Bluescreen stop c000021a fatal system error 0xc0000005

[olof_christenss]

Hi,

We have converted a physical Fujitsu Siemens Server with Windows 2003 Server SP2/R2 to a Vmware ESX 3.02 virtual machine with vmware converter and gotten several bluescreens when the administrators logs out from the server. Any ideas on how to solve this is appreciated!

Kind Regards

Olof

[olof_christenss]

I now found a user.dmp that i have analysed but it doesnt say much to me,

could you get something out of this?

Microsoft (R) Windows Debugger Version 6.7.0005.1

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and

Settings\Administrator.IXXHOSTING\Desktop\user.dmp]

User Mini Dump File: Only registers, stack and portions of memory are

available

Comment: 'Dr. Watson generated MiniDump'

Symbol search path is:

SRVc:\symbolshttp://msdl.microsoft.com/download/symbols

Executable search path is:

Windows Server 2003 Version 3790 (Service Pack 2) MP (2 procs) Free x86

compatible

Product: Server, suite: TerminalServer

Debug session time: Wed Sep 12 13:02:19.000 2007 (GMT+2)

System Uptime: not available

Process Uptime: 0 days 0:02:18.000

......................................................................................................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(19c.b18): Access violation - code c0000005 (first/second chance not

available)

eax=00000018 ebx=008a3a18 ecx=00000006 edx=00381658 esi=008a3a18

edi=01bcfebc

eip=77388a1f esp=01bcfe7c ebp=01bcff18 iopl=0 nv up ei pl nz na po

nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000

efl=00000202

user32!InternalCreateDialog+0x6d6:

77388a1f f3a5 rep movs dword ptr es:\[edi],dword ptr \[esi]

es:0023:01bcfebc=7c834a4b ds:0023:008a3a18=????????

[oreeh]

FYI: this thread has been moved to the VMware Converter forum.

Oliver

[url=http://www.vmware.com/community/ann.jspa?annID=84

]VMTN User Moderator[/url]

[admin]

It could be a hardware-specific device or driver. Did you have any hardware monitoring agents on the original server? If so, uninstall/remove them in the VM.

[olof_christenss]

Hi pangchen and thanks for your answer, yes we had some hardware monitoring agents on that server but has uninstalled them already.

In fact the first bluescreen appeared after the reboot just after we installed a mylex software. Maybe there are still som hidden/ghosted devices that could be the issue here. i will look at that again.

[theanykey]

>> gotten several bluescreens when the administrators logs out from the server

Possible you can take note of the error on the bluescreen? They may also be noted in event viewer.

[olof_christenss]

Here is the bluescreen details:

STOP: c000021a \{Fatal System Error}

The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000005 (0x000000000 0x000000000)

the system has been shut down

Here is the event log:

Event Type: Error

Event Source: EventLog

Event Category: None

Event ID: 6008

Date: 2007-09-12

Time: 13:10:56

User: N/A

Computer: SERVER

Description:

The previous system shutdown at 13:11:29 on 2007-09-12 was unexpected.

Data:

0000: d7 07 09 00 03 00 0c 00 ×.......

0008: 0d 00 0b 00 1d 00 3d 03 ......=.

0010: d7 07 09 00 03 00 0c 00 ×.......

0018: 0b 00 0b 00 1d 00 3d 03 ......=.

Event Type: Information

Event Source: Application Popup

Event Category: None

Event ID: 26

Date: 2007-09-12

Time: 13:11:24

User: N/A

Computer: SERVER

Description:

Application popup: winlogon.exe - Programfel : Instruktionen på "0x773888bc" refererade till minnet på "0x009a39e4". Det gick inte att utföra en minnesåtgärd. Följande fel returnerades: The memory could not be "read".

[theanykey]

You may be right about hidden drivers carried over, however as per ms-kb-330303 (http://support.microsoft.com/kb/330303), you may also want to ensure you have the latest servicepacks:

CAUSE

This problem occurs if the fully qualified domain name ( FQDN) of your computer is exactly 200 bytes long. During logon, one character more than the 200-byte allocation is written and heap corruption occurs.

RESOLUTION

Service Pack Information

To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

[olof_christenss]

update, the bluescreen only occurs if I log to the console.

[sebastian_schae]

Hi,

old Thread - same problem here.

Windows Server 2003 Standard - all acutal hotfixes and servicepacks. Runs on ESX Cluster. The BSOD occues 2 - 3 Times a week, I connect to the server using "mstsc /console". Client is Vista Ultimate 32bit, all actual Hotfixes.

Do you have news on this case?

Regards,

Sebastian

[sebastian_schae]

doublepost ...