• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1557
  • Last Modified:

SBS 2003 getting Error code 000000d1, parameter1 00021000, parameter2 00000002, parameter3 00000000, parameter4 b9ff60a9.

Hi, I got this message this morning

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            8/10/2007
Time:            5:41:41 PM
User:            N/A
Computer:      OURPDC
Error code 000000d1, parameter1 00021000, parameter2 00000002, parameter3 00000000, parameter4 b9ff60a9.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 30 30 30 30 30 30 64    000000d
0020: 31 20 20 50 61 72 61 6d   1  Param
0028: 65 74 65 72 73 20 30 30   eters 00
0030: 30 32 31 30 30 30 2c 20   021000,
0038: 30 30 30 30 30 30 30 32   00000002
0040: 2c 20 30 30 30 30 30 30   , 000000
0048: 30 30 2c 20 62 39 66 66   00, b9ff
0050: 36 30 61 39               60a9    

Any Idea where this is stemming from?
  • 5
  • 5
  • 2
1 Solution
Blue screens can be caused by a LOT of different things, but tend to be hardware or driver issues.  You specific blue screen was 000000d1.

Can you look through the logs to when this happened and see if anything else happened beforehand that may have been the trigger for the blue screen?  Any hardware or driver changes recently?

Also have a look at
There are lots of possible causes for 1D stop errors on Microsoft's site but narrowing down what might have caused this first would be better, but as examples -
An old one from here with info on getting/reading dump files - http://www.experts-exchange.com/Operating_Systems/Windows_Server_2003/Q_21631450.html

Does the server itself have any monitoring software that might have more info in its logs?  For instance HP Management Console and ILO logs?
For a quick guide on how to analyse crash dumps, check out:
nexxsupportAuthor Commented:
No there is no monitoring software of any kind. I have a minidump file, but not sure what to do with it
Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

Have a look at the link I posted, which will explain how to perform a crash dump analysis...
nexxsupportAuthor Commented:
Ok i am trying it as we speak
nexxsupportAuthor Commented:
Ok I followed the instructions and this is how far I got:

Microsoft (R) Windows Debugger  Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp1_gdr.070304-2232
Kernel base = 0x80800000 PsLoadedModuleList = 0x8089ffa8
Debug session time: Tue Aug  7 14:19:15.468 2007 (GMT-4)
System Uptime: 8 days 17:43:31.107
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
ERROR: FindPlugIns 8007007b
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck D1, {21000, 2, 0, b9ff60a9}

*** ERROR: Module load completed but symbols could not be loaded for CSTDI50.sys
*** WARNING: Unable to verify timestamp for afd.sys
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
Probably caused by : CSTDI50.sys ( CSTDI50+10a9 )

Followup: MachineOwner

Not sure what this means
It means that (apart from the errors) the crash was probably caused by CSTDI50.sys.

Which is quite freaky since that's the same Colasoft driver as in the blog post I linked to first - Have another look at that post since it seems to be written for you :-)
nexxsupportAuthor Commented:
Yea i found that funny. But I don't have anthing from Colasoft??? thats the weird part
From their FAQ -
I received a blue screen with CSTDI50.SYS (Colasoft TDI Loopback Driver), the screen said IRQ NOT LESS THAN OR EQUAL.
A:      A possible reason is the packet driver was installed improperly. Please run regedit.exe and delete the following keys:

The keys also can be found in:

Then reinstall Colasoft Capsa.

Any of those registry entries present on your server?
nexxsupportAuthor Commented:
Hummm very odd. I found them in Current Control set and Controlset 2....still have no idea how these got there.
No idea - I'm not in front of any servers and about to take off since it's midnight here, time to hit the road :-)
Will check back tomorrow to see if you got any further - sorry to bail on you!
Good luck...
I guess that solved your problem... glad to help & thanks for the A. Just a little pointer to help others in future - it's nicer to accept the post that actually helped most in solving the problem, so that others can quickly check the solution :-)
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

  • 5
  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now