Windows 7 crash when logging off

I have a user that started having his Windows 7 pro sp1 64bit desktop crash when logging off last week. I was on a different forum and there were several others with the same problem, that started around the same time. I will post the dumb file below.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000001, session ID
Arg2: 0000000000000350, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000001, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------

Use !poolused 8 to dump allocation info for leaked session pooltags.

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  7601.24059.amd64fre.win7sp1_ldr_escrow.180308-1637

SYSTEM_MANUFACTURER:  LENOVO

SYSTEM_PRODUCT_NAME:  10A9000SUS

SYSTEM_SKU:  LENOVO_MT_10A9

SYSTEM_VERSION:  ThinkCentre M93p

BIOS_VENDOR:  LENOVO

BIOS_VERSION:  FBKT56AUS

BIOS_DATE:  11/18/2013

BASEBOARD_MANUFACTURER:  LENOVO

BASEBOARD_PRODUCT:  SHARKBAY

BASEBOARD_VERSION:  0B98401 PRO

DUMP_TYPE:  1

BUGCHECK_P1: 1

BUGCHECK_P2: 350

BUGCHECK_P3: 0

BUGCHECK_P4: 1

BUGCHECK_STR:  0xAB_Pool

SESSION_POOL_TAG: Pool

CPU_COUNT: 4

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R)  SIG: 17'00000000 (cache) 17'00000000 (init)

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  Z240-1

ANALYSIS_SESSION_TIME:  03-28-2018 16:15:09.0702

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER:  from fffff8000363a15f to fffff800032fa3a0

STACK_TEXT:  
fffff880`088b59b8 fffff800`0363a15f : 00000000`000000ab 00000000`00000001 00000000`00000350 00000000`00000000 : nt!KeBugCheckEx
fffff880`088b59c0 fffff800`03505d30 : 00000000`00000000 fffffa80`07630b50 fffffa80`07630b50 fffffa80`07630b50 : nt!MiCheckSessionPoolAllocations+0x13f
fffff880`088b5a00 fffff800`035dd3c5 : fffff880`088b5aa8 fffffa80`076135a0 00000000`00000000 fffffa80`076135a0 : nt!MiDereferenceSessionFinal+0x130
fffff880`088b5ab0 fffff800`03294ad7 : ffffffff`ffffffff fffff8a0`0100a280 00000000`00020cb9 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x25635
fffff880`088b5ae0 fffff800`0368cd24 : fffff8a0`0100a280 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x957
fffff880`088b5b30 fffff800`035739dd : 00000000`00000000 fffff800`0359d401 00000000`00000000 fffffa80`07a1db50 : nt!PspExitThread+0x944
fffff880`088b5bf0 fffff800`03300816 : fffff880`031dc180 00000000`00000080 fffffa80`07630b50 00000000`000000d1 : nt!PspTerminateThreadByPointer+0x4d
fffff880`088b5c40 00000000`00000000 : fffff880`088b6000 fffff880`088b0000 fffff880`088b5880 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC:  8a355d6d43b58f88be5e2ac0803c51f05449fe11

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  6904b79a16eb8aa092ea0155ce5ed6a7d8b931d6

THREAD_SHA1_HASH_MOD:  cb5f414824c2521bcc505eaa03e92fa10922dad8

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+13f
fffff800`0363a15f cc              int     3

FAULT_INSTR_CODE:  cccccccc

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+13f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  5aa1f203

IMAGE_VERSION:  6.1.7601.24059

STACK_COMMAND:  .thread ; .cxr ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_LEAKED_SESSION_POOLTAG_Pool

BUCKET_ID:  X64_LEAKED_SESSION_POOLTAG_Pool

PRIMARY_PROBLEM_CLASS:  X64_LEAKED_SESSION_POOLTAG_Pool

TARGET_TIME:  2018-03-28T18:55:18.000Z

OSBUILD:  7601

OSSERVICEPACK:  1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2018-03-08 21:31:31

BUILDDATESTAMP_STR:  180308-1637

BUILDLAB_STR:  win7sp1_ldr_escrow

BUILDOSVER_STR:  6.1.7601.24059.amd64fre.win7sp1_ldr_escrow.180308-1637

ANALYSIS_SESSION_ELAPSED_TIME:  467

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_leaked_session_pooltag_pool

FAILURE_ID_HASH:  {9650ff51-11f4-b11b-e151-128a2efd0412}

Followup:     MachineOwner
ibewlocal98Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Alex Green3rd Line Server SupportCommented:
Have you tried resetting the user profile? Go to the registry HKLM:software\microsoft\windows nt\ current version\profilelist

In there, delete the users registry storage data, you can tell which user it is on the right hand side with the ProfileImagePath name.

Then, rename the local profile to .old and reboot the machine.

Another thing to check, is this happening with all users who log onto the machine?

Thanks

Alex
0
ibewlocal98Author Commented:
It doesn't happen every time. I tried yesterday to replicate the problem on his pc without any success. I viewed reliability history and could see that it started around 3-15-18. I think it is related to a Microsoft update. Here is a dump file from someone on a different forum that is having the same problem.


*******************************************************************************
*                                                                           *
*                       Bugcheck Analysis                                   *
*                                                                           *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000001, session ID
Arg2: 0000000000000350, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000001, total number of paged and nonpaged allocations that are leaking.
  nonpaged allocations are in the upper half of this word,
  paged allocations are in the lower half of this word.

Debugging Details:
------------------

Use !poolused 8 to dump allocation info for leaked session pooltags.

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 7601.24059.amd64fre.win7sp1_ldr_escrow.180308-1637

SYSTEM_MANUFACTURER: Dell Inc.

SYSTEM_PRODUCT_NAME: OptiPlex 390

SYSTEM_VERSION: 01

BIOS_VENDOR: Dell Inc.

BIOS_VERSION: A11

BIOS_DATE: 10/14/2013

BASEBOARD_MANUFACTURER: Dell Inc.

BASEBOARD_PRODUCT: 0F6X5P

BASEBOARD_VERSION: A00

DUMP_TYPE: 1

BUGCHECK_P1: 1

BUGCHECK_P2: 350

BUGCHECK_P3: 0

BUGCHECK_P4: 1

BUGCHECK_STR: 0xAB_Pool

SESSION_POOL_TAG: Pool

CPU_COUNT: 4

CPU_MHZ: c15

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 2a

CPU_STEPPING: 7

CPU_MICROCODE: 6,2a,7,0 (F,M,S,R) SIG: 29'00000000 (cache) 29'00000000 (init)

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: DC01

ANALYSIS_SESSION_TIME: 03-28-2018 08:48:29.0432

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER: from fffff80002def15f to fffff80002aaf3a0

STACK_TEXT:
fffff880`06cf09b8 fffff800`02def15f : 00000000`000000ab 00000000`00000001 00000000`00000350 00000000`00000000 : nt!KeBugCheckEx
fffff880`06cf09c0 fffff800`02cbad30 : 00000000`00000000 fffffa80`07f71060 fffffa80`07f71060 fffffa80`07f71060 : nt!MiCheckSessionPoolAllocations+0x13f
fffff880`06cf0a00 fffff800`02d923c5 : fffff880`06cf0aa8 fffffa80`05f56b00 00000000`00000000 fffffa80`05f56b00 : nt!MiDereferenceSessionFinal+0x130
fffff880`06cf0ab0 fffff800`02a49ad7 : ffffffff`ffffffff fffff8a0`04457c40 00000000`0000c6c0 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x25635
fffff880`06cf0ae0 fffff800`02e41d24 : fffff8a0`04457c40 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x957
fffff880`06cf0b30 fffff800`02d289dd : fffffa80`00000000 fffff800`02d52401 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x944
fffff880`06cf0bf0 fffff800`02ab5816 : fffff800`02bf4180 00000000`00000080 fffffa80`07f71060 00000000`04b4aa00 : nt!PspTerminateThreadByPointer+0x4d
fffff880`06cf0c40 00000000`00000000 : fffff880`06cf1000 fffff880`06ceb000 fffff880`06cf0230 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC: 8a355d6d43b58f88be5e2ac0803c51f05449fe11

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6904b79a16eb8aa092ea0155ce5ed6a7d8b931d6

THREAD_SHA1_HASH_MOD: cb5f414824c2521bcc505eaa03e92fa10922dad8

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+13f
fffff800`02def15f cc             int   3

FAULT_INSTR_CODE: cccccccc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiCheckSessionPoolAllocations+13f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 5aa1f203

IMAGE_VERSION: 6.1.7601.24059

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_LEAKED_SESSION_POOLTAG_Pool

BUCKET_ID: X64_LEAKED_SESSION_POOLTAG_Pool

PRIMARY_PROBLEM_CLASS: X64_LEAKED_SESSION_POOLTAG_Pool

TARGET_TIME: 2018-03-27T23:53:52.000Z

OSBUILD: 7601

OSSERVICEPACK: 1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-03-08 18:31:31

BUILDDATESTAMP_STR: 180308-1637

BUILDLAB_STR: win7sp1_ldr_escrow

BUILDOSVER_STR: 6.1.7601.24059.amd64fre.win7sp1_ldr_escrow.180308-1637

ANALYSIS_SESSION_ELAPSED_TIME: 1048

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_leaked_session_pooltag_pool

FAILURE_ID_HASH: {9650ff51-11f4-b11b-e151-128a2efd0412}

Followup:   MachineOwner
0
pgm554Commented:
It's calling out a bad video driver.
Did the update push out a new one?

Also ,your BIOS is way out of date.
The latest is dated 28 march 2018

https://support.lenovo.com/us/en/downloads/ds035753
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

ibewlocal98Author Commented:
1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
larryhSr. Software EngineerCommented:
We have seen this same issue on several of our computers as well.  For us it seems to be tied to using Remote Desktop to connect to another computer.  

Try this:
  1. Log on to computer.
  2. Log off of computer.  Do you get the BSOD?  (We don't)
  3. Log on to computer.
  4. Log on using Remote Desktop (RDP) to another computer.
  5. Disconnect from remote computer (or log off from remote computer).
  6. Log off of local computer.  (We get a BSOD at this point.)

From what I’ve read online two patches have known issues like we’re seeing:
KB4088875: https://support.microsoft.com/en-us/help/4088875/windows-7-update-kb4088875
KB4088878: https://support.microsoft.com/en-ca/help/4088878/windows-7-update-kb4088878

Look at the bottom of each article and you will see the very error message we’re seeing (SESSION_HAS_VALID_POOL_ON_EXIT).

I’ve tried applying the patch mentioned (KB4099467) but it doesn’t help.
0
ibewlocal98Author Commented:
The Hotfix has solved the issue that we were having.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.