ࡱ >
" u@ ,w bjbj @z f f f f f f f f 8 p f 2 ^ k 7 \ 0 $ R ~ Q f k k f f q f f 4 V c f f D R zr . 0 t } W } 4 f f f f f f } f 1 f f D @ D q T f f @ C h a p t e r 1 0
T r o u b l e s h o o t i n g S t o p E r r o r s
W h e n a c o m p u t e r r u n n i n g M i c r o s o f t W i n d o w s S e r v e r "! 2 0 0 3 d e t e c t s a n u n e x p e c t e d p r o b l e m f r o m w h i c h i t c a n n o t r e c o v e r , a S t o p e r r o r o c c u r s . A S t o p e r r o r s e r v e s t o p r o t e c t t h e i n t e g r i t y o f t h e s y s t e m b y i m m e d i a t e l y s t o p p ing all processing. Although it is theoretically possible for WindowsServer2003 to continue functioning when it detects that a core component has experienced a serious problem, the integrity of the system would be questionable, which could lead to security violations, system corruption, and invalid transaction processing. When a Stop error occurs, WindowsServer2003 displays a Stop message, sometimes referred to as a blue screen, which is a text-mode error message that reports information about the condition. A basic understanding of Stop errors and their underlying causes improves your ability to locate and understand technical information or perform diagnostic procedures requested of you by technical support personnel.
In This Chapter
Stop Errors Overview 3
Memory Dump Files 8
Stop Errors Recorded in the System Log 19
Being Prepared for Stop Errors 20
Common Stop Messages 22
Additional Resources 52
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
2003 Microsoft Corporation. All rights reserved.
Microsoft, Windows, Windows Server 2 0 0 3 , a n d t h e W i n d o w s l o g o a r e e i t h e r r e g i s t e r e d t r a d e m a r k s o r t r a d e m a r k s o f M i c r o s o f t C o r p o r a t i o n i n t h e U n i t e d S t a t e s a n d / o r o t h e r c o u n t r i e s .
T h e n a m e s o f a c t u a l c o m p a n i e s a n d p r o d u c t s m e n t i o n e d h e r e i n m a y b e t h e t r a d e m a r k s o f t h e i r r e s p e c t i v e o w n e r s .
S t o p E r r o r s O v e r v i e w
S t o p e r r o r s o n l y o c c u r w h e n a p r o b l e m c a n n o t b e h a n d l e d b y u s i n g t h e h i g h e r - l e v e l e r r o r - h a n d l i n g m e c h a n i s m s i n t h e M i c r o s o f t W i n d o w s S e r v e r "! 2 0 0 3 o p e r a t i n g s y s t e m . N o r m a l l y , w h e n a n e r r o r o c c u r s i n a n a p p l i c a t i o n , t h e a p p l i c a t i o n i n t e rprets the error message and provides detailed information to the system administrator. However, Stop errors are handled by the kernel, and WindowsServer2003 is only able to display basic information about the error, write the contents of memory to the disk (if memory dumps are enabled), and halt the system. This basic information, known as a Stop message, is described in more detail in Stop Messages in this chapter.
As a result of the minimal information provided in a Stop message, and the fact that the operating system stops all processing, Stop errors can be difficult to troubleshoot. Fortunately, they tend to occur very rarely. When they do occur, they are almost always caused by driver problems, hardware problems, or file inconsistencies.
Identifying the Stop Error
There are many different types of Stop errors. Each has its own possible causes and requires a unique troubleshooting process. Therefore, the first step in troubleshooting a Stop error is to identify the Stop error. You need the following information about the Stop error to begin troubleshooting:
Stop error number. This number uniquely identifies the Stop error.
Stop error parameters. These parameters provide additional information about the Stop error. Their meaning is specific to the Stop error number.
Driver information. When available, the driver information identifies the most likely source of the problem.
This information is often displayed as part of the Stop message. If possible, write it down to use as a reference during the troubleshooting process. If the operating system restarts before you can write down the information, you can often retrieve the information from the System log in Event Viewer. For more information, see Stop Errors Recorded in the System Log later in this chapter.
If you are unable to gather the Stop error number from the Stop message and the System log, you can retrieve it from a memory dump file. By default, WindowsServer2003 is configured to create a memory dump whenever a Stop error occurs. If no memory dump file was created, configure the system to create a memory dump file. Then, if the Stop error reoccurs, you will be able to extract the necessary information from the memory dump file. For information about using dump files, see Memory Dump Files later in this chapter.
Figure10.1 illustrates the process of identifying the Stop error information needed for further troubleshooting.
Figure10.1Identifying the Stop Error
Finding Troubleshooting Information
Each Stop error requires a different troubleshooting technique. Therefore, after you identify the Stop error and gather the associated information, search the following sources for troubleshooting information specific to that Stop error:
Common Stop Messages later in this chapter
Microsoft Debugging Tools for Windows Help
Microsoft Knowledge Base
Figure10.2 shows the process for identifying detailed troubleshooting information specific to your Stop error, after you have identified the Stop message number and parameters.
Figure10.2Finding Stop ErrorSpecific Troubleshooting Information
Common Stop Messages later in this chapter is intended as a reference for troubleshooting Stop errors; however, it does not include every possible Stop error. If the Stop error number you are troubleshooting is not listed in Common Stop Messages, refer to the Debugging Tools for Windows Help. Finally, the Microsoft Knowledge Base includes timely articles about a limited subset of Stop errors. Stop error information in the Microsoft Knowledge Base is often specific to a particular driver or hardware component, and generally includes step-by-step instructions for resolving the problem. Although it is rarely necessary, you can also consult Microsoft Product Support Services for troubleshooting services to resolve Stop errors.
Microsoft Knowledge Base
For related information, see the Microsoft Knowledge Base link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Microsoft Debugging Tools for Windows Help
Install the Microsoft Debugging Tools for Microsoft Windows, and consult Help for that tool. This Help contains the definitive list of Stop messages, including many not covered in this chapter, and explains how to troubleshoot a wide variety of Stop errors. To install Debugging Tools for Windows from the Microsoft Debugging Tools Web site, see the Debugging Tools link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Microsoft Product Support Services
If you cannot isolate the cause of the Stop error, obtain assistance from trained Microsoft Product Support Services personnel. You might need to furnish specific information and perform certain procedures to help technical support investigate your problem. For more information about Microsoft product support, see the Microsoft Product Support Services link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Stop Messages
Stop messages report information about Stop errors. The intention of the Stop message is to assist the system administrator in isolating, and eventually resolving, the problem that caused the Stop error. Stop messages provide a great deal of useful information to administrators who understand how to interpret the information in the Stop message. In addition to other information, the Stop message includes the Stop error number, or bug check code, which you can use to find or reference troubleshooting information about the specific Stop error in Common Stop Messages later in this chapter.
Stop Message Screen Sections
When examining a Stop message, you need to have a basic understanding of the problem so that you can plan a course of action. Always review the Stop message and record as much information about the problem as possible before searching through technical sources. Stop messages use a full-screen character mode format, as shown in Figure10.3. Each message is uniquely associated with alphanumeric characters.
Figure10.3Stop Message
As shown in Figure10.3, a Stop message screen has four major sections, which display the following information:
Recommended user action
Technical information
Driver information
Debug port and dump status information
Note
If the video display drivers have stopped functioning, the kernel might not be able to fully display all the Stop message contents; in such a case, only the first line will be visible.
Recommended user action
The Recommended user action section informs the user that a problem has occurred and that Windows was shut down. It also provides the symbolic name of the Stop error. In Figure10.3, the symbolic name is DRIVER_IRQL_NOT_LESS_OR_EQUAL. It also attempts to describe the problem and lists suggestions for recovery. In some cases, restarting the computer might be sufficient because the problem is not likely to recur. But if the Stop error persists after you restart the operating system, you must determine the root cause to return the operating system to an operable state. This process might involve undoing recent changes, replacing hardware, or updating drivers to eliminate the source of the problem. If you have enabled Emergency Management Services, you can restart and troubleshoot your computer remotely.
Technical information
The Technical information section lists the Stop error number as the first parameter, followed by up to four Stop error-specific codes (displayed as hexadecimal numbers enclosed in parentheses), which identify related parameters. Stop message codes contain a 0x prefix, which indicates that the number is in hexadecimal format. For example, in Figure10.3, the Stop error hexadecimal code is 0x000000D1 (often written as 0xD1).
Driver information
The Driver information section identifies the driver associated with the Stop error. If a file is specified by name, you can use Recovery Console or Safe Mode to verify that the driver is signed or has a date stamp that coincides with other drivers. If necessary, you can replace the file manually (in Recovery Console or in Safe Mode), or use Roll Back Driver to revert to a previous version.
Debug port and dump status information
The Debug port and dump status information section lists COM port parameters that a kernel debugger uses, if enabled. If you have enabled memory dump file saves, this section also indicates whether one was successfully written. As a dump file is being written to the disk, the percentage shown after Dumping physical memory to disk is incremented to 100. A value of 100 indicates that the memory dump was successfully saved.
For more information about installing and using kernel debuggers, see Using Symbol Files and Debuggers later in this chapter.
Memory Dump Files
When a Stop error occurs, WindowsServer2003 displays information that can help you analyze the root cause of the problem. WindowsServer2003 writes the information to the paging file (Pagefile.sys) on the systemdrive root by default. When you restart the computer in Start Windows Normally mode (commonly called normal mode) or Safe Mode after a Stop error occurs, WindowsServer2003 uses the paging file information to create a memory dump file in the systemroot or systemroot\Minidump folder. Analyzing dump files can provide more information about the root cause of a problem and lets you perform offline analysis by running analysis tools on another computer.
Configuring Memory Dump Files
You can configure your system to generate one of three different types of dump files:
Small memory dump files. Sometimes referred to as mini dump files, these dump files contain the least information. Small memory dump files can be written to disk quickly, which minimizes server downtime by allowing the operating system to restart sooner.
Kernel memory dump files. Records the contents of kernel memory. Kernel memory dump files require a larger paging file on the boot device than small memory dump files and take longer to create when a failure has occurred. However, they record significantly more information and are more useful when you need to perform in-depth analysis.
Complete memory dump files. Records the entire contents of physical memory when the Stop error occurred. A complete memory dump files size will be slightly larger than the amount of physical memory installed at the time of the error. This option is not available for computers with more than 2gigabytes (GB) of RAM.
By default, WindowsServer2003 is configured to create complete memory dump files. You can change the locations of the dump files by using System in Control Panel. By default, small memory dump files are saved in the systemroot\Minidump folder, and kernel and complete memory dump files are saved to a file named systemroot\Memory.dmp.
Servers that use Physical Address Extensions (PAE) can create only small and kernel memory dump files. PAE enables x86-based computers running WindowsServer2003, Enterprise Edition to access up to 32GB of memory by using the /PAE parameter in the Boot.ini file. This same parameter enables WindowsServer2003, Datacenter Edition to potentially access more than 32GB of memory, as allowed by the hardware platform. For more information about PAE, see PAE in Help and Support Center for WindowsServer2003, Enterprise Edition.
Configuring Small Memory Dump Files
Small memory dump files contain the least information, but they also consume the least disk space: 64KB for 32-bit systems and 128KB for 64-bit systems. By default, WindowsServer2003 stores small memory dump files in the systemroot\Minidump folder. The small dump file format is identical for x86-based and Itanium-based systems.
WindowsServer2003 always creates a small memory dump file when a Stop error occurs, even when you choose the kernel or complete memory dump file options. One of the services that use small memory dump files is the Error Reporting Service. The Error Reporting Service reads the contents of a small memory dump file to help diagnose problems that cause Stop errors. For more information about the Error Reporting Service, see Using Memory Dump Files to Analyze Stop Errors later in this chapter.
A small memory dump file records the smallest set of information that might identify the cause of the system stopping unexpectedly. For example, the small memory dump includes some of the following information:
Stop message information. Includes the error number and additional parameters that describe the Stop error.
A list of drivers running on the system. Identifies the modules in memory when the Stop error occurred. This device driver information includes the file name, date, version, size, and manufacturer.
Processor context information for the process that stopped. Includes the processor and hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts.
Kernel context information for the process that stopped. Includes offset of the directory table and the page frame number database, which describes the state of every physical page in memory.
Kernel context information for the thread that stopped. Identifies registers and interrupt request levels, and includes pointers to operating system data structures.
Kernel-mode call stack information for the thread that stopped. Consists of a series of memory locations, and includes a pointer to the initial location.
A small memory dump file requires a paging file of at least 2MB on the boot volume. The operating system saves each dump file with a unique file name every time a Stop error occurs. The file name includes the date the Stop error occurred. For example, Mini011003-02.dmp is the second small memory dump generated on January10, 2003.
Small memory dump files are useful when space is limited or when you are using a slow connection to send information to technical support personnel. Because of the limited amount of information that can be included, these dump files do not include errors that were not directly caused by the thread that was running when the problem occurred.
To configure WindowsServer2003 to generate only a small memory dump file
In Control Panel, double-click System, and then click the Advanced tab.
Under Startup and Recovery, click Settings.
In the Write debugging information list, click Small memory dump.
Click OK twice, and then restart the operating system if prompted.
By default, WindowsServer2003 saves small memory dump files to the systemroot\Minidump folder. You can change the folder location by typing a new path in the Small dump directory box under the Write debugging information list.
Configuring Kernel Memory Dump Files
By default, WindowsServer2003 systems create kernel memory dump files. The kernel memory dump file is an intermediate-size dump file that records only kernel memory and can occupy several megabytes (MB) of disk space. Kernel memory dumps take longer to create than a small dump file, and thus increase the downtime associated with a system failure. On most systems, the increase in downtime is minimal. Kernel memory dumps contain additional information that might assist troubleshooting the problem. When a Stop error occurs, WindowsServer2003 saves a kernel memory dump file to a file named systemroot\Memory.dmp and creates a small memory dump file in the systemroot\Minidump folder.
Note
When debugging WindowsServer2003, it is useful to know the memory range the kernel occupies to identify components that run within that space. On 32-bit systems, the kernel occupies memory from 0x80000000 to 0xFFFFFFFF. On 64-bit systems, the kernel occupies 0x6FC0000000000000 to 0xFFFFFFFF00000000.
A kernel memory dump file records only kernel memory information, which expedites the dump file creation process. The kernel memory dump file does not include unallocated memory or any memory allocated to user-mode programs. It includes only memory allocated to the Executive, kernel, hardware abstraction layer (HAL), and file system cache, in addition to nonpaged pool memory allocated to kernel-mode drivers and other kernel-mode routines.
The size of the memory dump file will vary, but is always less than the size of the system memory. When WindowsServer2003 creates the dump file, it first writes the information to the paging file. Therefore, the paging file might grow to the size of the physical memory. Later, the dump file information is extracted from the paging file to the actual memory dump file. To ensure that you have sufficient free space, verify that the system drive would have free space greater than the size of physical memory if the paging file were extended to the size of physical memory.
For most purposes, a kernel memory dump file is sufficient for troubleshooting Stop errors. It contains more information than a small memory dump file and is smaller than a complete memory dump file. It omits those portions of memory that are unlikely to have been involved in the problem. However, there are problems that require a complete memory dump for troubleshooting. If you have configured a kernel memory dump and you experience a Stop error that requires a complete memory dump to isolate the problem, you must specify that the operating system generate a complete memory dump and reproduce the Stop error to continue troubleshooting.
To configure WindowsServer2003 to generate a kernel memory dump file
In Control Panel, double-click System, and then click the Advanced tab.
Under Startup and Recovery, click Settings.
In the Write debugging information list, click Kernel memory dump.
Click OK twice, and then restart the operating system if prompted.
By default, WindowsServer2003 saves a kernel memory dump file to systemroot\Memory.dmp. You can change the default output location by typing a new value in the Dump file box under the Write debugging information list.
Note
By default, a new kernel memory dump file overwrites an existing one. To change the default setting, clear the Overwrite any existing file check box. You can also archive or move an existing dump file to another location prior to troubleshooting.
Configuring Complete Memory Dump Files
A complete memory dump file, sometimes referred to as a full dump file, contains everything that was in physical memory when the Stop error occurred. This includes all of the information included in a kernel memory dump file, plus user-mode memory. Therefore, complete memory dump files can be examined to reveal the contents of memory contained within applications, although this is rarely necessary or feasible when troubleshooting application problems.
If you choose to use complete memory dump files, you must have available space on the systemdrive partition large enough to hold the contents of the physical RAM. Additionally, you must have a paging file equal to the size of your physical RAM. Complete memory dump files for Itanium-based systems typically require more disk space than complete dump files for x86-based systems. For information about viewing the paging file size, see Ensuring Dump File Saves later in this chapter.
When a Stop error occurs, the operating system saves a complete memory dump file to a file named systemroot\Memory.dmp and creates a small memory dump file in the systemroot\Minidump folder. A Microsoft technical support engineer might ask you to change this setting to facilitate data uploads over slow connections. Depending on the speed of your Internet connection, uploading the data might not be practical and you might be requested to provide the memory dump file on removable media.
To configure WindowsServer2003 to generate a complete memory dump file
In Control Panel, double-click System, and then click the Advanced tab.
Under Startup and Recovery, click Settings.
In the Write debugging information list, click Complete memory dump.
Click OK twice, and then restart the operating system if prompted.
By default, WindowsServer2003 saves a complete memory dump file to systemroot\Memory.dmp. You can change the default location by typing in a new path in the Dump file box of the Write debugging information list.
Note
By default, new complete memory dump files overwrite existing files. To change this, clear the Overwrite any existing file check box. You can also choose to archive or move a dump file prior to troubleshooting.
Ensuring Dump File Saves
To help ensure that your operating system can properly save memory dump files, verify that the system drive has adequate free space, check for adequate hard disk space, and check for disk corruption.
Verifying System Drive Free Space
Verify that adequate free space exists on the systemdrive to accommodate the maximum paging file size for the selected dump file. For example, for complete memory dump files, the available space must be at least equal to the amount of physical memory present.
To view the maximum paging file size for each disk volume
In Control Panel, double-click System, and then click the Advanced tab.
Under Performance, click Settings.
In the Performance Options dialog box, click the Advanced tab.
Under Virtual memory, click Change.
In the Virtual Memory dialog box, view the paging file information. Under Total paging file size for all drives, the Currently allocated value indicates the paging file disk space used.
If you click Custom size, you can specify different paging file sizes by entering values for Initial size (MB) and Maximum size (MB).
Verify that systemdrive has adequate disk space available to accommodate the maximum paging file size specified.
To avoid disk fragmentation when creating a memory dump, set the Initial size to a value greater than that required by the memory dump file, so that the paging file does not have to be expanded while the memory dump is created.
Checking for Adequate Hard Disk Space
Verify that the memory dump file path (by default, systemroot\Memory.dmp) contains sufficient free space to store the memory dump file. For more information about specifying disk dump file locations, see Configuring Memory Dump Files earlier in this chapter.
Checking for Disk Corruption
Verify that systemdrive, the volume containing the memory dump file, is not corrupted. To test hard disk or volume integrity, follow the instructions provided in Stop 0x00000024 or NTFS_FILE_SYSTEM later in this chapter.
Using Memory Dump Files to Analyze Stop Errors
Memory dump files record detailed information about the state of your operating system when the Stop error occurred. You can analyze memory dump files manually by using debugging tools or by using automated processes provided by Microsoft. The information you obtain can help you understand more about the root cause of the problem.
You can use the Error Reporting Service to upload your memory dump file information to Microsoft. You can also use the following debugging tools to manually analyze your memory dump files:
Microsoft Kernel Debugger (Kd.exe)
Microsoft WinDbg Debugger (WinDbg.exe)
As an additional troubleshooting option, you can configure your system to write an entry in the System log when a Stop error occurs.
Using the Error Reporting Service
When enabled, the Error Reporting Service monitors your operating system for faults related to operating system components and applications. Using the Error Reporting Service enables you to obtain more information about the problem or condition that caused the Stop error.
When a Stop error occurs, WindowsServer2003 displays a Stop message and writes diagnostic information to the memory dump file specified on the Advanced tab of the System Properties dialog box (as described in "Configuring Memory Dump Files" earlier in this chapter). For reporting purposes, the operating system also saves a small memory dump file. The next time you start your system by using normal mode or Safe Mode with Networking and log on to WindowsServer2003 as an Administrator, the Error Reporting Service gathers information about the problem and performs the following actions.
Shutdown Event Tracker appears
The Shutdown Event Tracker, although it is not directly related to the Error Reporting Service, appears immediately after an administrator authenticates to the system after a Stop error or other unexpected shutdown. This dialog box allows the administrator to add information about the Stop error to the event. The Stop error number and parameters are automatically added to the Comment field. After the administrator clicks OK, an event with the information is added to the System log with an Event ID of 1076. The normal logon process begins after the Shutdown Event Tracker is closed.
Displays an alert
Once the desktop environment has started, the Error Reporting Service displays a dialog box stating that the system has recovered from a serious error.
Provides the option to send a problem report
You can click Send Error Report or Don't Send. You also have the option to view the data the error report contains and can even view the location of the XML file that will be transmitted to Microsoft. This XML report contains the version and language of WindowsServer2003 you are using, and a list of all devices and drivers loaded in the system at the time the Stop error occurred.
If you click Send Error Report, the Error Reporting Service anonymously sends the report, which includes the small memory dump file that was just generated and the XML report, to Microsoft by using a Secure Socket Layer (SSL) encrypted session. You might be prompted to provide additional information to complete your error report. An error report contains information about what your operating system was doing when the problem occurred. Microsoft uses error report information to improve the quality of WindowsServer2003 in the form of product updates or future software revisions.
After the report has been uploaded, you are directed to the Online Crash Analysis Web site. If available, an analysis of the Stop error is provided. Depending on the nature of the error, you might be able to track the status of the Stop error. For more information about this Web site, see Using the Online Crash Analysis Web Site later in this chapter.
To enable the Error Reporting Service for Stop errors
In Control Panel, double-click System, and then click the Advanced tab.
Click Error Reporting to display the Error Reporting dialog box shown in Figure10.4.
Figure10.4Error Reporting Dialog Box
Click Enable error reporting.
Make sure the Windows operating system check box is selected.
The operating system always writes a supplemental small memory dump file when a Stop error occurs. Therefore, the Error Reporting Service can send a problem report with small memory dump file information, even if you have configured your system to generate kernel or complete memory dump files.
The Group Policy Object Editor can customize the Error Reporting Service in several useful ways. One of the most useful ways to customize the Error Reporting Service is to configure it to upload error reports without prompting an administrator. Error reports can be stored on a shared folder, which is useful for analyzing errors that occur across several different servers. Administrators can then analyze errors that occur across several different servers and filter which reports are sent to Microsoft for analysis. For more information about additional reporting options provided by the Error Reporting Service, see System and program error reporting overview in Help and Support Center for WindowsServer2003.
Using the Online Crash Analysis Web Site
You can use the Windows Online Crash Analysis Web site to track the status of unresolved error reports uploaded to Microsoft by the Error Reporting Service. For more information about the Error Reporting Service, see Using the Error Reporting Service earlier in this chapter.
To visit the Windows Online Crash Analysis Web site, click the Online Crash Analysis Web Site link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources. If you are using Error Reporting, the Error Reporting Service client automatically directs you to the Windows Online Crash Analysis Web site when you log on to WindowsServer2003 in normal mode or Safe Mode with Networking .
Information sent to Microsoft includes the following:
System information. Includes the operating system version and language.
Hardware data. Includes the number of processors installed and the amount of RAM available.
Date and time information. Indicates when the Stop error event occurred.
Stop message information. Includes the error number and additional parameters that describe the Stop error.
List of drivers running on the system. Identifies the modules in memory when the Stop error occurred. Device driver information sent includes the file name, date, version, size, and manufacturer.
Processor context information for the process that stopped. Includes the processor and hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts.
Kernel context information for the process that stopped. Includes offset of the directory table and the page frame number database, which describes the state of every physical page in memory.
Kernel context information for the thread that stopped. Identifies registers, interrupt request levels, and includes pointers to operating system data structures.
Kernel-mode call stack information for the interrupted thread. Consists of a series of memory locations and includes a pointer to the initial location.
If you need an immediate response before analysis of your dump file is complete, you can search the Microsoft Knowledge Base or submit a request to the Microsoft Product Support Services Web site. For more information about Microsoft Product Support Services, see the Microsoft Product Support Services link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Using Symbol Files and Debuggers
You can also analyze memory dump files by using a kernel debugger. Kernel debuggers are primarily intended to be used by developers for in-depth analysis of application behavior. However, kernel debuggers are also useful tools for administrators who are troubleshooting Stop errors. In particular, kernel debuggers can be used to analyze memory dump files after a Stop error has occurred.
A debugger is a program that enables users with the Debug programs user right (by default, only the Administrators group) to step through software instructions, examine data, and check for certain conditions. The following are two examples of kernel debuggers that you can obtain from Microsoft.
Kernel Debugger
Kernel Debugger (Kd.exe) is a command-line debugging tool that you can use to analyze a memory dump file written to disk when a Stop message occurs. Kernel Debugger requires that you install symbol files on your system.
WinDbg Debugger
WinDbg Debugger (WinDbg.exe) provides functionality similar to Kernel Debugger, but uses a GUI interface.
Both tools enable users with the Debug programs user right to analyze the contents of a memory dump file and debug kernel-mode and user-mode programs and drivers. Kernel Debugger and WinDbg Debugger are just a few of the many tools included in the Debugging Tools for Windows installation.
The rest of this section will discuss WinDbg usage.
Using WinDbg to Troubleshoot Stop Errors
To use WinDbg to analyze a crash dump, first install the debugging tools. Go to the Debugging Tools link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources and follow the instructions on the Microsoft Debugging Tools Web site.
To gather the most information from a memory dump file, provide the debugger access to symbol files. Symbol files enable the debugger to match memory addresses to human-friendly module and function names. The simplest way to provide the debugger access to symbol files is to configure the debugger to access the Microsoft Internet-connected symbol server.
To configure the debugger to use the Microsoft symbol server
Click the Start button, point to All Programs, point to Debugging Tools for Windows, and then click WinDbg.
On the File menu, click Symbol File Path.
In the Symbol path box, type:
SRV*localpath*http://msdl.microsoft.com/download/symbols
where localpath is a path on the hard disk that the debugger will use to store the downloaded symbol files. The debugger will automatically create localpath when you analyze a dump file.
For example, to store the symbol files in C:\Websymbols, set the symbol file path to SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols.
Alternatively, you can download the symbol files to your system for debugging when you have disconnected from the Internet.
To download symbol files for offline use
Go to the Driver Development Kits link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Find the symbol package that matches your version and processor type. Click the link to download the symbol package.
Follow the on-screen instructions to install the symbol files.
Note
Debuggers do not require access to symbol files to extract the Stop error number and parameters from a memory dump file. Often, the debugger can also identify the source of the Stop error without access to symbols.
To analyze a memory dump file
Click the Start button, point to All Programs, point to Debugging Tools for Windows, and then click WinDbg.
On the File menu, click Open Crash Dump.
Type the location of the memory dump file, and then click Open. By default, this location is %systemroot%\memory.dmp.
In the Save Workspace Information dialog box, click No.
Two windows will appear. The Disassembly window shows the assembly command that was executing when the Stop error occurred. This is generally not useful for high-level troubleshooting.
Select the Command window.
As shown in Figure10.5, the Bugcheck line tells you the Stop error number. The Probably caused by line indicates the file that was being processed at the time of the Stop error.
Figure10.5WinDbg analysis of a memory dump file
The Command window displays feedback from the debugger and allows you to issue additional commands. When a crash dump is opened, the Command window automatically displays the output of the !analyze command. In many cases, this default information is sufficient to isolate the cause of the Stop error. For more detailed information about the Stop error, type !analyze -v in the kd box of the Command window, and then press ENTER. This command will show the Stop message, which includes a description of the Stop error and the Stop error parameters.
Stop Errors Recorded in the System Log
You can use Event Viewer (Eventvwr.msc) to view entries in the System log that describe Stop errors that have occurred. Stop error information is automatically added to the System log with the Event ID 1003. The System log is the simplest way to view the Stop error number and parameters after a system has restarted. As shown in Figure10.6, the event information contains only the error number and parameters. For troubleshooting information specific to an error, find the error number in Common Stop Messages later in this chapter. To gather additional information about the Stop error, see Using Memory Dump Files to Analyze Stop Errors earlier in this chapter.
Figure10.6Stop Error Numbers and Parameters Available Within the System Log
Being Prepared for Stop Errors
Some useful software and hardware-related techniques can help you prepare for Stop errors when they occur. Stop messages do not always pinpoint the root of the problem, but they do provide important clues that you or a trained support technician can use to identify and troubleshoot the cause.
Prevent System Restarts After a Stop Error
When a Stop error occurs, WindowsServer2003 displays a Stop message related to the problem, followed by one of these events:
WindowsServer2003 becomes unresponsive.
WindowsServer2003 automatically restarts.
By default, WindowsServer2003 automatically restarts after a Stop error occurs, unless the system becomes unresponsive. If WindowsServer2003 restarts your system immediately after a Stop error occurs, you might not have enough time to record Stop message information that can help you analyze the cause of a problem. Additionally, you might miss the opportunity to change startup options or start the operating system in Safe Mode. Disabling the default restart behavior allows you to record Stop message text, information that can help you analyze the root cause of a problem if memory dump files are not accessible. Disabling the automatic restart causes a failed system to remain offline until an administrator manually restarts the system. Therefore, you should enable automatic restart on mission-critical servers and on remote servers that cannot be manually restarted.
To disable the Automatically restart option
In Control Panel, double-click System, and then click the Advanced tab.
Under Startup and Recovery, click Settings.
In the System failure box, clear the Automatically restart check box.
If you cannot start your computer in normal mode, you can perform the preceding steps in Safe Mode.
Record and Save Stop Message Information
With the automatic restart behavior disabled, you must restart your computer manually after a Stop message appears. Stop messages provide diagnostic information, such as Stop error numbers and driver names, which you can use to resolve the problem. However, this information disappears from the screen when you restart your computer. Generally, this information can be retrieved after the system is restarted by viewing the System log, as described in Stop Errors Recorded in the System Log earlier in this chapter, or examining the memory dump file, as described in Using Memory Dump Files to Analyze Stop Errors earlier in this chapter. There are situations where Stop error information is not successfully logged, and therefore it is important to record the information displayed in the Stop message for future reference. Before restarting the system, take the following actions to ensure that you have saved important information, which you can reference when using the resources listed in this chapter.
To record and save Stop message information
Record data that is displayed in the Technical information and Driver information sections of the Stop message for later reference. These sections are described in Stop Messages earlier in this chapter.
Record and evaluate suggestions in the Recommended user action section. Stop messages typically provide troubleshooting tips relevant to the error.
Check the Debug port and dump file status section to verify that WindowsServer2003 successfully created a memory dump file.
If a memory dump file does exist, copy the file to removable media, another disk volume, or a network location for safekeeping. You can use Recovery Console to copy the dump file if you are not able to start WindowsServer2003 in normal mode or Safe Mode.
Analyzing memory dump files can assist you with identifying root causes by providing you with detailed information about the system state when the Stop error occurred. The preceding steps enable you to save important information that you can refer to when using the resources listed in "Stop Messages" earlier in this chapter. For more information about creating and analyzing memory dump files, see Memory Dump Files earlier in this chapter.
Check Software Disk Space Requirements
Verify that adequate free space exists on your disk volumes for virtual memory paging files and application data files. Insufficient free space might cause Stop errors and other symptoms, including disk corruption. To determine the amount allocated to paging files, see Memory Dump Files earlier in this chapter.
You can move, delete, or compress unused files manually or by using Disk Cleanup (Cleanmgr.exe) to increase free space on disk volumes.
To run Disk Cleanup
In the Run dialog box, type:
cleanmgr
If you have more than one logical drive, select a disk volume to clean from the Select Drive dialog box, and then click OK. If you have only one logical drive, skip to step 3.
Click the Disk Cleanup or the More Options tab to specify files to compress or delete.
For more information about Disk Cleanup, see Disk Cleanup in Help and Support Center for WindowsServer2003.
Install a Kernel Debugger and Symbol Files
You can use a kernel debugger to gather more information about the problem. The Debugging Tools for Windows Help contains instructions and examples that can help you find additional information about the Stop error affecting you. For more information about installing and using debugging tools, see Stop Messages and Using Memory Dump Files to Analyze Stop Errors earlier in this chapter.
Common Stop Messages
The following Stop message descriptions contain details that help you troubleshoot or learn more about specific Stop errors. For information about the format of Stop messages as displayed on the screen, see Stop Messages earlier in this chapter.
The list of Stop messages in this chapter is not comprehensive. For information about additional Stop messages, see Help in the Microsoft Debugging Tools for Windows, which contains a more extensive list of Stop messages, is updated regularly, and might have additional information that can help you troubleshoot a Stop error. Search by using the number of the Stop message in the format bug check 0xA.
For another source of information about individual Stop messages, see the Microsoft Knowledge Base link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources. Search by using the number of the Stop message, such as 0x0000000A or 0xA, as a keyword.
If errors persist after you have followed the recommendations, request assistance from Microsoft support personnel. For more information about Microsoft Product Support Services, see the Microsoft Product Support Services link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Note
Stop message codes are generally displayed in 32-bit hexadecimal form in 32-bit versions of WindowsServer2003, and 64-bit hexadecimal form in 64-bit versions. For example, the Stop message code for the IRQL_NOT_LESS_OR_EQUAL message is shown as 0x0000000A. However, in this section, codes are abbreviated by dropping the insignificant zeros. For example, the Stop message number 0x0000000A is shown as 0xA.
Stop 0xA or IRQL_NOT_LESS_OR_EQUAL
The Stop 0xA message indicates that a driver or the kernel attempted to access a memory location to which it did not have permission, or at a kernel interrupt request level (IRQL) that was too high. The kernel represents an IRQL as a number from 0 to 31, with higher numbers representing higher-priority interrupts. Normal thread execution is at the lowest priority: IRQL0. This Stop error is typically caused by faulty or incompatible hardware or software.
Interpreting the Stop 0xA Message
This Stop message has four parameters, as listed in Table10.1.
Table10.1Parameters for the Stop 0xA Message
ParameterDescriptionParameter 1Memory address that was improperly referencedParameter 2IRQL that was required to access the memoryParameter 3Type of access:
0x00000000 = read operation
0x00000001 = write operationParameter 4Address of the instruction that attempted to reference memory specified in parameter1
If the last parameter is within the address range of a device driver used on your system, you can determine which device driver was running when the memory access occurred. You can typically determine the driver name by reading the line that begins with:
**Address 0xZZZZZZZZ has base at
-
If the third parameter is the same as the first parameter, a special condition exists in which a system worker routine, carried out by a worker thread to handle background tasks known as work items, returned at a higher IRQL. In that case, some of the four parameters take on new meanings, as shown in Table10.2.
Table10.2Special Parameters for the 0xA Message
ParameterDescriptionParameter 1Address of the worker routineParameter 2Kernel IRQLParameter 3Address of the worker routineParameter 4Address of the work item
Troubleshooting the Stop 0xA Error
First, use the Event Viewer to review the System log for error events that identify the problem. The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Device driver issues
A Stop 0xA message might occur after you install a faulty or outdated device driver, system service, or firmware. If a Stop message lists a driver by name, and that driver has been recently replaced, use Device Manager to roll back the driver to correct the problem. If the device is not critical to the functionality of the system (for example, the CD-ROM driver), you can also uninstall or disable the driver.
Hardware issues
A Stop 0xA message might also be caused by failing or defective hardware. If a Stop message points to a category of devices (video or disk controller adapters, for example), try removing or replacing the hardware to determine if it is causing the problem.
Software compatibility issues
If you encounter a Stop 0xA message while upgrading to WindowsServer2003, the problem might be caused by an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running Setup. After you have successfully installed WindowsServer2003, contact the hardware manufacturer to obtain compatible updates.
Stop 0x1E or KMODE_EXCEPTION_NOT_HANDLED
The Stop 0x1E message indicates that the WindowsServer2003 kernel detected an illegal or unknown processor instruction. The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors, in that they can be caused by invalid memory and access violations. The default WindowsServer2003 error handler typically intercepts these problems if error-handling routines are not present in the code itself.
Interpreting the Stop 0x1E Message
This Stop message has four parameters, as listed in Table10.3.
Table10.3Parameters for the Stop 0x1E Message
ParameterDescriptionParameter 1Exception code that was not handledParameter 2Address at which the exception occurredParameter 3Parameter 0 of the exceptionParameter 4Parameter 1 of the exception
The first parameter identifies the exception generated. Common exception codes are listed in Table10.4.
Table10.4Common Exception Codes for Parameter 1
Exception CodeDescription0x80000002:
STATUS_DATATYPE_MISALIGNMENTAn unaligned data reference was encountered. The trap frame supplies additional information. Generally, Stop errors with this exception code are resolved by replacing the driver named in the Stop message.0x80000003:
STATUS_BREAKPOINTA breakpoint or ASSERT was encountered when no kernel debugger was attached to the system. This generally occurs when a debug version of a driver is used. If you are not intentionally using a debug version of a driver, replace the driver with the free version.0xC0000005:
STATUS_ACCESS_VIOLATIONA memory access violation occurred. Parameter4 of the Stop message (which is parameter 1 of the exception) is the address that the driver attempted to access. When the Stop message indicates this exception code, the driver identified as the cause of the Stop error might be faulty. You should take additional steps to identify the faulty driver.
For a complete list of exception codes, see the Ntstatus.h file located in the Inc directory of the Windows Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
The second parameter identifies the address of the module in which the error occurred. Frequently, the address points to an individual driver or faulty hardware pointed to by the third parameter of the Stop message. Make a note of this address and the link date of the driver or image that contains it.
The last two Stop message parameters vary, depending on the exception that has occurred. You can typically find a description of the parameters that are included in the Ntstatus.h file. If the error number has no parameters, the last two parameters of the Stop message are listed as 0x00000000.
Troubleshooting the Stop 0x1E Error
First, use the Event Viewer to review the System log for error events that identify the problem. The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Driver, service, or hardware issues
Stop 0x1E messages typically occur after faulty drivers or system services have been installed, or they can indicate hardware problems such as memory and IRQ conflicts. If a Stop message lists a driver by name, and that driver has been recently updated, use Device Manager to roll back or update the driver to correct the problem. If the device is not critical to the functionality of the system (for example, the keyboard driver), you can also uninstall or disable the driver.
Incompatible remote control programs
If the Stop message mentions the file Win32k.sys, the source of the error might be an incompatible third-party remote control program. Win32k.sys is a kernel component that performs graphics functions involving the user interface. If such software is installed, you might be able to disable it by starting the system in Safe Mode. If not, use Recovery Console to manually disable the system service file that is causing the problem. If removing the remote control software solves the problem, contact the manufacturer to obtain a WindowsServer2003compatible update.
Kernel memory leaks
You can use Poolmon (Poolmon.exe) to isolate the WindowsServer2003 components that are causing kernel memory leaks. The problem might be a memory leak caused by an application or service that is not releasing memory correctly. Although memory leaks cannot directly cause Stop errors, they can cause problems with drivers that can result in a Stop error. Poolmon helps you to isolate the components that cause kernel memory leaks.
Firmware incompatibility
Problems can result from system firmware incompatibilities. Using outdated firmware might cause several problems, including issues with installing WindowsServer2003. Many Advanced Configuration and Power Interface (ACPI) issues can be resolved by updating to the latest firmware. Check the computer or motherboard manufacturers Web site for updated system firmware.
Stop 0x24 or NTFS_FILE_SYSTEM
The Stop 0x24 message indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to NTFS file system drives. A similar Stop message, 0x23, exists for the file allocation table (FAT32) file systems.
Interpreting the Stop 0x24 Message
This Stop message has four parameters, as listed in Table10.5.
Table10.5Parameters for the Stop 0x24 Message
ParameterDescriptionParameter 1Source file and line number.Parameter 2A nonzero value that contains the address of the exception record (optional).Parameter 3A nonzero value that contains the address of the context record (optional).Parameter 4This parameter is reserved (set aside for future use).
Parameters for this Stop message are useful only to Microsoft technical support personnel who have access to WindowsServer2003 source code. Stop errors caused by file system issues have the source file and the line number within the source file that generated the error encoded in their first parameter. The first four hexadecimal digits (also known as the high 16 bits) after the 0x identify the source file number, and the last four hexadecimal digits (the low 16 bits) identify the source line in the file where the error occurred.
Troubleshooting the Stop 0x24 Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Hard disk issues
File system corruption in the form of bad sectors on the hard disk can cause Stop 0x24 errors. Malfunctioning disk hardware or disk drivers can also adversely affect the systems ability to read and write to disk, causing errors. Check for cabling and termination problems between the controller and the disks. Remove and replace disk controller cards to ensure all connections are solid.
To test hard disk or volume integrity
Method1:
In the Run dialog box, type:
cmd
At the command prompt, type:
chkdsk drive: /f
Method2:
In Windows Explorer, select the hard disk you want to check.
On the File menu, click Properties, and then click the Tools tab.
In the Error-checking box, click Check Now.
Under Check disk options, select the Scan for and attempt recovery of bad sectors check box. You can also select the Automatically fix file system errors check box.
If the volume you are checking is in use, a message asks whether you want to delay disk error checking until the next time you restart your computer. When you restart, disk error checking runs and the volume chosen is not available to run other tasks during this process. If you cannot restart the computer in normal mode because of the error, use Safe Mode or Recovery Console.
Caution
Do not use tools meant for other operating systems on WindowsServer2003 partitions, or you might lose file information.
System and application problems
Periodically check Event Viewer for error messages related to small computer system interface (SCSI) or FASTFAT in the System log or Autochk in the Application log. Verify that services or other software that runs in the background such as virus scanners, backup programs, or disk defragmenters are compatible with WindowsServer2003. Some disks and adapters come packaged with diagnostic software that you can use to run hardware tests. For more information about diagnostic tools usage and compatibility, see the owners manual for your computer, hard disk, or controller.
Stop 0x2E or DATA_BUS_ERROR
The Stop 0x2E message indicates a system memory parity error. The cause is typically failed or defective RAM (including memory on the motherboard, Level 2 cache, or video adapter), incompatible or mismatched memory hardware, or a device driver attempting to access an address in the 0x8xxxxxxx range that does not exist (that is, it does not map to a physical address). A Stop 0x2E message can also indicate hard disk damage caused by a virus or other problems.
Interpreting the Stop 0x2E Message
This Stop message has four parameters, as listed in Table10.6.
Table10.6Parameters for the Stop 0x2E Message
ParameterDescriptionParameter 1Virtual address that caused the faultParameter 2Physical address that caused the faultParameter 3Processor status registerParameter 4Faulting instruction register
Troubleshooting the Stop 0x2E Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Memory hardware issues
Stop 0x2E is typically caused by defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) cache memory, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
Driver and service issues
Stop 0x2E messages can also occur after you install faulty drivers or system services. If a file name is given, you can disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If it does, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD/DVD mastering tools.
Hard disk issues
Hard disk corruption can also cause this Stop error. For more information about checking hard disk integrity, see the suggestions provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this chapter.
Motherboard issues
The problem might also be caused by cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Stop 0x31 or PHASE0_INITIALIZATION_FAILED
The Stop 0x31 message indicates that system startup failed during Phase 0 of the Executive initialization. During Phase 0, interrupts are disabled and the HAL is initialized. Several Executive components are started: the memory manager, object manager, security reference monitor, process manager, and the Plug and Play manager. This error indicates a failure of one of those components.
Note
This Stop message includes no parameters.
Troubleshooting the Stop 0x31 Error
A Stop error during Phase0 initialization might indicate a problem with outdated firmware, corrupted kernel or HAL files, or faulty hardware. The most likely cause is a newly installed or upgraded hardware component. Systems configured to automatically restart after a Stop error tend to experience this error repeatedly until an administrator intervenes. To troubleshoot the Stop error, run the hardware diagnostics program included with your devices or replace them with new parts. If system files have recently been replaced, restoring those system files might prevent the failure. Also, verify that your motherboard firmware and peripheral firmware versions are current.
If you cannot isolate any specific hardware problems, try running WindowsServer2003 Setup again. If the same error message appears, record the information in the Stop message and contact a Microsoft support technician.
Stop 0x32 or PHASE1_INITIALIZATION_FAILED
The Stop 0x32 message indicates that system startup failed during Phase 1 of the Executive initialization. During Phase 1, interrupts are enabled, device drivers are initialized, and those Executive components that were not initialized during Phase 0 are initialized. Executive components initialized in Phase 1 include the power manager and the I/O manager. The progress bar on the startup screen advances during this phase to provide a visual representation of this part of the boot process. This error indicates a failure of one of those components.
Interpreting the Stop 0x32 Message
This Stop message has four parameters, as listed in Table10.7.
Table10.7Parameters for the Stop 0x32 Message
ParameterDescriptionParameter 1The NT status code that describes why the system initialization failed.Parameter 2This parameter is reserved (set aside for future use).Parameter 3This parameter is reserved (set aside for future use).Parameter 4This parameter is reserved (set aside for future use).Troubleshooting the 0x32 Stop Error
A Stop error during Phase1 initialization might indicate a problem with outdated firmware, corrupted system files, corrupted or outdated device drivers, an incompatible HAL type, or a hardware failure. Verify that your motherboard and peripheral firmware versions are current. As a last resort, you might be able to resolve the problem by reinstalling WindowsServer2003, which will replace faulty system files and drivers. If you get the same message, record the information in the Stop message and contact a Microsoft support technician.
Stop 0x3F or NO_MORE_SYSTEM_PTES
The Stop 0x3F message indicates one or more of the following problems:
The system Page Table Entries (PTEs) are fragmented because the system performed a large number of input/output (I/O) actions and a driver has requested a block of memory that is too large to fit in any of the available contiguous blocks of memory. PTEs map virtual memory to physical locations.
A faulty device driver is not managing memory properly.
An application, such as a backup program, is improperly allocating large amounts of kernel memory.
Note
This Stop error should never occur on 64-bit systems, because the 64-bit architecture essentially removes PTE limitations experienced on 32-bit systems.
Interpreting the 0x3F Stop Message
This Stop message has four parameters, as listed in Table10.8. The value of the first parameter depends on the configuration of your system.
Table10.8Parameters for the Stop 0x3F Message
ParameterDescriptionParameter 1PTE type:
0x00000000 = system expansion
0x00000001 = nonpaged pool expansionParameter 2Requested sizeParameter 3Total free system PTEsParameter 4Total system PTEs
Troubleshooting the Stop 0x3F Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Driver and service issues
Stop 0x3F messages can occur after installing faulty drivers or system services. If a file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If it does, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD/DVD mastering tools.
Insufficient memory
The system might not actually be out of PTEs, but a contiguous memory block of sufficient size might not be available to satisfy a driver or application request. Check for the availability of updated driver or application files, and consult the hardware or program documentation for minimum system requirements.
Excessive demands for system PTEs
Another cause is excessive demands for system PTE by applications. Microsoft Windows2000 Server and WindowsServer2003 include a registry entry that you can modify to increase the number of PTEs allocated. PTE limitations should cause problems only on 32-bit systems.
Caution
Do not edit the registry unless you have no alternative. The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first and see HYPERLINK "http://go.microsoft.com/fwlink/?linkid=4543" \t "_blank" Registry Reference on the Microsoft WindowsServer2003 Deployment Kit companion CD or at HYPERLINK "http://www.microsoft.com/reskit"http://www.microsoft.com/reskit.
To increase the number of PTEs allocated on 32-bit systems
In the Run dialog box, type:
regedit
In the registry editor, navigate to the SystemPages entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.
View the values for the PagedPoolSize and SystemPages entries.
If the value of the PagedPoolSize entry is not zero, double-click PagedPoolSize and change the value in the Value data box to 0.
If the value of the SystemPages entry is not zero, double-click SystemPages and increase the value in the Value data box to a higher number than what appears.
Setting this value to 0xFFFFFFF causes WindowsServer2003 to automatically configure the maximum number of PTEs possible, which reduces the space available for the file system cache. The default value is 0.
Click OK, and then close the registry editor.
Restart your computer.
If this procedure does not solve the problem on the first try, repeat the procedure and increase the value for the SystemPages entry.
Other suggestions
Use the Driver Verifier to identify the faulty driver. For more information about identifying the driver causing the problem, search for Bug Check 0x3F in Debugging Tools for Windows Help. To download Debugging Tools for Windows, go to the Debugging Tools link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources. A related Stop message, 0x000000D8: DRIVER_USED_EXCESSIVE_PTES, is described later in this chapter.
Stop 0x50 or PAGE_FAULT_IN_NONPAGED_AREA
The Stop 0x50 message indicates that requested data was not in memory. The system generates an exception error when using a reference to an invalid system memory address. Defective memory (including main memory, L2 cache memory, and video RAM) or incompatible software (including remote control and antivirus software) might cause Stop 0x50 messages.
Interpreting the Stop 0x50 Message
This Stop message has four parameters, as listed in Table10.9.
Table10.9Parameters for the Stop 0x50 Message
ParameterDescriptionParameter 1Memory address referenced.Parameter 2Type of access:
0x00000000 = read operation
0x00000001 = write operationParameter 3If not zero, the instruction address that referenced the address in Parameter 1.Parameter 4This parameter is reserved (set aside for future use).
Troubleshooting the Stop 0x50 Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
New hardware issues
If you added new hardware recently, remove and replace the hardware to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the hardware manufacturer to determine if the component has failed.
Driver and system service issues
Stop 0x50 messages can also occur after you install faulty drivers or system services. If the file listed is a driver, use Driver Verifier to validate that the reported driver is causing the problem. Once you have identified the problematic driver, use Device Manager to roll back or update the driver to correct the problem. If the device is not critical to the functionality of the system (for example, the keyboard driver), you can also uninstall or disable the driver.
If you have recently added a service or application, disable the recently installed service or application to determine if this resolves the error. If this does not resolve the problem, contact the hardware manufacturer for updates. Using updated drivers and software is especially important for network adapters, video adapters, backup programs, multimedia applications, antivirus scanners, and CD/DVD mastering tools. If an updated driver is not available, attempt to use a driver from a similar device in the same family. For example, if printing to a Model 1100C printer causes Stop 0x50 errors, using a printer driver meant for a Model 1100A or Model 1100B might temporarily resolve the problem.
Stop 0x6B or PROCESS1_INITIALIZATION_FAILED
The Stop 0x6B message indicates that system startup failed during Phase 1 of the Executive initialization. During Phase 1, interrupts are enabled, device drivers are initialized, components initialized in Phase 0 continue the initialization process, and those Executive components that were not initialized during Phase 0 are initialized. Executive components initialized in Phase 1 include the power manager and the I/O manager. The progress bar on the startup screen advances during this phase to provide a visual representation of this part of the boot process. This error indicates a failure of one of those components.
Interpreting the Stop 0x6B Message
This Stop message has four parameters, as listed in Table10.10.
Table10.10Parameters for the Stop 0x6B Message
ParameterDescriptionParameter 1The NT status code that describes why the system initialization failed.Parameter 2Indicates the internal debug code where the failure was detected.Parameter 3This parameter is reserved (set aside for future use).Parameter 4This parameter is reserved (set aside for future use).Troubleshooting the Stop 0x6B Error
This error can be caused by any part of the disk subsystem, including bad disks, bad or incorrect cables, mixing different ATA-type devices on the same chain, or drives that are not available because of hardware regeneration. It can also be caused by a missing file from the boot partition, or by a driver file that has been disabled on the Drivers tab by mistake.
Verify the hard disk configuration and repair any problems with the storage subsystem. If you get the same message, record the information in the Stop message and contact a Microsoft support technician.
Stop 0x77 or KERNEL_STACK_INPAGE_ERROR
The Stop 0x77 message indicates that a page of kernel data requested from the paging (virtual memory) file could not be found or read into memory. This Stop message can also indicate disk hardware failure or possible virus infection.
Interpreting the Stop 0x77 Message
The parameters for this Stop message have one of two different meanings. The value of the first parameter determines the meaning of parameters 2, 3, and 4. If parameter1 is anything other than 0x0, 0x1, or 0x2, the parameters should be interpreted as shown in Table10.11.
Table10.11Parameters for the Stop 0x77 Message
ParameterDescriptionParameter 1Status code.Parameter 2I/O status codeParameter 3Paging file numberParameter 4Offset into paging file
Frequently, the cause of this error can be determined from the I/O status code (parameter2). Some common status codes for parameter2 are listed in Table10.12.
Table10.12Common Status Codes for Parameter 2
Exception CodeDescription0xC000009A:
STATUS_INSUFFICIENT_RESOURCESIndicates a lack of nonpaged pool resources.0xC000009C:
STATUS_DEVICE_DATA_ERRORGenerally indicates bad blocks (sectors) on the hard disk.0xC000009D:
STATUS_DEVICE_NOT_CONNECTEDIndicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or hard disk configuration.0xC000016A:
STATUS_DISK_OPERATION_FAILEDIndicates bad blocks (sectors) on the hard disk.0xC0000185:
STATUS_IO_DEVICE_ERRORIndicates improper termination, defective storage controller hardware, defective disk cabling, or two devices attempting to use the same system resources.
The following set of parameter definitions listed in Table10.13 applies only if parameter1 is 0, 1, or 2:
Table10.13Additional Parameters for the Stop 0x77 Message
ParameterDescriptionParameter 1A value of 0x00000000 = page was retrieved from page cache, 0x00000001 = page was retrieved from disk, 0x00000002 = page was retrieved from disk with a successful status, but the page size was different than expected.Parameter 2Value found in the stack where the signature should be.Parameter 3This value is 0x00000000 (zero).Parameter 4Address of signature on kernel stack.
These are the most common codes for which specific causes have been determined. For information about other possible status codes that can be returned, see the Ntstatus.h file of the WindowsServer2003 Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kit link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Troubleshooting the Stop 0x77 Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Hard disk hardware or driver issues
Stop 0x77 messages can be caused by bad sectors in the virtual memory paging file or a disk controller error. If parameter1 is 0, 1, or 2, the stack signature in the kernel stack is missing, which is an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues and verify that no IRQ conflicts exist. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be read to the disk, which is typically caused by bad blocks (sectors) on the hard disk. You can try to correct this by restarting the computer.
If a problem with disk integrity exists, Autochk.exe a program that attempts to mark bad disk sectors as defective so that they are not used in the future starts automatically. If Autochk.exe fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk.exe provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this chapter. Not all disk problems can be repaired with software, however, and hardware might need to be replaced if it has failed.
Memory hardware issues
Another cause of Stop 0x77 messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system or hardware manufacturer to determine if the component has failed.
Motherboard issues
The problem might also be caused by cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Stop 0x79 or MISMATCHED_HAL
The Stop 0x79 message indicates that the HAL and the kernel type for the computer do not match. This error generally results from one of the following circumstances:
Either Ntoskrnl.exe or Hal.dll has been manually updated.
ACPI firmware settings were changed after WindowsServer2003 was installed. For example, an administrator might have installed WindowsServer2003 on an x86-based computer with the firmware ACPI enable option enabled, and later decided to disable it.
Mismatched single-processor and multiprocessor configuration files are copied to the system.
The operating system loader is an older version than the operating system kernel; for example, the Windows2000 Server loader is used to load the WindowsServer2003 kernel because Windows2000 Server was installed after WindowsServer2003.
Interpreting the Stop 0x79 Message
The content of the information provided by a 0x79 Stop message varies according to the value of parameter1. Table10.14 lists the different values for parameter1.
Table10.14Parameters for the Stop 0x79 Message
Parameter 1Parameter 2Parameter 3Parameter 4Description0x00000001Release level of Ntoskrnl.exeRelease level of Hal.dllThis value is 0x00000000 (zero).PRCB release level mismatch0x00000002Build type of Ntoskrnl.exeBuild type of Hal.dllThis value is 0x00000000 (zero).Build type mismatch0x00000003Size of the loader parameter extensionMajorVersion of the loader parameter extensionMinorVersion of the loader parameter extensionThe Ntldr and HAL versions mismatch
When the value of parameter1 is set to 0x00000002, the build type codes shown in Table10.15 become effective for parameter2 and parameter3.
Table10.15Common Build Type Codes for Parameter 2
Build Type CodeDescription0x00000000Multiprocessor-enabled free build0x00000001Multiprocessor-enabled checked build0x00000002Single-processor free build
Troubleshooting the 0x79 Stop Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Incorrect versions of Ntoskrnl.exe or Hal.dll files
A Stop 0x79 message occurs when the operating system is using out-of-date Ntoskrnl.exe or Hal.dll files. This can occur after manual repairs that involve copying incorrect files to the operating system. This error also occurs when copying mismatched files, such as a multiprocessor HAL to an operating system that uses a single-processor kernel (or vice versa). The kernel and HAL files for single-processor and multiprocessor systems are stored on the WindowsServer2003 operating system CD by using two different file names: Ntoskrnl.exe and Ntkrnlmp.exe, respectively. Setup copies either Ntoskrnl.exe or Ntkrnlmp.exe to your system as Ntoskrnl.exe.
In Recovery Console, it is possible to use the Copy command to copy the correct Ntldr, HAL, or kernel files from the operating system CD to the appropriate folder on the hard disk. For more information about Recovery Console, see Recovery Console overview in Help and Support Center for WindowsServer2003.
Incorrect firmware settings
If you experience Stop 0x79 messages after changing firmware settings, restore the original settings used during WindowsServer2003 Setup.
Stop 0x7A or KERNEL_DATA_INPAGE_ERROR
The Stop 0x7A message indicates that a page of kernel data was not found in the paging (virtual memory) file and could not be read into memory. The causes of this might be incompatible disk or controller drivers, outdated firmware, or a hardware problem.
Interpreting the Stop 0x7A Message
The parameters for this Stop message have two sets of meanings. The value of parameter1 determines the meaning of parameters2, 3, and 4.
If parameter1 is 0x1, 0x2, or 0x3, the parameters should be interpreted as shown in Table10.16.
This Stop message has four parameters, as listed in Table10.16.
Table10.16Parameters for the Stop 0x7A Message
ParameterDescriptionParameter 1Lock type value
0x00000001
0x00000002
0x00000003 or PTE addressParameter 2Error status (typically an I/O status code).Parameter 3If the lock type is 0x00000001 or 0x00000002, this parameter represents the current process.
If the lock type is 0x00000003, this parameter represents the virtual address.Parameter 4The virtual address that could not be paged into memory.
If parameter1 does not have a value of 0x1, 0x2, or 0x3, the parameters listed in Table10.17 apply.
Table10.17Secondary Parameters for the Stop 0x7A Message
ParameterDescriptionParameter 1PTE addressParameter 2Error status (typically an I/O status code)Parameter 3Virtual addressParameter 4The virtual address that could not be paged into memory
Frequently, the cause of this error can be determined from the I/O status code (parameter 2). Some common status codes are listed in Table10.18.
Table10.18Common Status Codes for Parameter 2
Status CodeDescription0xC000000E: STATUS_NO_SUCH_DEVICEIndicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or disk configuration.0xC000009A:
STATUS_INSUFFICIENT_RESOURCESIndicates a lack of nonpaged pool resources.0xC000009C:
STATUS_DEVICE_DATA_ERRORIndicates bad blocks (sectors) on the hard disk.0xC000009D:
STATUS_DEVICE_NOT_CONNECTEDIndicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or disk configuration.0xC000016A:
STATUS_DISK_OPERATION_FAILEDIndicates bad blocks (sectors) on the hard disk.0xC0000185:
STATUS_IO_DEVICE_ERRORIndicates improper termination, defective storage controller hardware, defective disk cabling, or an IRQ conflict.
For information about other possible status codes that might be returned, see the file Ntstatus.h of the WindowsServer2003 Driver Development Kits (DDK). For more information about the DDK, see the Driver Development Kit link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Troubleshooting the Stop 0x7A Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Hard disk hardware or driver issues
Stop 0x7A can be caused by bad sectors in the virtual memory paging file, disk controller error, virus infection, or memory hardware problems. If parameters 1 and 3 are 0, the stack signature in the kernel stack is missing, an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found. You can try to correct this by restarting the computer.
If a problem with disk integrity exists, Autochk, a program that attempts to mark bad disk sectors as defective so that they are not used in the future, starts automatically. If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this chapter.
Memory hardware issues
Another cause of Stop 0x7A messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
Firmware and driver issues
Check the hardware manufacturers Web site for updates to disk adapter firmware or drivers that improve compatibility. Verify that your firmware, disks, and controller support the same set of advanced features, such as higher transfer rates. If necessary, select a slower transfer rate if an update is not yet available. Consult your hardware or device documentation for more information.
Important
You can install disk controller drivers that are not present on the WindowsServer2003 operating system CD by responding to the following message shortly after starting setup: Press F6 if you need to install a third party SCSI or RAID driver. When you see this message, press F6, and when prompted, provide the appropriate storage controller driver (ATA or SCSI) supplied by the manufacturer.
Motherboard issues
The problem might also be caused by cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Stop 0x7B or INACCESSIBLE_BOOT_DEVICE
The Stop 0x7B message indicates that WindowsServer2003 has lost access to the system partition or boot volume during the startup process. There are several circumstances that can cause this:
A hard disk or disk controller has failed.
A Boot.ini file is configured incorrectly. This often occurs when disks or controllers are added and change the ARC mapping of existing disks.
Incorrect disk controller device drivers are installed. This might happen because incorrect drivers were loaded during Setup, or you are using a system image created by using different hardware.
The disk subsystem device driver is faulty.
The system has a virus infection.
Interpreting the Stop 0x7B Message
This Stop message has four parameters, as listed in Table10.19.
Table10.19Parameters for the Stop 0x7B Message
ParameterDescriptionParameter 1The address of the device object that could not be mounted, or the Unicode string of ARC name.Parameter 2This value is 0x00000000 (zero).Parameter 3This value is 0x00000000 (zero).Parameter 4This value is 0x00000000 (zero).
The value of parameter1 determines whether the parameter is a pointer to an ARC name string (ARC names are a generic method of identifying devices within the ARC environment) or a device object, because a Unicode string never has an odd number of bytes, and a device object always has a Type code of 0003.
Troubleshooting the Stop 0x7B Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Hardware issues
During I/O system initialization, the controller or driver for the startup device (typically the hard disk) might have failed to initialize the necessary hardware. File system initialization might have failed because of disk or controller failure, or because the file system did not recognize the data on the boot device.
Adding new disk hardware
Repartitioning disks, adding new disks, or upgrading to a new disk controller might cause the startup information in the Boot.ini file or Boot Manager to be become outdated. If a Stop 0x7B error occurs after you install new disks in your system, edit the Boot.ini file or adjust the Boot Manager parameters to allow the system to start. If the error occurs after you upgrade the disk controller, verify that the new hardware is functioning and correctly configured.
Firmware, disk controller, and driver issues
Verify that the system firmware and disk controller BIOS settings are correct and that the storage device was properly installed. If you are unsure, consult your computers documentation about restoring default firmware settings or configuring your system to use automatically detected settings. If the error occurs during WindowsServer2003 Setup, the problem might be caused by unsupported disk controller hardware. If you are applying a system image created on another computer, this Stop error might be occurring because the destination computer has a different disk controller installed. In some cases, drivers for the newest hardware are not in the WindowsServer2003 Driver.cab driver library file, and you need to provide additional drivers to complete WindowsServer2003 Setup successfully. If this is the case, follow the manufacturers instructions when installing drivers. Periodically check for driver and firmware updates.
Hard disk issues
Hard disk corruption can also cause this Stop error. For more information about checking hard disk integrity, see the instructions provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this chapter.
Other suggestions
In addition to the potential causes listed above, viruses can cause the 0x7B Stop error. Problems that cause 0x7B errors might also cause Stop 0x6B or Stop 0xED errors. For more information about 0xED Stop errors, see Stop 0x000000ED or UNMOUNTABLE_BOOT_VOLUME later in this chapter.
Stop 0x7F or UNEXPECTED_KERNEL_MODE_TRAP
The Stop 0x7F message indicates that one of two types of problems occurred in kernel-mode:
A condition that the kernel is not allowed to have or intercept (also known as a bound trap).
A fault occurred while processing an earlier fault (also known as a double fault).
Interpreting the Stop 0x7F Message
This Stop message has four parameters, as listed in Table10.20.
Table10.20Parameters for the Stop 0x7F Message
ParameterDescriptionParameter 1Processor exception code.Parameter 2This value is 0x00000000 (zero).Parameter 3This value is 0x00000000 (zero).Parameter 4This value is 0x00000000 (zero).
Parameter1 is the most important parameter and can have several different values, indicating different causes of this error. You can find all conditions that cause a Stop 0x7F in any x86 microprocessor reference manual because they are specific to the x86 platform. Table10.21 lists some of the most common exception codes.
Table10.21Common Exception Codes for the Stop 0x7F Message
Exception CodeDescription0x00000000:
Divide by Zero ErrorOccurs when a divide (DIV) instruction is run in a kernel process and the divisor is 0. Memory corruption, other hardware failures, or software problems can cause this error message.0x00000004:
OverflowOccurs when the processor carries out a call to an interrupt handler when the overflow (OF) flag is set.0x00000005:
Bounds Check FaultIndicates that the processor, while carrying out a BOUND instruction, found that the operand exceeded the specified limits. BOUND instructions ensure that a signed array index is within a certain range.0x00000006:
Invalid OpcodeGenerated when the processor attempts to run an invalid instruction. This typically occurs when a hardware memory problem corrupts the instruction pointer, which then points to a wrong location.0x00000008:
Double FaultIndicates an exception while trying to call the handler for a prior exception. Usually, a processor can handle two exceptions serially, but certain exceptions (almost always caused by hardware problems) cause the processor to signal a double fault.
Less common codes are listed in Table10.22.
Table10.22Less Common Exception Codes for the Stop 0x7F Message
Exception CodeDescription0x00000001A system-debugger call0x00000003A debugger breakpoint0x0000000AA corrupted Task State Segment0x0000000BAn access to a memory segment that was not present0x0000000CAn access to memory beyond the limits of a stack0x0000000DAn exception not covered by some other exception; a protection fault that pertains to access violations for applications
Troubleshooting the Stop 0x7F Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Memory hardware issues
Stop 0x7F messages are typically caused by defective, malfunctioning, or failed memory hardware. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
Processor hardware issues
This Stop error can occur when the processor or the processor cache are failing; if this is the case, replacing the processor will resolve the problem. Running the processor (or other components) beyond the rated specification, known as overclocking, can cause Stop 0x7F or other error messages due to heat buildup. When diagnosing problems on overclocked systems, first restore all clock and bus speed settings to the manufacturer-recommended values to determine if this resolves the issues.
Motherboard issues
The problem might also be caused by cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Software incompatibility issues
Stop 0x7F messages can occur after you install incompatible applications, drivers, or system services. Contact the software manufacturer about possible WindowsServer2003specific updates. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD/DVD mastering tools.
Stop 0x9F or DRIVER_POWER_STATE_FAILURE
The Stop 0x9F message indicates that a driver is in an inconsistent or invalid power state.
Interpreting the Stop 0x9F Message
Table10.23 describes the information provided by Stop 0x9F messages. The value of parameter1 indicates the type of violation and determines the meaning of the next three parameters. In WindowsServer2003 and Microsoft WindowsXP, these errors have been superseded by Driver Verifier tests. For more information about Driver Verifier tests, see the Driver Verifier section of the WindowsServer2003 Driver Development Kits (DDK). To obtain the DDK, see the Driver Development Kit link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Table10.23Parameters for the Stop 0x9F Message
Parameter 1 ValueType of ViolationParameter 2 DescriptionParameter 3 DescriptionParameter 4 Description0x00000001The device object being freed still has an incomplete power request pending.Pointer to the target device object (optional)Pointer to the device objectPointer to the driver object0x00000002The device object completed the I/O request packet (IRP) for the system power state request, but failed to call PoStartNextPowerIrp. Pointer to the target device object (optional)Pointer to the device objectPointer to the driver object0x00000003The device driver did not properly set the IRP as "pending" or complete the IRP.Pointer to the target device objectPointer to the device objectThe IRP0x00000100The device objects in the devnode were inconsistent in their use of DO_POWER_PAGABLE.Pointer to the nonpaged device objectPointer to the target device objectPointer to the device object to notify0x00000101A parent device object has detected that a child device has not set the DO_POWER_PAGABLE bit.Child device object Child device objectParent device object
This Stop message typically occurs during events that involve power state transitions, such as the following:
Shutting down
Suspending or resuming from standby mode
Suspending or resuming from hibernate mode
Troubleshooting the 0x9F Stop Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Application, driver, or system services issues
Stop 0x9F messages can occur after you install faulty applications, drivers, or system services. If a file is listed by name and you can associate it with an application, uninstall the application. For drivers, disable, remove, or roll back the driver to determine if this resolves the error. If it does, contact the hardware manufacturer for a possible update. Using up-to-date software is especially important for backup programs, multimedia applications, antivirus scanners, and CD/DVD mastering tools.
Standby and hibernate mode
For information about troubleshooting standby and hibernate mode issues, see article Q266169, How to Troubleshoot Problems with Standby Mode, Hibernate Mode, and Shutting Down Your Computer in Windows2000 in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Stop 0xBE or ATTEMPTED_WRITE_TO_READONLY_MEMORY
The Stop 0xBE message indicates that a driver attempted to write to read-only memory. If the driver responsible for the error can be identified, its name is printed in the Stop message.
Interpreting the Stop 0xBE Message
This Stop message has four parameters, as listed in Table10.24.
Table10.24Parameters for the Stop 0xBE Message
ParameterDescriptionParameter 1Virtual address of attempted write.Parameter 2PTE contents.Parameter 3This parameter is reserved (set aside for future use).Parameter 4This parameter is reserved (set aside for future use).Troubleshooting the Stop 0xBE Error
The following section describes the most common sources for this Stop error and suggests a troubleshooting solution.
Driver and system services issues
A Stop 0xBE message might occur after you install a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD/DVD mastering tools.
Stop 0xC2 or BAD_POOL_CALLER
The Stop 0xC2 message indicates that a kernel-mode process or driver incorrectly attempted to perform memory operations in the following ways:
By allocating a memory pool size of zero bytes
By allocating a memory pool that does not exist
By attempting to free a memory pool that is already free
By allocating or freeing a memory pool at an IRQL that was too high
This Stop message is typically due to a faulty driver or software.
Interpreting the Stop 0xC2 Message
Table10.25 describes the information provided by Stop 0xC2 messages. The value of parameter1 indicates the type of violation and determines the meaning of the next three parameters.
Table10.25Parameter Listing for Stop Message 0xC2
Parameter 1 ValueType of ViolationParameter 2 DescriptionParameter 3 DescriptionParameter 4 Description0x00000000The caller is requesting a zero byte pool allocation.This value is always 0The pool type being allocatedThe pool tag being used0x00000001, 0x00000002, or 0x00000004Pool header has been corrupted.Pointer to pool headerFirst part of pool header contentsThis value is always zero0x00000006 Attempt to free a memory pool that was already freed.ReservedPointer to pool headerPool header contents0x00000007Attempt to free a memory pool that was already freed.ReservedMemory contents of the pool blockPointer to pool header0x00000008Attempt to allocate pool at invalid IRQL.Current IRQLPool typeSize of allocation0x00000009Attempt to free pool at invalid IRQL.Current IRQLPool typeAddress of pool0x0000000AThe current thread attempted to free pool memory by using the wrong tag.Address of poolAllocators tagTag being used0x0000000B, 0x0000000C, or 0x0000000DThe current thread attempted to release a quota on a corrupted pool allocation.Address of poolPool allocations tagBad quota process pointer 0x00000040Attempt to free kernel pool at user mode address.Starting addressStart of system address spaceThis value is always zero0x00000041Attempt to free a non-allocated nonpaged pool address.Starting addressPhysical page frameHighest physical page frame0x00000042 or 0x00000043Attempt to free a virtual address that was never in any pool.Address being freedThis value is always zeroThis value is always zero0x00000050Attempt to free a non-allocated paged pool address.Starting addressStart offset in pages from beginning of paged poolSize in bytes of paged pool0x00000060The current thread attempted to free an invalid contiguous memory address.Starting addressThis value is always zeroThis value is always zero0x00000099Attempt to free pool with invalid address or corruption in pool header.Address being freedThis value is always zeroThis value is always zero0x0000009AAttempt to allocate was marked MUST_SUCCEED.Pool typeSize of allocation in bytesAllocation's pool tag0x0000009BThe current thread attempted to allocate a pool with a tag of zero.Pool typeSize of allocation in bytesCallers address0x0000009CThe current thread attempted to allocate a pool with a tag of "BIG."Pool typeSize of allocation in bytesCallers address
Troubleshooting the Stop 0xC2 Error
The following sections list the most common sources for this Stop error and suggest some troubleshooting solutions.
Driver, system services, and firmware issues
A Stop 0xC2 message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD/DVD mastering tools.
Hardware issues
A Stop 0xC2 message might also be due to failing or defective hardware. If a Stop message points to a category of devices (such as disk controllers, for example), try removing or replacing the hardware to determine if it is causing the problem.
Software compatibility issues
If you encounter a Stop 0xC2 message while upgrading to WindowsServer2003, the problem might be caused by an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running Setup. After you have successfully installed WindowsServer2003, contact the hardware manufacturer to obtain compatible updates.
Stop 0xCE or DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
This Stop message indicates that a driver failed to cancel pending operations, deferred procedure calls, and worker threads before exiting.
Interpreting the Stop 0xCE Message
This Stop message has four parameters, as listed in Table10.26.
Table10.26Parameters for the Stop 0xCE Message
ParameterDescriptionParameter 1Memory address referenced.Parameter 2Type of access:
0x00000000 = read operation
0x00000001 = write operationParameter 3If non-zero, the address of the instruction that referenced the incorrect memory location.Parameter 4This parameter is reserved (set aside for future use).Troubleshooting the Stop 0xCE Error
The following section describes the most common source for this Stop error and suggests a troubleshooting solution.
Driver and system services issues
Stop 0xCE messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If it does, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD/DVD mastering tools.
Stop 0xD1 or DRIVER_IRQL_NOT_LESS_OR_EQUAL
The Stop 0xD1 message indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. Drivers that use improper addresses typically cause this error. The problems that cause Stop 0xD1 messages share similarities with those that generate Stop 0xA errors, in that they can be caused by invalid memory and access violations.
Interpreting the Stop 0xD1 Message
This Stop message has four parameters, as shown in Table10.27.
Table10.27Parameters for the Stop 0xD1 Message
ParameterDescriptionParameter 1Memory referencedParameter 2IRQL at time of referenceParameter 3Type of access:
0x00000000 = read operation
0x00000001 = write operationParameter 4Address that referenced memory
Troubleshooting the Stop 0xD1 Error
The following section describes the most common source for this Stop error and suggests a troubleshooting solution.
Driver and system services issues
Stop 0xD1 messages can occur after you install faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If it does, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD/DVD mastering tools.
Stop 0xD8 or DRIVER_USED_EXCESSIVE_PTES
The Stop 0xD8 message typically occurs if your computer runs out of PTEs because of a driver that requests large amounts of kernel memory.
Interpreting the Stop 0xD8 Message
Depending on the configuration of your system, the number of parameters returned might vary, as shown in Table10.28.
Table10.28Parameters for the Stop 0xD8 Message
ParameterDescriptionParameter 1If this parameter has a nonzero value, it contains the name of the driver that caused the Stop error.Parameter 2If the first parameter has a nonzero value, this parameter contains the number of PTEs used by the driver that is causing the error.Parameter 3This parameter represents the total free system PTEs.Parameter 4This parameter represents the total system PTEs.
Troubleshooting the Stop 0xD8 Error
For suggestions about resolving problems related to inadequate PTEs, see Stop 0x0000003F or NO_MORE_SYSTEM_PTES earlier in this chapter.
Stop 0xEA or THREAD_STUCK_IN_DEVICE_DRIVER
A device driver problem is causing the operating system to pause indefinitely. Typically, this problem is caused by a display driver waiting for the video hardware to enter an idle state. This might indicate a hardware problem with the video adapter or a faulty video driver.
Interpreting the Stop 0xEA Message
This Stop message has four parameters, as listed in Table10.29.
Table10.29Parameters for the Stop 0xEA Message
ParameterDescriptionParameter 1Pointer to the thread object that is caught in an infinite loop.Parameter 2Pointer to a DEFERRED_WATCHDOG object. This pointer is useful when you use a kernel debugger to find out more information about this problem.Parameter 3The name of the driver that caused the Stop error.Parameter 4When viewing the Stop message in the kernel debugger, this is the cumulative number of times the 0xEA bug check was intercepted. When viewing the Stop message on the computer screen, this parameter is always 0x00000001.
Troubleshooting the Stop 0xEA Error
The following section describes the most common source for this Stop error and suggests a troubleshooting solution.
Driver and system services issues
Stop 0xEA messages can occur after you install faulty drivers (especially video drivers) or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If it does, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD/DVD mastering tools.
Stop 0xED or UNMOUNTABLE_BOOT_VOLUME
The kernel mode I/O subsystem failed in its attempt to mount the boot volume. This error might also occur during an upgrade to WindowsServer2003 on operating systems that use higher-throughput ATA disks, or controllers with incorrect cabling. In some cases, your operating system might appear to work normally after you restart.
Interpreting the Stop 0xED Message
This Stop message has two parameters, as listed in Table10.30.
Table10.30Parameters for the Stop OxED Message
ParameterDescriptionParameter 1Device object of the boot volume.Parameter 2Status code from the file system describing why it failed to mount the volume.Parameter 3This parameter is reserved (set aside for future use).Parameter 4This parameter is reserved (set aside for future use).Troubleshooting the 0xED Stop Error
The following section describes the most common source for this Stop error and suggests a troubleshooting solution.
Disk controller and throughput issues
Verify that your computer firmware, disk controller, and cabling support the storage system. For example, using an 80-wire cable is optional for transfer rates up to and including 33.3megabytes per second, but is mandatory for higher transfer rates. The additional grounded pins are required to prevent data loss. Verify that the cables and hard disks are connected according to the hard disk manufacturers specifications.
Some firmware enables you to force higher transfer rates even when you are using the incorrect cable type. Your firmware might issue a warning but allow the startup process to proceed. To avoid problems, do not change the default firmware settings for ATA cable detection.
Other suggestions
Problems that cause Stop 0xED errors might also cause Stop 0x6B and Stop 0x7B errors. For more information about Stop 0x7B errors, see Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE earlier in this chapter.
Additional Resources
These resources contain additional information related to this chapter.
Related Information
The ACPI link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
The Driver Development Kits link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
The Debugging Tools link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
The Extensible Firmware Interface link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
The Windows Catalog link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
The Microsoft Product Support Services link on the HYPERLINK "http://go.microsoft.com/fwlink/?linkid=291" \t "_blank" Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Related Help Topics
PAE in Help and Support in WindowsServer2003, Enterprise Edition for detailed information about Physical Address Extensions.
System and program error reporting overview in Help and Support Center for WindowsServer2003 for detailed information about error reporting.
Disk Cleanup in Help and Support Center for WindowsServer2003 for instructions on freeing disk space.
Recovery Console Overview in Help and Support Center for WindowsServer2003 for information about Recovery Console.
Related Tools
Event Viewer. This tool is used to review Stop error codes and parameters, and will reveal Stop errors that reoccur over a period of time.
Online Crash Analysis. This tool is a Microsoft-hosted service that analyzes memory dump information created when a Stop error occurs. Online Crash Analysis is capable of providing additional information about troubleshooting a stop error, can suggest updates that may resolve the problem, and provides informati
D
E
G
g
h
j
6 8 " $ B D = P % ! ! ! Ϻϭ h# hv 5
hv 0J 5hf0 hv hIB hv 5B*ph3f (j hIB hv OJ PJ QJ U^J o( hIB hv hv mH nH uh0 h0 h0 hv h0 hv
hv 0J hv 7 N P
H
k
& P " * = gdv gdv
&