asked on

SBS 2003 getting Error code 000000d1, parameter1 00021000, parameter2 00000002, parameter3 00000000, parameter4 b9ff60a9.

Hi, I got this message this morning

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            8/10/2007
Time:            5:41:41 PM
User:            N/A
Computer:      OURPDC
Description:
Error code 000000d1, parameter1 00021000, parameter2 00000002, parameter3 00000000, parameter4 b9ff60a9.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 64 000000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 32 31 30 30 30 2c 20 021000,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 62 39 66 66 00, b9ff
0050: 36 30 61 39 60a9

Any Idea where this is stemming from?

Zenith63

Blue screens can be caused by a LOT of different things, but tend to be hardware or driver issues. You specific blue screen was 000000d1.

Can you look through the logs to when this happened and see if anything else happened beforehand that may have been the trigger for the blue screen? Any hardware or driver changes recently?

Also have a look at
http://www.eventid.net/display.asp?eventid=1003&eventno=1274&source=System&phase=1
There are lots of possible causes for 1D stop errors on Microsoft's site but narrowing down what might have caused this first would be better, but as examples -
http://support.microsoft.com/kb/894086
http://support.microsoft.com/kb/931322
An old one from here with info on getting/reading dump files - https://www.experts-exchange.com/questions/21631450/Server-rebooting-with-Error-code-000000d1-parameter1-00000003-parameter2-00000002-parameter3-00000000-parameter4-f76a9917.html

Does the server itself have any monitoring software that might have more info in its logs? For instance HP Management Console and ILO logs?

budchawla

For a quick guide on how to analyse crash dumps, check out:
http://blogs.technet.com/petergal/archive/2006/03/23/422993.aspx

nexxsupport

ASKER

No there is no monitoring software of any kind. I have a minidump file, but not sure what to do with it

budchawla

Have a look at the link I posted, which will explain how to perform a crash dump analysis...

nexxsupport

ASKER

Ok i am trying it as we speak

nexxsupport

ASKER

Ok I followed the instructions and this is how far I got:

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp1_gdr.070304-2232
Kernel base = 0x80800000 PsLoadedModuleList = 0x8089ffa8
Debug session time: Tue Aug 7 14:19:15.468 2007 (GMT-4)
System Uptime: 8 days 17:43:31.107
Loading Kernel Symbols
..................................................................................................................................
Loading User Symbols
.........................................................................................
Loading unloaded module list
......................
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {21000, 2, 0, b9ff60a9}

*** ERROR: Module load completed but symbols could not be loaded for CSTDI50.sys
*** WARNING: Unable to verify timestamp for afd.sys
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
Probably caused by : CSTDI50.sys ( CSTDI50+10a9 )

Followup: MachineOwner
---------

Not sure what this means

budchawla

It means that (apart from the errors) the crash was probably caused by CSTDI50.sys.

Which is quite freaky since that's the same Colasoft driver as in the blog post I linked to first - Have another look at that post since it seems to be written for you :-)

nexxsupport

ASKER

Yea i found that funny. But I don't have anthing from Colasoft??? thats the weird part

Zenith63

From their FAQ -
------------
I received a blue screen with CSTDI50.SYS (Colasoft TDI Loopback Driver), the screen said IRQ NOT LESS THAN OR EQUAL.
A: A possible reason is the packet driver was installed improperly. Please run regedit.exe and delete the following keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSTDIDRV

The keys also can be found in:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CSTDIDRV
or
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\CSTDIDRV

Then reinstall Colasoft Capsa.
-------------

Any of those registry entries present on your server?

nexxsupport

ASKER

Hummm very odd. I found them in Current Control set and Controlset 2....still have no idea how these got there.

ASKER CERTIFIED SOLUTION

budchawla

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

budchawla

I guess that solved your problem... glad to help & thanks for the A. Just a little pointer to help others in future - it's nicer to accept the post that actually helped most in solving the problem, so that others can quickly check the solution :-)