Windows Server 2003 reboot error PAGE_FAULT_IN_NONPAGED_AREA (50)

You may have a bad memory stick i.e. location in memory that has problems not the entire stick being dead.  Another thing you can do is setup performance monitor to monitor memory usage.  This way you can see whether this error occurs every time the memory usage hits a particular threshold i.e.usage goes over >3.45Gb

Use memtest http://www.memtest.org/ to test the memory in the system.  If you have similar good memory lying around, you can test it first to make sure it is good.  Then replace those sticks with the one in the current server to see whether the issue goes away while testing the now removed sticks. Otherwise the server will be offline for the memory test.

You can control what type of dump file is created by altering the settings in the properties of my computer/advanced/start up and recovery section without the need to edit the boot.ini file (the change in those settings will be reflected in the boot.ini if needed).

Memory is all ECC.  Single bit errors are corrected, greater errors stop the machine.

This does bring up another point, though.  
This is windows server 2003 standard.
System shows 4 GB of memory.  
Physical Address Extension.

Another 2003 standard server I just brought up with 4 GB in it shows
3.25 GB memory

Is memory mis-configured, for instance PAE enabled when it shouldn't be?

Still lookiing to see of the nwfs patch is applicable.

John

Also noted that failing called addresses are all above the 0xC0000000 (3.25 G) nominal limit without PAE

<<I take it the Novell Client is there so remote users get a Novell login process in their terminal server session, right?>>
Novell 4.11, latest service pack before force to 5.  Going to change it out for a Samba server pretty soon, so don't want to go up the Novell path anymore.  Latest Novell is Linux anyway.

<<The two post-SP5 patches are different - one is for login services and the other is for NWFS.SYS.  It couldn't hurt to have both.>>
Login is installed, wondered what the bug report 437212 was all about.  Haven't installed nwfs patch yet.

<<That said - when  you installed the client, you did it using add/remove programs or by putting the server in install mode first? >>
Installed using Novells install program as Administrator.

<<Also, have you seen this appnote on recommended settings for the Novell Client32 on a Terminal Server?
http://www.novell.com/coolsolutions/appnote/15773.html>>

No, thank you for the link.

<<Additionally, although the crash occurs in NWFS.SYS, you say it's got AVP in the stack.  Do you have AVP configured not to scan network drives? If not, you should change that -especially if you've got an antivirus scan running on the NetWare server(s).  If you don't, you should.  Alternatively, set AVP only to scan on read, since any updates/writes will occur in a realtime-scanned environment. >>

Scan Network Drives is checked.  My bad, I know better than that.

<<It also could be a problem with the configuration of the NetWare server - I have seen odd client issues caused by certain types of access when settings on the server aren't quite right.  Don't remember offhand but might be related to the client caching and level 2 oplock settings, but it could also have something to do with patch level on the server - maybe an old version of NSS or something.  What is the version/SP of the NetWare server(s) and how is the filesystem configured - traditional turboFAT/NWFS or NSS?  What version of NSS are you running?>>

Don't know what file system, it's not an option on 4.11 that I know of.  Access is either bindery or by NDS.  we use NDS on the terminal server and most workstations.

The Novell box is an oldie, 1.6 G P4 or so, adaptec SCSI raid in it.  It feeds 2 Gigabyte channels with a sigh, unless it's crowded and has to work too hard recompressing compressed files.  Been solid as a rock for years.

As I noted above, the bug occurrs when memory above the 3.25 gig that is normally addressable is called.  I've configured boot.ini /maxmen to 3330.  DEP is on system files only.  I may disable DEP if I can.

As soon as I can dig up the password for KAV, I'll uncheck the network files box.

Thanks for the input.  All good.

>><<That said - when  you installed the client, you did it using add/remove programs or by putting the server in install mode first? >>
Installed using Novells install program as Administrator. <<

That's not what I meant.  When you install something - especially something like the Novell Client32, on a Terminal Server, you need to either put it in install mode or install using add/remove programs - if you don't it is likely to cause problems as multiple people use the program in multiple TS sessions.

To use install mode, you have to be at the console, not remote.  You open a command prompt and enter "change user /install" which sets the terminal server to install mode.  Then you install the program. When done, you open a command prompt and enter "change user /execute"

The only other approved way to install programs on a Terminal Server is through add/remove programs.

Found out PAE is automatically loaded by DEP.  
I limited High memory with a /maxmem =3331 in the boot.ini
Same stop over weekend, just different addresses.
I removed the /maxmem ---no change.
I found that Kaspersky was configured to scan network drives.  I unchecked that.
We'll see.  
Next will be to install the nwfs patch.
I noticed that with memory limited and the page file opened up to 4092 I still don't have the option to enable a full memory dump.  I suspect there's a registry entry to fix that.   Don't know for sure if I'll even need it, but I suspect that when I get to the end of this plan, and also going through the Novell ApNote you linked above, I'll need to submit a full memory dump to Novell.

Thanks for the help, we're close.

Been an uneventful week.

Configuring AVP to not scan network drives was the ticket.  It eliminated the error, and greatly increased network throughput and lightened the load on the server.  I see processor use way down and dirty buffers up high enough to indicate a lot of throughput.

I tried the change user /install command at the console and was told by the machine that it did not apply to a server running terminal services.

I will update NWFS if there's any more trouble.

ShineOn gets the points.

Solution was in an aside comment, but that was because this expert has such a thorough overview of the subject.  Thanks