Link to home
Start Free TrialLog in
Avatar of compsupport
compsupportFlag for United States of America

asked on

Windows Server 2003 SBS SP2 BSOD ntkrpamp

Hi
We have a Windows SBS 2003 SP2 on a Dell PE1900 which had a few BSODs recently.
I have run windbg for crashes on 07/01/2013 and 05/30/2013 and both point to ntkrpamp.exe but both have different strings.

Controller is Perc 5/i with RAID5
Dumps are attached.

I ran debug with Analyze and then lmnt:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [G:\Mini070113-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\WindbgSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.120411-0334
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Jul  1 20:01:39.674 2013 (UTC - 4:00)
System Uptime: 0 days 4:12:27.351
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, d0000002, 0, 8080f5f3}

Probably caused by : ntkrpamp.exe ( nt!CcFlushCache+a3 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8080f5f3, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  00000004

CURRENT_IRQL:  2

FAULTING_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004          mov     eax,dword ptr [eax+4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  f78d2c1c -- (.trap 0xfffffffff78d2c1c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=808b4000 edx=00000000 esi=8734bd2c edi=00000000
eip=8080f5f3 esp=f78d2c90 ebp=f78d2cfc iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!CcFlushCache+0xa3:
8080f5f3 8b4004          mov     eax,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8080f5f3 to 8088c9fb

STACK_TEXT:  
f78d2c1c 8080f5f3 badb0d00 00000000 8b4697e0 nt!KiTrap0E+0x2a7
f78d2cfc 8080fc6f 8a1fa55c 00000000 00000001 nt!CcFlushCache+0xa3
f78d2d40 808127ba 8b57fc10 808ae5c0 8b577100 nt!CcWriteBehind+0x11b
f78d2d80 808804ab 8b577100 00000000 8b57fc10 nt!CcWorkerThread+0x15a
f78d2dac 80949c7a 8b577100 00000000 00000000 nt!ExpWorkerThread+0xeb
f78d2ddc 8088e0f2 808803c0 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004          mov     eax,dword ptr [eax+4]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!CcFlushCache+a3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4f857c1d

FAILURE_BUCKET_ID:  0xA_nt!CcFlushCache+a3

BUCKET_ID:  0xA_nt!CcFlushCache+a3

Followup: MachineOwner
---------

1: kd> lmnt
start    end        module name
80800000 80a5a000   nt       ntkrpamp.exe Wed Apr 11 08:42:05 2012 (4F857C1D)
80a5a000 80a86000   hal      halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
b6306000 b6330000   Fastfat  Fastfat.SYS  Sat Feb 17 01:27:55 2007 (45D6A06B)
b67b8000 b67e3000   RDPWD    RDPWD.SYS    Fri Jun 24 09:05:10 2011 (4E048B86)
b72fb000 b735a000   IDSxpx86 IDSxpx86.sys Tue Aug 28 22:48:13 2012 (503D82ED)
b7906000 b7908d00   wdcsam   wdcsam.sys   Wed Apr 16 04:27:02 2008 (4805B856)
b8282000 b828d000   TDTCP    TDTCP.SYS    Sat Feb 17 00:44:32 2007 (45D69640)
b852a000 b8558000   sfmsrv   sfmsrv.sys   Sat Feb 17 00:59:53 2007 (45D699D9)
b8840000 b884a000   LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:22 2008 (487B7E2E)
b8878000 b88c9000   HTTP     HTTP.sys     Wed Apr 14 13:37:09 2010 (4BC5FD45)
b8c39000 b8c55c00   VirtFile VirtFile.sys Wed Aug 24 11:42:47 2011 (4E551BF7)
b8ed6000 b8f3a000   srv      srv.sys      Thu Feb 17 11:58:17 2011 (4D5D53A9)
b8f62000 b8f95000   mrxdav   mrxdav.sys   Mon Dec 17 05:49:07 2007 (47665423)
b90fd000 b912b000   sfmatalk sfmatalk.sys Sat Feb 17 00:59:55 2007 (45D699DB)
b91dd000 b920ce60   exifs    exifs.sys    Thu Aug 25 20:29:05 2005 (430E6251)
b9235000 b926f000   CpsFsJnl CpsFsJnl.sys Tue Sep 15 07:45:46 2009 (4AAF7E6A)
b92f7000 b9301000   ndisuio  ndisuio.sys  Sat Feb 17 00:58:25 2007 (45D69981)
b93af000 b93c4000   Cdfs     Cdfs.SYS     Sat Feb 17 01:27:08 2007 (45D6A03C)
b93ec000 b94e4000   BHDrvx86 BHDrvx86.sys Mon May 20 15:17:36 2013 (519A76D0)
b94e4000 b9543000   eeCtrl   eeCtrl.sys   Tue Jul 31 19:33:30 2012 (50186B4A)
b9543000 b9554000   Fips     Fips.SYS     Sat Feb 17 01:26:33 2007 (45D6A019)
b9554000 b95ca000   mrxsmb   mrxsmb.sys   Wed Jul 06 10:34:54 2011 (4E14728E)
b95ca000 b95fa000   rdbss    rdbss.sys    Wed Feb 24 10:54:03 2010 (4B854B9B)
b96ea000 b9714000   afd      afd.sys      Tue Dec 27 09:11:19 2011 (4EF9D207)
b9714000 b9745000   netbt    netbt.sys    Sat Feb 17 01:28:57 2007 (45D6A0A9)
b97a4000 b97fcd00   SYMTDI   SYMTDI.SYS   Fri Mar 09 17:55:26 2012 (4F5A8A5E)
b9825000 b98b9000   tcpip    tcpip.sys    Sat Aug 15 05:53:38 2009 (4A8685A2)
b98b9000 b98d2000   ipsec    ipsec.sys    Sat Feb 17 01:29:28 2007 (45D6A0C8)
b98f2000 b9907000   NAVENG   NAVENG.SYS   Fri Apr 26 01:27:07 2013 (517A102B)
b9907000 b9a8ec80   NAVEX15  NAVEX15.SYS  Fri Apr 26 01:25:25 2013 (517A0FC5)
b9a8f000 b9ab9000   SYMEVENT SYMEVENT.SYS Tue Nov 22 13:30:26 2011 (4ECBEA42)
b9ab9000 b9add000   Ironx86  Ironx86.SYS  Fri Sep 09 19:24:24 2011 (4E6AA028)
b9b0d000 b9b17000   dump_percsas dump_percsas.sys Fri Jun 08 13:15:54 2007 (46698ECA)
b9b1d000 b9b27000   dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
b9b3d000 b9b4b000   msgpc    msgpc.sys    Sat Feb 17 00:58:37 2007 (45D6998D)
b9b4d000 b9b5a000   Npfs     Npfs.SYS     Sat Feb 17 00:50:36 2007 (45D697AC)
b9b5d000 b9b68000   Msfs     Msfs.SYS     Sat Feb 17 00:50:33 2007 (45D697A9)
b9b6d000 b9b79000   vga      vga.sys      Sat Feb 17 01:10:30 2007 (45D69C56)
b9b7d000 b9c05000   SRTSP    SRTSP.SYS    Thu Mar 01 13:40:52 2012 (4F4FC2B4)
b9c05000 b9c1a000   usbhub   usbhub.sys   Sat Feb 17 01:13:05 2007 (45D69CF1)
b9c82000 b9ce1000   update   update.sys   Mon May 28 08:15:16 2007 (465AC7D4)
b9ce1000 b9cfd380   teefer   teefer.sys   Tue Aug 16 05:24:45 2011 (4E4A375D)
b9d1e000 b9d2b000   wanarp   wanarp.sys   Sat Feb 17 00:59:17 2007 (45D699B5)
b9d2e000 b9d39000   dcdbas32 dcdbas32.sys Tue Aug 07 17:33:21 2007 (46B8E521)
b9d4e000 b9d57000   kbdhid   kbdhid.sys   Sat Feb 17 01:05:42 2007 (45D69B36)
b9d7e000 b9d87000   mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
b9d8e000 b9d9c000   HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
b9d9e000 b9dd5000   rdpdr    rdpdr.sys    Sat Feb 17 00:51:00 2007 (45D697C4)
b9dd5000 b9de7000   raspptp  raspptp.sys  Sat Feb 17 01:29:20 2007 (45D6A0C0)
b9de7000 b9e00000   ndiswan  ndiswan.sys  Sat Feb 17 01:29:22 2007 (45D6A0C2)
b9e00000 b9e14000   rasl2tp  rasl2tp.sys  Sat Feb 17 01:29:02 2007 (45D6A0AE)
b9e14000 b9e3b000   ks       ks.sys       Sat Feb 17 01:30:40 2007 (45D6A110)
b9e3b000 b9e4f000   redbook  redbook.sys  Sat Feb 17 01:07:26 2007 (45D69B9E)
b9e4f000 b9e64000   cdrom    cdrom.sys    Sat Feb 17 01:07:48 2007 (45D69BB4)
b9e64000 b9e79000   serial   serial.sys   Sat Feb 17 01:06:46 2007 (45D69B76)
b9e79000 b9e95000   VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
b9e95000 b9ffd000   ati2mtag ati2mtag.sys Wed Apr 05 23:03:52 2006 (44348518)
b9ffd000 ba027000   USBPORT  USBPORT.SYS  Sat Feb 17 01:12:59 2007 (45D69CEB)
ba027000 ba098000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
ba098000 ba100000   bxvbdx   bxvbdx.sys   Fri Aug 10 20:12:01 2007 (46BCFED1)
ba100000 ba142000   e1e5132  e1e5132.sys  Thu Jun 14 15:15:06 2007 (467193BA)
ba162000 ba16a000   mouhid   mouhid.sys   Tue Mar 25 03:03:12 2003 (3E7FFF30)
ba16a000 ba170300   HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
ba18a000 ba191000   dxgthk   dxgthk.sys   Tue Mar 25 03:05:52 2003 (3E7FFFD0)
bad6d000 bad7c000   intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
bad7d000 bad8c000   raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
bad9d000 bada8000   fdc      fdc.sys      Sat Feb 17 01:07:16 2007 (45D69B94)
badad000 badb6000   hidusb   hidusb.sys   Tue Mar 25 03:10:17 2003 (3E8000D9)
badbd000 badc7000   Dxapi    Dxapi.sys    Tue Mar 25 03:06:01 2003 (3E7FFFD9)
badcd000 baddb000   imapi    imapi.sys    Sat Feb 17 01:08:22 2007 (45D69BD6)
baded000 badfb000   NDProxy  NDProxy.SYS  Wed Nov 03 09:25:59 2010 (4CD162E7)
bae49000 bae4c500   scsichng scsichng.sys Thu Aug 23 22:59:47 2007 (46CE49A3)
baea5000 baec4000   Mup      Mup.sys      Tue Apr 12 15:05:46 2011 (4DA4A28A)
baec4000 baf03000   NDIS     NDIS.sys     Sat Feb 17 01:28:49 2007 (45D6A0A1)
baf03000 baf98000   Ntfs     Ntfs.sys     Sat Feb 17 01:27:23 2007 (45D6A04B)
bf800000 bf9d3000   win32k   win32k.sys   Wed Apr 11 10:38:23 2012 (4F85975F)
bf9d3000 bf9ea000   dxg      dxg.sys      Sat Feb 17 01:14:39 2007 (45D69D4F)
bf9ea000 bfa2d000   ati2dvag ati2dvag.dll Wed Apr 05 23:04:15 2006 (4434852F)
bfa2d000 bfa6c000   ati2cqag ati2cqag.dll Wed Apr 05 21:57:18 2006 (4434757E)
bfa6c000 bfaa2000   atikvmag atikvmag.dll Wed Apr 05 22:25:29 2006 (44347C19)
bfaa2000 bfd2c0c0   ati3duag ati3duag.dll Wed Apr 05 22:47:35 2006 (44348147)
bfd2d000 bfe41180   ativvaxx ativvaxx.dll Wed Apr 05 22:40:57 2006 (44347FB9)
bfe42000 bfe8d000   ATMFD    ATMFD.DLL    Tue Feb 15 08:19:22 2011 (4D5A7D5A)
bff60000 bff7e000   RDPDD    RDPDD.dll    Sat Feb 17 09:01:19 2007 (45D70AAF)
f7206000 f722b000   fltMgr   fltMgr.sys   Sat Feb 17 00:51:08 2007 (45D697CC)
f722b000 f723e000   CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f723e000 f725d000   SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f725d000 f7284000   adpu320  adpu320.sys  Wed Mar 07 13:43:42 2007 (45EF07DE)
f7284000 f72a2000   storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f72a2000 f72bf000   atapi    atapi.sys    Sat Feb 17 01:07:34 2007 (45D69BA6)
f72bf000 f72e9000   volsnap  volsnap.sys  Sat Feb 17 01:08:23 2007 (45D69BD7)
f72e9000 f7315000   dmio     dmio.sys     Sat Feb 17 01:10:44 2007 (45D69C64)
f7315000 f733c000   ftdisk   ftdisk.sys   Sat Feb 17 01:08:05 2007 (45D69BC5)
f733c000 f7352000   pci      pci.sys      Sat Feb 17 00:59:03 2007 (45D699A7)
f7352000 f7386000   ACPI     ACPI.sys     Sat Feb 17 00:58:47 2007 (45D69997)
f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Sat Feb 17 00:58:57 2007 (45D699A1)
f74a7000 f74b4000   PCIIDEX  PCIIDEX.SYS  Sat Feb 17 01:07:32 2007 (45D69BA4)
f74b7000 f74c7000   MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
f74c7000 f74d2000   PartMgr  PartMgr.sys  Sat Feb 17 01:29:25 2007 (45D6A0C5)
f74d7000 f74e1000   percsas  percsas.sys  Fri Jun 08 13:15:54 2007 (46698ECA)
f74e7000 f74f7000   disk     disk.sys     Sat Feb 17 01:07:51 2007 (45D69BB7)
f74f7000 f7503000   Dfs      Dfs.sys      Sat Feb 17 00:51:17 2007 (45D697D5)
f7507000 f7512000   ptilink  ptilink.sys  Sat Feb 17 01:06:38 2007 (45D69B6E)
f7517000 f7521000   crcdisk  crcdisk.sys  Sat Feb 17 01:09:50 2007 (45D69C2E)
f7567000 f7574a60   SCDEmu   SCDEmu.SYS   Mon Apr 12 04:44:34 2010 (4BC2DD72)
f7577000 f7586000   termdd   termdd.sys   Sat Feb 17 00:44:32 2007 (45D69640)
f75a7000 f75b2000   kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
f75d7000 f75e0000   raspti   raspti.sys   Sat Feb 17 00:59:23 2007 (45D699BB)
f75e7000 f75f1000   serenum  serenum.sys  Sat Feb 17 01:06:44 2007 (45D69B74)
f75f7000 f7601000   mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7607000 f7612000   TDI      TDI.SYS      Sat Feb 17 01:01:19 2007 (45D69A2F)
f7617000 f7624000   netbios  netbios.sys  Sat Feb 17 00:58:29 2007 (45D69985)
f7627000 f7630000   watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f7647000 f7650000   ndistapi ndistapi.sys Fri Jul 08 10:08:19 2011 (4E170F53)
f7657000 f7663000   USBSTOR  USBSTOR.SYS  Sat Feb 17 01:13:05 2007 (45D69CF1)
f7667000 f766f680   04mmdat  04mmdat.sys  Tue Feb 12 08:35:47 2008 (47B1A0B3)
f7677000 f7685000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
f7687000 f7693c80   GenericMount GenericMount.sys Mon Jan 18 08:49:10 2010 (4B5466D6)
f76b7000 f76c7000   SRTSPX   SRTSPX.SYS   Thu Mar 01 13:40:59 2012 (4F4FC2BB)
f76e6000 f7706b00   symsnap  symsnap.sys  Mon Jun 21 11:37:35 2010 (4C1F873F)
f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000   pciide   pciide.sys   Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000   dmload   dmload.sys   Tue Mar 25 03:08:08 2003 (3E800058)
f773f000 f7744280   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
f7757000 f775db80   usbehci  usbehci.sys  Sat Feb 17 01:12:56 2007 (45D69CE8)
f775f000 f7764180   usbuhci  usbuhci.sys  Sat Feb 17 01:13:02 2007 (45D69CEE)
f7777000 f777f000   audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f77c7000 f77cf000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 03:08:36 2003 (3E800074)
f77cf000 f77d6000   Null     Null.SYS     Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77d7000 f77de000   Beep     Beep.SYS     Tue Mar 25 03:03:04 2003 (3E7FFF28)
f77df000 f77e7000   mnmdd    mnmdd.SYS    Tue Mar 25 03:07:53 2003 (3E800049)
f77e7000 f77ef000   RDPCDD   RDPCDD.sys   Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77ef000 f77f7000   rasacd   rasacd.sys   Tue Mar 25 03:11:50 2003 (3E800136)
f781f000 f7824680   tpfilter tpfilter.sys Thu May 13 15:49:52 2010 (4BEC57E0)
f7840000 f7897000   SYMDS    SYMDS.SYS    Thu Apr 28 18:39:23 2011 (4DB9EC9B)
f7897000 f7899980   compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f789b000 f789e900   BATTC    BATTC.SYS    Sat Feb 17 00:58:46 2007 (45D69996)
f7961000 f7987000   KSecDD   KSecDD.sys   Mon Jun 15 13:45:11 2009 (4A3688A7)
f7995000 f7996680   RaInfo   RaInfo.sys   Fri Jan 11 04:20:41 2013 (50EFD969)
f79ad000 f79ae280   swenum   swenum.sys   Sat Feb 17 01:05:56 2007 (45D69B44)
f79af000 f79b0580   USBD     USBD.SYS     Tue Mar 25 03:10:39 2003 (3E8000EF)
f7a7a000 f7a7ac80   lmimirr  lmimirr.sys  Tue Apr 10 18:32:11 2007 (461C106B)
f7b20000 f7bdf000   SYMEFA   SYMEFA.SYS   Wed Feb 22 12:38:08 2012 (4F452800)

Unloaded modules:
b9745000 b97a4000   IDSxpx86.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0005F000
b98df000 b98f2000   i8042prt.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
ba182000 ba18a000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
f7567000 f7571000   Flpydisk.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
f7507000 f7515000   WDFLDR.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
baf98000 bb000000   bxvbdx.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00068000
Mini053013-01.dmp
Mini070113-01.dmp
ASKER CERTIFIED SOLUTION
Avatar of Davis McCarn
Davis McCarn
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of compsupport

ASKER

We have removed the Network Threat Protection and so far so good.
We did suspect something related to Symantec but we also have Symantec Mail Security on this server but thanks for pointing us to Endpoint.