar 25 00:28:49 2005 (42435B41)
    f72bf000 f72e9000   volsnap  volsnap.sys  Fri Mar 25 00:29:10 2005 (42435B56)
    f72e9000 f7315000   dmio     dmio.sys     Fri Mar 25 00:30:02 2005 (42435B8A)
    f7315000 f733c000   ftdisk   ftdisk.sys   Fri Mar 25 00:29:00 2005 (42435B4C)
    f733c000 f7352000   pci      pci.sys      Fri Mar 25 00:34:14 2005 (42435C86)
    f7352000 f7386000   ACPI     ACPI.sys     Fri Mar 25 00:34:09 2005 (42435C81)
    f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 07:13:00 2003 (3E80017C)
    f7497000 f74a6000   isapnp   isapnp.sys   Tue Mar 25 07:16:35 2003 (3E800253)
    f74a7000 f74b4000   PCIIDEX  PCIIDEX.SYS  Fri Mar 25 00:28:48 2005 (42435B40)
    f74b7000 f74c7000   MountMgr MountMgr.sys Fri Mar 25 00:27:23 2005 (42435AEB)
    f74c7000 f74d2000   PartMgr  PartMgr.sys  Fri Mar 25 00:40:34 2005 (42435E02)
    f74d7000 f74e7000   disk     disk.sys     Fri Mar 25 00:28:58 2005 (42435B4A)
    f74e7000 f74f3000   Dfs      Dfs.sys      Fri Mar 25 00:30:28 2005 (42435BA4)
    f74f7000 f7501000   crcdisk  crcdisk.sys  Fri Mar 25 00:29:40 2005 (42435B74)
    f7517000 f7526000   amdk8    amdk8.sys    Fri Mar 25 00:28:41 2005 (42435B39)
    f7527000 f7530000   watchdog watchdog.sys Fri Mar 25 00:30:19 2005 (42435B9B)
    f7537000 f7542000   fdc      fdc.sys      Fri Mar 25 00:28:43 2005 (42435B3B)
    f7547000 f7551000   serenum  serenum.sys  Fri Mar 25 00:28:27 2005 (42435B2B)
    f7557000 f7561000   mouclass mouclass.sys Tue Mar 25 07:03:09 2003 (3E7FFF2D)
    f7567000 f7571000   kbdclass kbdclass.sys Tue Mar 25 07:03:10 2003 (3E7FFF2E)
    f7577000 f7580000   ndistapi ndistapi.sys Fri Mar 25 00:34:11 2005 (42435C83)
    f7587000 f7596000   raspppoe raspppoe.sys Fri Mar 25 00:34:16 2005 (42435C88)
    f7597000 f75a2000   TDI      TDI.SYS      Fri Mar 25 00:35:34 2005 (42435CD6)
    f75a7000 f75b2000   ptilink  ptilink.sys  Fri Mar 25 00:28:25 2005 (42435B29)
    f75b7000 f75c0000   raspti   raspti.sys   Fri Mar 25 00:34:16 2005 (42435C88)
    f75c7000 f75d6000   termdd   termdd.sys   Fri Mar 25 00:27:15 2005 (42435AE3)
    f75d7000 f75e0000   mssmbios mssmbios.sys Fri Mar 25 00:34:14 2005 (42435C86)
    f75e7000 f75f5000   NDProxy  NDProxy.SYS  Fri Mar 25 00:34:13 2005 (42435C85)
    f7627000 f7631000   flpydisk flpydisk.sys Tue Mar 25 07:04:32 2003 (3E7FFF80)
    f7637000 f7643000   vga      vga.sys      Fri Mar 25 00:29:54 2005 (42435B82)
    f7647000 f7652000   Msfs     Msfs.SYS     Fri Mar 25 00:30:04 2005 (42435B8C)
    f7657000 f7664000   Npfs     Npfs.SYS     Fri Mar 25 00:30:04 2005 (42435B8C)
    f7667000 f7675000   msgpc    msgpc.sys    Fri Mar 25 00:33:31 2005 (42435C5B)
    f7677000 f7684000   wanarp   wanarp.sys   Fri Mar 25 00:34:07 2005 (42435C7F)
    f7687000 f7694000   netbios  netbios.sys  Fri Mar 25 00:33:21 2005 (42435C51)
    f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 07:08:00 2003 (3E800050)
    f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 07:07:58 2003 (3E80004E)
    f7717000 f771e000   pciide   pciide.sys   Tue Mar 25 07:04:46 2003 (3E7FFF8E)
    f771f000 f7726000   dmload   dmload.sys   Tue Mar 25 07:08:08 2003 (3E800058)
    f7757000 f775b400   usbohci  usbohci.sys  Fri Mar 25 00:30:45 2005 (42435BB5)
    f775f000 f7765a00   usbehci  usbehci.sys  Fri Mar 25 00:30:43 2005 (42435BB3)
    f776f000 f7776000   parvdm   parvdm.sys   Tue Mar 25 07:03:49 2003 (3E7FFF55)
    f7777000 f777f000   audstub  audstub.sys  Tue Mar 25 07:09:12 2003 (3E800098)
    f7787000 f778f000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 07:08:36 2003 (3E800074)
    f778f000 f7796000   Null     Null.SYS     Tue Mar 25 07:03:05 2003 (3E7FFF29)
    f7797000 f779e000   Beep     Beep.SYS     Tue Mar 25 07:03:04 2003 (3E7FFF28)
    f779f000 f77a7000   mnmdd    mnmdd.SYS    Tue Mar 25 07:07:53 2003 (3E800049)
    f77a7000 f77af000   RDPCDD   RDPCDD.sys   Tue Mar 25 07:03:05 2003 (3E7FFF29)
    f77af000 f77b7000   rasacd   rasacd.sys   Tue Mar 25 07:11:50 2003 (3E800136)
    f77df000 f77e6000   dxgthk   dxgthk.sys   Tue Mar 25 07:05:52 2003 (3E7FFFD0)
    f7987000 f7988280   swenum   swenum.sys   Fri Mar 25 00:27:42 2005 (42435AFE)
    f7989000 f798a580   USBD     USBD.SYS     Tue Mar 25 07:10:39 2003 (3E8000EF)
    f7b19000 f7bdf000   dmboot   dmboot.sys   Fri Mar 25 00:30:03 2005 (42435B8B)

    Unloaded modules:
    ba521000 ba529000   drmkaud.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    b754e000 b757e000   kmixer.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    b757e000 b7590000   DMusic.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    b7590000 b75a4000   swmidi.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    b75a4000 b75cc000   aec.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    f79db000 f79dd000   splitter.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    f79d9000 f79db000   FLASHSYS.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    f77d7000 f77dc000   NTACCESS.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    f7697000 f76a5000   imapi.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    f777f000 f7787000   Sfloppy.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
    Closing open log file c:\debuglog.txt
    LVL 48

    Expert Comment

    was that from the driver verification tool?

    Author Comment

    no - from the windbg tool suggested by mpfister above

    I downloaded the verifier and installed  tool, (requires reboot)
    then ran verifier /log to which produced a v large log file which I don't quite know how to interpret. Don't know if I have used this correctly
    LVL 48

    Expert Comment

    you can email me the log if you like and ill see if i can make sense of it
    LVL 28

    Accepted Solution

    Is this a DLINK network card you have there in your server? Either the driver is faulty or the card is bad.

    Steps to take from her:
    1) Check if DLink provides updated drivers for your network card. If yes, update the drivers and see if your server still crashes. I
    2) Replace the DLink card with a good server card, like Intel sells.

    The dump shows that the system crashes somewhere around the NDIS functions, a search for m4cxw2k3 shows this is a driver for a DLink network card.
    Hope it helps,


    Author Comment

    Thanks mpfister - yes it is a dlink card.

    The server finally rebooted and wouldn't come backup again until I removed one of the disks, and then hey presto - it runs fine. Only snag was it was a data disk and the raid was not workin properly. Thankfully I have been able to get the data disk up and running on an XP pro box and am getting the data off now (THIS IS ALL BRAND NEW KIT!!!!)  I suspect there may be more than one hardware problem here and I am adding another DC AND reset up everything on that using all new hardware. Useful tip re the dlink card. I will give it some hammer in another box where we are not so dependent.

    Thanks for hardwork - this is the first time I have asked a question here although I ave been checking the forums for years.

    Would be useful to know the best way of diagnosing stop errors for the future. Is the windbg a good option?
    LVL 28

    Expert Comment

    Very strange that a faulty disk/controller interfered with the network driver. But of course you never know.

    Some stop codes can be analyzed without amalyzing the memory dump, the blue screnn provides enough info, others have to be cracked by windbg. Still its not 100% accurate.
    If its a criticial server and windbg doesn't show helpful info  I'd submit the memory dump to Microsoft.

    Featured Post

    What Is Threat Intelligence?

    Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

    Join & Write a Comment

    by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
    Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
    This video discusses moving either the default database or any database to a new volume.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now