Windows 7 crash when logging off

I have a user that started having his Windows 7 pro sp1 64bit desktop crash when logging off last week. I was on a different forum and there were several others with the same problem, that started around the same time. I will post the dumb file below.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000001, session ID
Arg2: 0000000000000350, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000001, total number of paged and nonpaged allocations that are leaking.
      nonpaged allocations are in the upper half of this word,
      paged allocations are in the lower half of this word.

Debugging Details:
------------------

Use !poolused 8 to dump allocation info for leaked session pooltags.

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  7601.24059.amd64fre.win7sp1_ldr_escrow.180308-1637

SYSTEM_MANUFACTURER:  LENOVO

SYSTEM_PRODUCT_NAME:  10A9000SUS

SYSTEM_SKU:  LENOVO_MT_10A9

SYSTEM_VERSION:  ThinkCentre M93p

BIOS_VENDOR:  LENOVO

BIOS_VERSION:  FBKT56AUS

BIOS_DATE:  11/18/2013

BASEBOARD_MANUFACTURER:  LENOVO

BASEBOARD_PRODUCT:  SHARKBAY

BASEBOARD_VERSION:  0B98401 PRO

DUMP_TYPE:  1

BUGCHECK_P1: 1

BUGCHECK_P2: 350

BUGCHECK_P3: 0

BUGCHECK_P4: 1

BUGCHECK_STR:  0xAB_Pool

SESSION_POOL_TAG: Pool

CPU_COUNT: 4

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R)  SIG: 17'00000000 (cache) 17'00000000 (init)

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  Z240-1

ANALYSIS_SESSION_TIME:  03-28-2018 16:15:09.0702

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER:  from fffff8000363a15f to fffff800032fa3a0

STACK_TEXT:  
fffff880`088b59b8 fffff800`0363a15f : 00000000`000000ab 00000000`00000001 00000000`00000350 00000000`00000000 : nt!KeBugCheckEx
fffff880`088b59c0 fffff800`03505d30 : 00000000`00000000 fffffa80`07630b50 fffffa80`07630b50 fffffa80`07630b50 : nt!MiCheckSessionPoolAllocations+0x13f
fffff880`088b5a00 fffff800`035dd3c5 : fffff880`088b5aa8 fffffa80`076135a0 00000000`00000000 fffffa80`076135a0 : nt!MiDereferenceSessionFinal+0x130
fffff880`088b5ab0 fffff800`03294ad7 : ffffffff`ffffffff fffff8a0`0100a280 00000000`00020cb9 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x25635
fffff880`088b5ae0 fffff800`0368cd24 : fffff8a0`0100a280 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x957
fffff880`088b5b30 fffff800`035739dd : 00000000`00000000 fffff800`0359d401 00000000`00000000 fffffa80`07a1db50 : nt!PspExitThread+0x944
fffff880`088b5bf0 fffff800`03300816 : fffff880`031dc180 00000000`00000080 fffffa80`07630b50 00000000`000000d1 : nt!PspTerminateThreadByPointer+0x4d
fffff880`088b5c40 00000000`00000000 : fffff880`088b6000 fffff880`088b0000 fffff880`088b5880 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC:  8a355d6d43b58f88be5e2ac0803c51f05449fe11

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  6904b79a16eb8aa092ea0155ce5ed6a7d8b931d6

THREAD_SHA1_HASH_MOD:  cb5f414824c2521bcc505eaa03e92fa10922dad8

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+13f
fffff800`0363a15f cc              int     3

FAULT_INSTR_CODE:  cccccccc

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+13f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  5aa1f203

IMAGE_VERSION:  6.1.7601.24059

STACK_COMMAND:  .thread ; .cxr ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_LEAKED_SESSION_POOLTAG_Pool

BUCKET_ID:  X64_LEAKED_SESSION_POOLTAG_Pool

PRIMARY_PROBLEM_CLASS:  X64_LEAKED_SESSION_POOLTAG_Pool

TARGET_TIME:  2018-03-28T18:55:18.000Z

OSBUILD:  7601

OSSERVICEPACK:  1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2018-03-08 21:31:31

BUILDDATESTAMP_STR:  180308-1637

BUILDLAB_STR:  win7sp1_ldr_escrow

BUILDOSVER_STR:  6.1.7601.24059.amd64fre.win7sp1_ldr_escrow.180308-1637

ANALYSIS_SESSION_ELAPSED_TIME:  467

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_leaked_session_pooltag_pool

FAILURE_ID_HASH:  {9650ff51-11f4-b11b-e151-128a2efd0412}

Followup:     MachineOwner