SBS 2003 getting Error code 000000d1, parameter1 00021000, parameter2 00000002, parameter3 00000000, parameter4 b9ff60a9.

Posted on 2007-08-10
Last Modified: 2013-11-05
Hi, I got this message this morning

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            8/10/2007
Time:            5:41:41 PM
User:            N/A
Computer:      OURPDC
Error code 000000d1, parameter1 00021000, parameter2 00000002, parameter3 00000000, parameter4 b9ff60a9.

For more information, see Help and Support Center at
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 30 30 30 30 30 30 64    000000d
0020: 31 20 20 50 61 72 61 6d   1  Param
0028: 65 74 65 72 73 20 30 30   eters 00
0030: 30 32 31 30 30 30 2c 20   021000,
0038: 30 30 30 30 30 30 30 32   00000002
0040: 2c 20 30 30 30 30 30 30   , 000000
0048: 30 30 2c 20 62 39 66 66   00, b9ff
0050: 36 30 61 39               60a9    

Any Idea where this is stemming from?
Question by:nexxsupport
    LVL 11

    Expert Comment

    Blue screens can be caused by a LOT of different things, but tend to be hardware or driver issues.  You specific blue screen was 000000d1.

    Can you look through the logs to when this happened and see if anything else happened beforehand that may have been the trigger for the blue screen?  Any hardware or driver changes recently?

    Also have a look at
    There are lots of possible causes for 1D stop errors on Microsoft's site but narrowing down what might have caused this first would be better, but as examples -
    An old one from here with info on getting/reading dump files -

    Does the server itself have any monitoring software that might have more info in its logs?  For instance HP Management Console and ILO logs?
    LVL 10

    Expert Comment

    For a quick guide on how to analyse crash dumps, check out:

    Author Comment

    No there is no monitoring software of any kind. I have a minidump file, but not sure what to do with it
    LVL 10

    Expert Comment

    Have a look at the link I posted, which will explain how to perform a crash dump analysis...

    Author Comment

    Ok i am trying it as we speak

    Author Comment

    Ok I followed the instructions and this is how far I got:

    Microsoft (R) Windows Debugger  Version 6.7.0005.1
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\MEMORY.DMP]
    Kernel Complete Dump File: Full address space is available

    Symbol search path is: SRV*c:\websymbols*
    Executable search path is:
    Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
    Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
    Built by: 3790.srv03_sp1_gdr.070304-2232
    Kernel base = 0x80800000 PsLoadedModuleList = 0x8089ffa8
    Debug session time: Tue Aug  7 14:19:15.468 2007 (GMT-4)
    System Uptime: 8 days 17:43:31.107
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    ERROR: FindPlugIns 8007007b
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {21000, 2, 0, b9ff60a9}

    *** ERROR: Module load completed but symbols could not be loaded for CSTDI50.sys
    *** WARNING: Unable to verify timestamp for afd.sys
    *** ERROR: Module load completed but symbols could not be loaded for afd.sys
    Probably caused by : CSTDI50.sys ( CSTDI50+10a9 )

    Followup: MachineOwner

    Not sure what this means
    LVL 10

    Expert Comment

    It means that (apart from the errors) the crash was probably caused by CSTDI50.sys.

    Which is quite freaky since that's the same Colasoft driver as in the blog post I linked to first - Have another look at that post since it seems to be written for you :-)

    Author Comment

    Yea i found that funny. But I don't have anthing from Colasoft??? thats the weird part
    LVL 11

    Expert Comment

    From their FAQ -
    I received a blue screen with CSTDI50.SYS (Colasoft TDI Loopback Driver), the screen said IRQ NOT LESS THAN OR EQUAL.
    A:      A possible reason is the packet driver was installed improperly. Please run regedit.exe and delete the following keys:

    The keys also can be found in:

    Then reinstall Colasoft Capsa.

    Any of those registry entries present on your server?

    Author Comment

    Hummm very odd. I found them in Current Control set and Controlset 2....still have no idea how these got there.
    LVL 10

    Accepted Solution

    No idea - I'm not in front of any servers and about to take off since it's midnight here, time to hit the road :-)
    Will check back tomorrow to see if you got any further - sorry to bail on you!
    Good luck...
    LVL 10

    Expert Comment

    I guess that solved your problem... glad to help & thanks for the A. Just a little pointer to help others in future - it's nicer to accept the post that actually helped most in solving the problem, so that others can quickly check the solution :-)

    Featured Post

    Promote certifications in your email signature

    Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

    Join & Write a Comment

    Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
    Learn about cloud computing and its benefits for small business owners.
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
    This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now