Event 41 Kernal Power

recently an HP Proliant /w Server 2016 Essentials reboots 2-5 times a day. I am getting a Event 41 error. I have changed out the Memory hoping that was the issue. It was not the problem. No new hardware has been installed prior to the issue.  Any help on where to start looking would be great.
Ross MaddoxIT DirectorAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
Does %SystemRoot%\MEMORY.DMP exist?
0
Ross MaddoxIT DirectorAuthor Commented:
yes it does it is 1.7GB in size.
0
Hello ThereSystem AdministratorCommented:
Well, bad power supply or overheating might cause this.
Read this and come back with BugcheckCode related to event 41.

This below applies to Windows 10 machines when this error occurs but you can take something useful from it.
• Check all power cables, cables from power supply into motherboard and GPU are all in place and tight. Check all cables within the computer. Retest.
• Check or swap any UPS, surge protectors, extension leads or multi-plugs. Retest.
• Remove all extra drives, USB devices (aside from keyboard and mouse) and anything aside from critical components you have drawing power from the computer. Retest.
• Remove any overclocking if you have it enabled. Retest.
• Set the power settings within Windows to maximum performance. Retest.
• Change the fuse in the wall plug or try a different cable between power supply and wall socket. Retest.

If none of those steps stop the error, you need to consider replacing your power supply.
0
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

Hello ThereSystem AdministratorCommented:
That event ID is simply a message indicating that the hard drive was not shut down cleanly along with Windows. You may be having some issues with either your memory or power-saving features.

Consider updating the Video Driver as well as the Power Manager Driver.

From another expert here:
Triage the computer and boot with a bootable CD / USB.
If it starts normally that way, there is an operating system issue.
If it does not start normally that way, there is a hardware issue.
0
Mitul PrajapatiIT SupervisorCommented:
It is required a clean reboot. I mean shutdown it and Turn on again if it is possible for you.
0
andyalderSaggar maker's framemakerCommented:
If it's a proper installation with HPE Systems Management Homepage installed you can browse to https://127.0.0.1:2381/ and get the insight management log, it will record any hardware events there (but not loss of power because it needs power to write to the log). If SMH isn't installed then reboot and press F10 to go to Intelligent Provisioning and you can get to the IML from there instead.
0
Ross MaddoxIT DirectorAuthor Commented:
Here is the mini dump file.



Loading Dump File [C:\Windows\Minidump\011718-40234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (8 procs) Free x64
Product: LanManNt, suite: SmallBusiness Enterprise TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 14393.0.amd64fre.rs1_release.160715-1616
Machine Name:
Kernel base = 0xfffff800`ce81d000 PsLoadedModuleList = 0xfffff800`ceb22060
Debug session time: Wed Jan 17 19:27:28.059 2018 (UTC - 5:00)
System Uptime: 0 days 1:30:08.614
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffe1058e466000, 2, fffff803ad9028b0, 0}


Could not read faulting driver name
Probably caused by : srv.sys ( srv!SrvOs2FeaToNt+48 )

Followup:     MachineOwner
---------

4: kd> analyze -v
Couldn't resolve error at 'nalyze -v'
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe1058e466000, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff803ad9028b0, If non-zero, the instruction address which referenced the bad memory
      address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  10.0.14393.0 (rs1_release.160715-1616)

SYSTEM_MANUFACTURER:  HP

SYSTEM_PRODUCT_NAME:  ProLiant ML110 Gen9

SYSTEM_SKU:  840667-S01

BIOS_VENDOR:  HP

BIOS_VERSION:  P99

BIOS_DATE:  09/12/2016

BASEBOARD_MANUFACTURER:  HP

BASEBOARD_PRODUCT:  ProLiant ML110 Gen9

DUMP_TYPE:  2

DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

BUGCHECK_P1: ffffe1058e466000

BUGCHECK_P2: 2

BUGCHECK_P3: fffff803ad9028b0

BUGCHECK_P4: 0

READ_ADDRESS: fffff800cebc4338: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
 ffffe1058e466000

FAULTING_IP:
srv!SrvOs2FeaToNt+48
fffff803`ad9028b0 c60300          mov     byte ptr [rbx],0

MM_INTERNAL_CODE:  0

CPU_COUNT: 8

CPU_MHZ: da8

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 4f

CPU_STEPPING: 1

CPU_MICROCODE: 6,4f,1,0 (F,M,S,R)  SIG: B00001E'00000000 (cache) B00001E'00000000 (init)

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

BUGCHECK_STR:  AV

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_SESSION_HOST:  DG-PHY

ANALYSIS_SESSION_TIME:  01-18-2018 09:20:47.0001

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

TRAP_FRAME:  ffffad805e41f6e0 -- (.trap 0xffffad805e41f6e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffe1058e466000
rdx=ffffbe85f311409a rsi=0000000000000000 rdi=0000000000000000
rip=fffff803ad9028b0 rsp=ffffad805e41f870 rbp=ffffbe85f3114095
 r8=0000000000000000  r9=0000000000000000 r10=ffff800000000000
r11=ffffe1058e466000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
srv!SrvOs2FeaToNt+0x48:
fffff803`ad9028b0 c60300          mov     byte ptr [rbx],0 ds:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800ce97f1af to fffff800ce966f90

STACK_TEXT:  
ffffad80`5e41f3e8 fffff800`ce97f1af : 00000000`00000050 ffffe105`8e466000 00000000`00000002 ffffad80`5e41f6e0 : nt!KeBugCheckEx
ffffad80`5e41f3f0 fffff800`ce89472a : 00000000`00000002 00000000`00000000 ffffad80`5e41f6e0 ffffad80`5e41f500 : nt! ?? ::FNODOBFM::`string'+0x8fef
ffffad80`5e41f4e0 fffff800`ce9705fc : 00000000`00000280 ffffad80`5e41a000 00000000`00000000 00001f80`0100db9c : nt!MmAccessFault+0x9ca
ffffad80`5e41f6e0 fffff803`ad9028b0 : 00000000`00000000 6c336352`2f325954 ffffad80`5e41f998 ffffad80`5e41f990 : nt!KiPageFault+0x13c
ffffad80`5e41f870 fffff803`ad9027f9 : ffffbe85`f3114095 ffffe105`8e465ff8 00000000`00000010 ffffbe85`f3114138 : srv!SrvOs2FeaToNt+0x48
ffffad80`5e41f8a0 fffff803`ad923ec3 : ffffe105`87340cc0 00000000`00000000 ffffbe85`f3104010 00000000`00000000 : srv!SrvOs2FeaListToNt+0x125
ffffad80`5e41f8f0 fffff803`ad92ceae : 00000000`00000000 fffff803`00010fe8 ffffe105`8e455010 ffffe105`87340cc0 : srv!SrvSmbOpen2+0xc3
ffffad80`5e41f990 fffff803`ad93006b : ffff818f`a08cadb0 ffffbe85`f3104010 00000000`00000002 00000000`00001000 : srv!ExecuteTransaction+0x1be
ffffad80`5e41f9d0 fffff803`ad8bda4e : fffff803`00000000 ffffe105`00000000 ffff818f`00000035 00000000`0000f3d0 : srv!SrvSmbTransactionSecondary+0x40b
ffffad80`5e41fa70 fffff803`ad8bdc24 : ffffe105`87340cc0 00000000`00000000 ffffe105`87341730 fffff803`ad8c8000 : srv!SrvProcessSmb+0x236
ffffad80`5e41faf0 fffff803`ad8fca36 : ffffe105`8727f020 ffffe105`87340cd0 00000000`00000000 ffffe105`87340cd0 : srv!SrvRestartReceive+0x114
ffffad80`5e41fb30 fffff800`ced4e908 : ffff818f`a39b2fe0 ffffe105`832a8700 ffffe105`87284040 00000000`00000080 : srv! ?? ::NNGAKEGL::`string'+0x3526
ffffad80`5e41fbb0 fffff800`ce8b94bd : ffff818f`a3724e48 ffff818f`a3724e00 ffff818f`a3724eb8 ffff818f`a38f8ac0 : nt!IopThreadStart+0x34
ffffad80`5e41fc10 fffff800`ce96c456 : ffffad80`5a651180 ffffe105`87284040 fffff800`ce8b947c 00000000`00000000 : nt!PspSystemThreadStartup+0x41
ffffad80`5e41fc60 00000000`00000000 : ffffad80`5e420000 ffffad80`5e41a000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC:  4037e4b1c59b59cefc68ec3809863292699dcde2

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  df2d141f790c56f100c1a75670672ec6437b2da0

THREAD_SHA1_HASH_MOD:  8f10e91895468b5b2a56df2106350f23f731e5ce

FOLLOWUP_IP:
srv!SrvOs2FeaToNt+48
fffff803`ad9028b0 c60300          mov     byte ptr [rbx],0

FAULT_INSTR_CODE:  480003c6

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  srv!SrvOs2FeaToNt+48

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: srv

IMAGE_NAME:  srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  57899ad8

IMAGE_VERSION:  10.0.14393.0

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  48

FAILURE_BUCKET_ID:  AV_INVALID_srv!SrvOs2FeaToNt

BUCKET_ID:  AV_INVALID_srv!SrvOs2FeaToNt

PRIMARY_PROBLEM_CLASS:  AV_INVALID_srv!SrvOs2FeaToNt

TARGET_TIME:  2018-01-18T00:27:28.000Z

OSBUILD:  14393

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  307

PRODUCT_TYPE:  2

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 LanManNt SmallBusiness Enterprise TerminalServer SmallBusinessRestricted SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2016-07-15 22:16:17

BUILDDATESTAMP_STR:  160715-1616

BUILDLAB_STR:  rs1_release

BUILDOSVER_STR:  10.0.14393.0

ANALYSIS_SESSION_ELAPSED_TIME:  ba8

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_invalid_srv!srvos2featont

FAILURE_ID_HASH:  {2750870e-d6f7-3f1d-0183-8d82a48b25bf}

Followup:     MachineOwner
---------
0
Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
All that I can detect as trace is a call to SMB routines, which hint towards a network drive issue.
0
Ross MaddoxIT DirectorAuthor Commented:
There are no network drives hooked up to the server.
0
Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
But the server certainly communicates with other machines using SMB.
0
Ross MaddoxIT DirectorAuthor Commented:
update to case, there is alot of disk activity. It spikes to 100% often. Any more ideas to check would be great thanks.
0
Hello ThereSystem AdministratorCommented:
Open Task Manager and tell us what loads your disk most.
0
Ross MaddoxIT DirectorAuthor Commented:
svchost.exe (netsvcs)
system
0
Hello ThereSystem AdministratorCommented:
Open CMD as admin: net stop wuauclt
Then delete: C:\Windows\SoftwareDistribution\
Check Task Manager. Any change?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ross MaddoxIT DirectorAuthor Commented:
Deleting the Software Distribution folder worked!
0
Hello ThereSystem AdministratorCommented:
I am glad to hear that. Please mark all helpful post. Thanks!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Server Hardware

From novice to tech pro — start learning today.