Solved

Windows 7 Pro 64bit Pc locking up can only move mouse.

Posted on 2013-12-20
14
256 Views
Last Modified: 2013-12-30
i have 10 of a Lenovo m83 10AM0009US Small Form Factor PC with Samsung EVO 120GB SSD Hard Drives. These systems came with a standard Sata 500GB WD HDD that i made an image of and then applied the same image to all of the 10 Lenovo machines with the SSDs.
They are all connected to a server 2003 standard domain. I am having an issue with 1 machine where at random times the whole system locks up. I can only move mouse, no keyboard activity. Have to do a hard boot to come backup. I have ran Samsung Magic on the SSD to check the drive. I also did all updates windows and Lenovo even bios. I checked the event logs and i only see errors 136 and 137 I have tried to delete the two hidden files and runs a fsutil command and restarted the pc but no luck on errors. I dont think these errors are the issue.  I have ran the windows Memory test and no errors.  Is there anything else i can try. Note i am troubleshooting this remotely via Kaseya.
0
Comment
Question by:noclav
  • 5
  • 2
  • 2
  • +5
14 Comments
 
LVL 10

Expert Comment

by:remmett70
ID: 39732124
My guess is a hardware issue on that one PC and will be difficult to troubleshoot remotely unless you have somebody local that can do the work.
 
I'd do a component swap between two of the machines, move RAM, HD, and anything else short of the motherboard between the two machines and than watch to see if the lockup issue stays on the same machine or moves.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39732139
This is typically caused by bad block recovery.  Check the system log and look for unrecoverable read errors.  If you see them, backup immediately and go shopping for a replacement HDD.
0
 
LVL 3

Expert Comment

by:IKtech
ID: 39732210
If the problem follows the HDD to another computer the drive is the problem (as mentioned above).  What happens in safemode?  It might also be a driver that is causing an issue. IF it is a driver the problem will also follow the HDD.

You could run diagnostics on the HDD and if it seems to pass, try to reimage this machine.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39732303
I don't recommend reimaging.  If the problem is bad blocks then reimaging will remap them, and you will still have a ticking time bomb bad HDD ... which will bite you again.  If it loses data in infancy, it will certainly lose data in the future.  

As IKtech suggested, move the HDD to another machine (or move one of the other imaged HDDs into this machine).  I don't see it being the driver since you have other machines with same images and hardware.

Or you can just contact the supplier and tell them you have a suspect drive that is locking up and ask for details on a freebie download to test the device prior to getting your money back.  The odds favor it is a HDD, so spend your time confirming this before looking at things out of your control.
0
 

Author Comment

by:noclav
ID: 39732355
I will pickup this machine later today and run a full hardware scan. I just wanted to know if there is a way to determine the issue mainly remotely. Like using Permon. I have ran 2 SSD Drive Testers and all pass.
0
 
LVL 10

Expert Comment

by:tmoore1962
ID: 39732473
If mouse moves could be a corrupted Keyboard driver, especially if its USB remove from dev man and redetect
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39732482
I expect samsung has a MS-DOS or hopefully windows-based utility you can run.  Go to their website under support. Perfmon, or any other native windows program won't do this type of diagnostic.  The information you need is vendor/product specific.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 13

Expert Comment

by:Michael Machie
ID: 39732544
If you have a bootable media for Ubuntu or Fedora you could boot off the USB/CD-ROM and verify your hardware is working. I have seen some situations where Windows gets corrupted and loses the ability to work with hardware, but booting off a different O/S (like one on a flash drive) everything works good. This will tell you if the hardware is faulty or just the drivers/OS.
0
 

Author Comment

by:noclav
ID: 39732576
I have been hammering at this machine remotely for the past 3 hrs and no freezes. I did go in intels site and found an updated driver for the NIC but dont think that was the issue.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39732605
Look, if you have a few bad blocks then you can't expect to see a freeze. You have about 250 billion blocks on that SSD. The odds of you just hitting one of them by running programs lightly already in RAM are ... well, you have a better chance at powerball ;)

If you wanted to certify that a car is fully operational, you just would't drive it around for 3 hours and say it is good because the engine didn't die.   You would hook up the diagnostic hardware/software and run the entire suite of code and certify each component as known good.
0
 
LVL 91

Expert Comment

by:nobus
ID: 39733329
look if there is a firmware update for the SSD - i believe it is in the magician software :  http://www.samsung.com/global/business/semiconductor/minisite/SSD/uk/html/about/SSD840EVO.html
0
 
LVL 8

Accepted Solution

by:
Ratnesh Mishra earned 375 total points
ID: 39743568
System hang /crash situation troubleshooting is always difficult or almost impossible. As you mentioned you are try to troubleshoot remotely ,
Is the situation which you mentioned is in remote session or at the console ?
Apart from this if you are able to move mouse it means machine is in soft hang situation and you can generate complete memory dump by creating following registry key entry :-

To enable the feature on a computer that uses a PS/2 keyboard, follow these steps:
Start Registry Editor.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
On the Edit menu, click Add Value, and then add the following registry entry:
Name : CrashOnCtrlScroll
Data Type : REG_DWORD
Value : 1  
Exit Registry Editor.
If you are using a USB keyboard, you have to create the CrashOnCtrlScroll registry entry.

To enable the feature on a computer that uses a USB keyboard, follow these steps:
Start Registry Editor.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters
On the Edit menu, click Add Value, and then add the following registry entry:
Name : CrashOnCtrlScroll
Data Type : REG_DWORD
Value : 1  
Exit Registry Editor.

Also need to check the value of the registry key to be 1 else to it manually :

set the CrashDumpEnabled registry entry under the following registry subkey to 1:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

And also set the page file size to be either system manage or make it 1.5 time that of RAM .


Once the issue reappear on physical machine  please press "Right CTRL" while pressing it ,hit scroll lock twice . It will give you blue you screen and a memory dump for analysis then only we will be able to understand what might be causing the issue . If event id mentioned and its source is NTFS then certainly either a log file corruption or disk corruption is observed.
0
 
LVL 91

Expert Comment

by:nobus
ID: 39743611
since you have 10 of these - try swapping hardware : disk, Ram, cd drive etc...to pinpoint the problem
look also in event viewer for info on the lockup
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39743660
For what it is worth, the correct way to fix such things is to buy motherboard test hardware.  Decent testers will set you back $500+ but they will almost always tell what the problem is, or at least what it is not.

Brute force trial and error component replacement won't always work, especially if there is an interoperability problem, like your memory not being correct.  (Have you looked at the specs for your motherboard and verified that the exact make/models of memory & CPU are certified for the motherboard?  If you are not using the SAME make/models that are certified by the motherboard maker then those components are always going to be suspect.)

Surprisingly, many people think that all memory is alike, as long as it physically plugs in and you have the speed right .. but there is much more to the specs than that)
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now