• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1435
  • Last Modified:

Server froze, then rebooted... stop error : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+16 )

This morning,

the information store service was kept in stopping mode, I wanted to delete the process in task manager, but couldn't. then the server froze and rebooted.
When it restarted it showed a blue screen with a stop error Error code 1000008e, parameter1 c0000005, parameter2 8092af08, parameter3 b8925c30, parameter4 00000000.

I got the dump file and here is the output of it:


Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [\\DOWNTOWN\Users\GaetanBarthelemy\My Documents\Business\Gramercy\Mini100507-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_gdr.070304-2232
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Fri Oct  5 16:49:32.359 2007 (GMT-7)
System Uptime: 0 days 9:45:27.057
Loading Kernel Symbols
............................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8092af08, b8925c30, 0}

GetUlongFromAddress: unable to read from 808b85f8
GetUlongFromAddress: unable to read from 808b85f8
Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+16 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8092af08, The address that the exception occurred at
Arg3: b8925c30, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

GetUlongFromAddress: unable to read from 808b85f8
GetUlongFromAddress: unable to read from 808b85f8

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ObpCloseHandleTableEntry+16
8092af08 8b80a8000000    mov     eax,dword ptr [eax+0A8h]

TRAP_FRAME:  b8925c30 -- (.trap ffffffffb8925c30)
ErrCode = 00000000
eax=00000000 ebx=88cf3b48 ecx=00000001 edx=88c1e361 esi=88c1e360 edi=e466b2d8
eip=8092af08 esp=b8925ca4 ebp=b8925cb0 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
nt!ObpCloseHandleTableEntry+0x16:
8092af08 8b80a8000000    mov     eax,dword ptr [eax+0A8h] ds:0023:000000a8=00000000
Resetting default scope

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x8E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 80912a6e to 8092af08

STACK_TEXT:  
b8925cb0 80912a6e e26f0d90 e466b2d8 0028b16c nt!ObpCloseHandleTableEntry+0x16
b8925ccc 80912c36 e466b2d8 0028b16c b8925d20 nt!ObpCloseHandleProcedure+0x1d
b8925ce8 8099da91 e26f0d90 80912a51 b8925d20 nt!ExSweepHandleTable+0x28
b8925d2c 80965aac 88cf3b48 b8925d64 00a4ffa0 nt!ObClearProcessHandleTable+0x52
b8925d54 80834d3f 00000000 c0000005 00a4ffa0 nt!NtTerminateProcess+0x156
b8925d54 7c82ed54 00000000 c0000005 00a4ffa0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00a4ffa0 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ObpCloseHandleTableEntry+16
8092af08 8b80a8000000    mov     eax,dword ptr [eax+0A8h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ObpCloseHandleTableEntry+16

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  45ebe552

FAILURE_BUCKET_ID:  0x8E_nt!ObpCloseHandleTableEntry+16

BUCKET_ID:  0x8E_nt!ObpCloseHandleTableEntry+16

Followup: MachineOwner
---------

I haven't installed anything lately, so I am not sure what the cause might be.
0
odewulf
Asked:
odewulf
  • 2
1 Solution
 
ajwukTechnical Consultant / Project ManagerCommented:
Were any Windows updates applied before this happened? Have you tried bringing the server up in safe mode or with last known good?
0
 
odewulfPresidentAuthor Commented:
The last time I installed updates was more than 2 weeks ago. I didn't try to boot in safe mode yet. In fact the server is ok as long as I don't work on it. If i start doing stuff, it just freezes, then reboot... it has been the 4th time in 2 days...
0
 
odewulfPresidentAuthor Commented:
It seems that the scripts I was running to stop the exchange service before doing the backup, was causing the problem. I took it out, the issue is that now I might get a corrupted DB :-(
0
 
Computer101Commented:
Closed, 500 points refunded.
Computer101
EE Admin
0

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now