Solved

BSOD - win32k.sys on 2003 Server R2

Posted on 2011-03-13
6
2,060 Views
Last Modified: 2012-05-11
After running Windows Update the server blue screens with the following message:.

A problem has been detected and Windows has been shut down to prevent damage to your computer.
win32k.sys
An attempt was made to write to read-only memory.
*****
Technical information:
STOP: 0x000000BE (0xBF9EA09B,0x791BF021,0xBA4548FC,0x0000000C)
win32k.sys - Address BF806436 base at BF800000, DateStamp 4d1ddf7b


I have run the Dell Utility memory tests - all passed.
It boots into Safe Mode however I am unable to get the minidump files until tomorrow when I am on site as I am currently connected using the DRAC.

Any suggestions what could be causing the problem?

Many thanks.
BSOD-BD02.jpg
0
Comment
Question by:morticcio
  • 4
6 Comments
 
LVL 8

Expert Comment

by:PenguinN
ID: 35123840
It's most likely a driver problem, check http://technet.microsoft.com/en-us/library/cc785339%28WS.10%29.aspx#BKMK_5
Quote from MS article link:

Stop message 0x000000BE Descriptive text: ATTEMPTED_WRITE_TO_READONLY_MEMORY
Usual cause: A device driver attempted to write to read-only memory. This problem can occur during an upgrade, although it is not limited to upgrades.

Solution:

1.Use the Online Crash Analysis tool at the Microsoft Web site. You can use this tool to send error reports to Microsoft and track their status by using your Microsoft Passport information. You can access the Online Crash Analysis Web site by using the Error Reporting service or by using your Web browser. When it is enabled, the Error Reporting service monitors your system for kernel and user mode faults that are related to operating system components and applications. With kernel-mode reporting, you can obtain more information about the problem or condition that caused the Stop error. For more information, see System and program error reporting overview.

2.Confirm that your hardware is designed for the Windows Server 2003 family by clicking the appropriate link in Support resources.

3.If the computer will not start normally, try starting it in Last Known Good Configuration or in Safe Mode, and then remove or disable newly added programs or drivers. For information about how to start your computer in Safe Mode, see Start the computer in Safe Mode. For more information about how to start your computer in Last Known Good Configuration, see Start the computer using the last known good configuration.

Important

When you use Last Known Good Configuration, system setting changes made after the last successful startup are lost.

0
 
LVL 1

Author Comment

by:morticcio
ID: 35127045
Server boots in Safe Mode
Would not boot with Last Known Good Configuration

Running MS memtest as I type...will post results when it finishes

minidump file uploaded below
0
 
LVL 1

Author Comment

by:morticcio
ID: 35127766
Ran memtest - passed all tests
output from minidump file below
minidump-output.txt
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 4

Accepted Solution

by:
evgeny_f31 earned 250 total points
ID: 35138583
" After running Windows Update " - maybe one of the updates  is the cause.
check what updates were installed, try to uninstall them.
0
 
LVL 1

Assisted Solution

by:morticcio
morticcio earned 0 total points
ID: 35138949
One of the updates was the culprit... KB2393802 to be exact. I raised a call with Microsoft and after some initial troubleshooting, they uninstalled the update and the server restarted.

Will post back if I hear the post mortem on the memoery dumps from Microsoft.

Many thanks.
0
 
LVL 1

Author Closing Comment

by:morticcio
ID: 35174527
KB2393802 was the actual update that caused the blue screen.
0

Featured Post

3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Hallo! I guess almost every Windows Administrator must have got stumped with this question "Where does WINDOWS store a users cached credentials? Every user who had once logged onto a Server/Desktop while it was connected to the domain could sti…
INTRODUCTION The purpose of this document is to demonstrate the Installation and configuration of the Data Protection Manager product. Note that this demonstration was prepared on the basis of Windows OS is 2008 R2 and DPM 2010. DATA PROTECTI…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question