Server froze, then rebooted... stop error : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+16 )

Posted on 2007-10-05
Last Modified: 2012-08-14
This morning,

the information store service was kept in stopping mode, I wanted to delete the process in task manager, but couldn't. then the server froze and rebooted.
When it restarted it showed a blue screen with a stop error Error code 1000008e, parameter1 c0000005, parameter2 8092af08, parameter3 b8925c30, parameter4 00000000.

I got the dump file and here is the output of it:

Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [\\DOWNTOWN\Users\GaetanBarthelemy\My Documents\Business\Gramercy\Mini100507-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*websymbols*
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_gdr.070304-2232
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Fri Oct  5 16:49:32.359 2007 (GMT-7)
System Uptime: 0 days 9:45:27.057
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8092af08, b8925c30, 0}

GetUlongFromAddress: unable to read from 808b85f8
GetUlongFromAddress: unable to read from 808b85f8
Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+16 )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
Arg1: c0000005, The exception code that was not handled
Arg2: 8092af08, The address that the exception occurred at
Arg3: b8925c30, Trap Frame
Arg4: 00000000

Debugging Details:

GetUlongFromAddress: unable to read from 808b85f8
GetUlongFromAddress: unable to read from 808b85f8

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

8092af08 8b80a8000000    mov     eax,dword ptr [eax+0A8h]

TRAP_FRAME:  b8925c30 -- (.trap ffffffffb8925c30)
ErrCode = 00000000
eax=00000000 ebx=88cf3b48 ecx=00000001 edx=88c1e361 esi=88c1e360 edi=e466b2d8
eip=8092af08 esp=b8925ca4 ebp=b8925cb0 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
8092af08 8b80a8000000    mov     eax,dword ptr [eax+0A8h] ds:0023:000000a8=00000000
Resetting default scope





LAST_CONTROL_TRANSFER:  from 80912a6e to 8092af08

b8925cb0 80912a6e e26f0d90 e466b2d8 0028b16c nt!ObpCloseHandleTableEntry+0x16
b8925ccc 80912c36 e466b2d8 0028b16c b8925d20 nt!ObpCloseHandleProcedure+0x1d
b8925ce8 8099da91 e26f0d90 80912a51 b8925d20 nt!ExSweepHandleTable+0x28
b8925d2c 80965aac 88cf3b48 b8925d64 00a4ffa0 nt!ObClearProcessHandleTable+0x52
b8925d54 80834d3f 00000000 c0000005 00a4ffa0 nt!NtTerminateProcess+0x156
b8925d54 7c82ed54 00000000 c0000005 00a4ffa0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00a4ffa0 00000000 00000000 00000000 00000000 0x7c82ed54


8092af08 8b80a8000000    mov     eax,dword ptr [eax+0A8h]


SYMBOL_NAME:  nt!ObpCloseHandleTableEntry+16

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  ntkrnlmp.exe


FAILURE_BUCKET_ID:  0x8E_nt!ObpCloseHandleTableEntry+16

BUCKET_ID:  0x8E_nt!ObpCloseHandleTableEntry+16

Followup: MachineOwner

I haven't installed anything lately, so I am not sure what the cause might be.
Question by:odewulf
    LVL 10

    Expert Comment

    Were any Windows updates applied before this happened? Have you tried bringing the server up in safe mode or with last known good?

    Author Comment

    The last time I installed updates was more than 2 weeks ago. I didn't try to boot in safe mode yet. In fact the server is ok as long as I don't work on it. If i start doing stuff, it just freezes, then reboot... it has been the 4th time in 2 days...

    Accepted Solution

    It seems that the scripts I was running to stop the exchange service before doing the backup, was causing the problem. I took it out, the issue is that now I might get a corrupted DB :-(
    LVL 1

    Expert Comment

    Closed, 500 points refunded.
    EE Admin

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Suggested Solutions

    Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now