sever crash when connecting use remote desktop clients

Windows 2008 Server x64. Set to allow only one session to logon.

It crash randomly when logon by using remote desktop clients.

I got crash dumps, dont know where to send it to.

Not every crash crashed at the same position. But it looks like it related
to device io , maybe possible graphic driver? But I try upgrade nivdia's
driver every time, but no help at all.

The problem been more annoying when using mac remote desktop client, almost
crash everytime, unless server just booted up.


----------


Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\022610-47845-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
************************************************** **************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
************************************************** **************************
Executable search path is:
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`02067000 PsLoadedModuleList = 0xfffff800`022a4e50
Debug session time: Fri Feb 26 18:15:57.494 2010 (GMT+8)
System Uptime: 0 days 21:01:05.571
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.................................................. ..............
.................................................. ...............
.................................................. ...............
........
Loading User Symbols
Loading unloaded module list
......
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800020de00c, fffff8800ce20140, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
Probably caused by : ntoskrnl.exe ( nt+7700c )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.................................................. ..............
.................................................. ...............
.................................................. ...............
........
Loading User Symbols
Loading unloaded module list
......
1: kd> !analyze -v
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020de00c, Address of the exception record for the exception
that caused the bugcheck
Arg3: fffff8800ce20140, Address of the context record for the exception that
caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!ObfDereferenceObject+2c
fffff800`020de00c f0480fc11f lock xadd qword ptr [rdi],rbx

CONTEXT: fffff8800ce20140 -- (.cxr 0xfffff8800ce20140)
rax=0000000000000001 rbx=ffffffffffffffff rcx=005690c0005690c0
rdx=0000000000000000 rsi=005690c0005690c0 rdi=005690c000569090
rip=fffff800020de00c rsp=fffff8800ce20b20 rbp=0000000000000000
r8=0000000000005aa0 r9=0000000000000170 r10=fffff80002067000
r11=fffff8800ce20b78 r12=0000000000000000 r13=000007fefda9b710
r14=0000000000000001 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00010286
nt!ObfDereferenceObject+0x2c:
fffff800`020de00c f0480fc11f lock xadd qword ptr [rdi],rbx
ds:002b:005690c0`00569090=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x3B

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff960000987e3 to fffff800020de00c

STACK_TEXT:
fffff880`0ce20b20 fffff960`000987e3 : 00000000`00000000 00000000`00000000
00000000`00000001 00000000`00000000 : nt!ObfDereferenceObject+0x2c
fffff880`0ce20b80 fffff960`00180545 : 00000000`00000000 00000000`00000001
00000000`00000000 00000000`00000000 :
win32k!DrvCloseLocalGraphicsDevices+0x83
fffff880`0ce20bb0 fffff960`00163ea6 : 00000000`00000000 fffffa80`08ac0080
fffff880`0ce20ca0 00000000`00000005 : win32k!xxxRemoteDisconnect+0x1cd
fffff880`0ce20bf0 fffff800`020d8153 : fffffa80`08ac0080 00000000`00000005
00000000`00000020 00000000`00000000 : win32k!NtUserCallNoParam+0x36
fffff880`0ce20c20 000007fe`fda83d3a : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`002df9f8 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : 0x7fe`fda83d3a


FOLLOWUP_IP:
win32k!DrvCloseLocalGraphicsDevices+83
fffff960`000987e3 4c8b1d7eaa2c00 mov r11,qword ptr [win32k!gPhysDispVGA
(fffff960`00363268)]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k!DrvCloseLocalGraphicsDevices+83

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc5e0

STACK_COMMAND: .cxr 0xfffff8800ce20140 ; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!DrvCloseLocalGraphicsDevices+83

BUCKET_ID: X64_0x3B_win32k!DrvCloseLocalGraphicsDevices+83

Followup: MachineOwner
---------



--

Tomasen

Hi Tomase,

yes that could be an faulty driver but also by several other possible
reasons :-(
Can u also create a full memory dump and analyze it on the same way ?
Also did you had configured the public symbols ? You could also use the
online version of the microsoft symbol server ->
http://support.microsoft.com/kb/311503

PS : Are u allowing here drive/printer mapping for your RDP clients ?

Regards
Ramazan

"Tomasen" <> wrote in message
news:...
> Windows 2008 Server x64. Set to allow only one session to logon.
>
> It crash randomly when logon by using remote desktop clients.
>
> I got crash dumps, dont know where to send it to.
>
> Not every crash crashed at the same position. But it looks like it related
> to device io , maybe possible graphic driver? But I try upgrade nivdia's
> driver every time, but no help at all.
>
> The problem been more annoying when using mac remote desktop client,
> almost crash everytime, unless server just booted up.
>
>
> ----------
>
>
> Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\Windows\Minidump\022610-47845-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: *** Invalid ***
> ************************************************** **************************
> * Symbol loading may be unreliable without a symbol search path.
> *
> * Use .symfix to have the debugger choose a symbol path.
> *
> * After setting your symbol path, use .reload to refresh symbol locations.
> *
> ************************************************** **************************
> Executable search path is:
> ************************************************** *******************
> * Symbols can not be loaded because symbol path is not initialized. *
> * *
> * The Symbol Path can be set by: *
> * using the _NT_SYMBOL_PATH environment variable. *
> * using the -y <symbol_path> argument when starting the debugger. *
> * using .sympath and .sympath+ *
> ************************************************** *******************
> Unable to load image ntoskrnl.exe, Win32 error 0n2
> *** ERROR: Module load completed but symbols could not be loaded for
> ntoskrnl.exe
> Windows 7 Kernel Version 7600 MP (4 procs) Free x64
> Product: Server, suite: Enterprise TerminalServer SingleUserTS
> Machine Name:
> Kernel base = 0xfffff800`02067000 PsLoadedModuleList = 0xfffff800`022a4e50
> Debug session time: Fri Feb 26 18:15:57.494 2010 (GMT+8)
> System Uptime: 0 days 21:01:05.571
> ************************************************** *******************
> * Symbols can not be loaded because symbol path is not initialized. *
> * *
> * The Symbol Path can be set by: *
> * using the _NT_SYMBOL_PATH environment variable. *
> * using the -y <symbol_path> argument when starting the debugger. *
> * using .sympath and .sympath+ *
> ************************************************** *******************
> Unable to load image ntoskrnl.exe, Win32 error 0n2
> *** ERROR: Module load completed but symbols could not be loaded for
> ntoskrnl.exe
> Loading Kernel Symbols
> .................................................. .............
> .................................................. ..............
> .................................................. ..............
> .......
> Loading User Symbols
> Loading unloaded module list
> .....
> ************************************************** *****************************
> * *
> * Bugcheck Analysis *
> * *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 3B, {c0000005, fffff800020de00c, fffff8800ce20140, 0}
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> ************************************************** ***********************
> *** ***
> *** ***
> *** Your debugger is not using the correct symbols ***
> *** ***
> *** In order for this command to work properly, your symbol path ***
> *** must point to .pdb files that have full type information. ***
> *** ***
> *** Certain .pdb files (such as the public OS symbols) do not ***
> *** contain the required information. Contact the group that ***
> *** provided you with these symbols if you need this command to ***
> *** work. ***
> *** ***
> *** Type referenced: nt!_KPRCB ***
> *** ***
> ************************************************** ***********************
> ************************************************** ***********************
> *** ***
> *** ***
> *** Your debugger is not using the correct symbols ***
> *** ***
> *** In order for this command to work properly, your symbol path ***
> *** must point to .pdb files that have full type information. ***
> *** ***
> *** Certain .pdb files (such as the public OS symbols) do not ***
> *** contain the required information. Contact the group that ***
> *** provided you with these symbols if you need this command to ***
> *** work. ***
> *** ***
> *** Type referenced: nt!_KPRCB ***
> *** ***
> ************************************************** ***********************
> ************************************************** ***********************
> *** ***
> *** ***
> *** Your debugger is not using the correct symbols ***
> *** ***
> *** In order for this command to work properly, your symbol path ***
> *** must point to .pdb files that have full type information. ***
> *** ***
> *** Certain .pdb files (such as the public OS symbols) do not ***
> *** contain the required information. Contact the group that ***
> *** provided you with these symbols if you need this command to ***
> *** work. ***
> *** ***
> *** Type referenced: nt!_KPRCB ***
> *** ***
> ************************************************** ***********************
> ************************************************** *******************
> * Symbols can not be loaded because symbol path is not initialized. *
> * *
> * The Symbol Path can be set by: *
> * using the _NT_SYMBOL_PATH environment variable. *
> * using the -y <symbol_path> argument when starting the debugger. *
> * using .sympath and .sympath+ *
> ************************************************** *******************
> ************************************************** *******************
> * Symbols can not be loaded because symbol path is not initialized. *
> * *
> * The Symbol Path can be set by: *
> * using the _NT_SYMBOL_PATH environment variable. *
> * using the -y <symbol_path> argument when starting the debugger. *
> * using .sympath and .sympath+ *
> ************************************************** *******************
> Probably caused by : ntoskrnl.exe ( nt+7700c )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> .reload
> Loading Kernel Symbols
> .................................................. .............
> .................................................. ..............
> .................................................. ..............
> .......
> Loading User Symbols
> Loading unloaded module list
> .....
> 1: kd> !analyze -v
> ************************************************** *****************************
> * *
> * Bugcheck Analysis *
> * *
> ************************************************** *****************************
>
> SYSTEM_SERVICE_EXCEPTION (3b)
> An exception happened while executing a system service routine.
> Arguments:
> Arg1: 00000000c0000005, Exception code that caused the bugcheck
> Arg2: fffff800020de00c, Address of the exception record for the exception
> that caused the bugcheck
> Arg3: fffff8800ce20140, Address of the context record for the exception
> that caused the bugcheck
> Arg4: 0000000000000000, zero.
>
> Debugging Details:
> ------------------
>
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
> referenced memory at 0x%08lx. The memory could not be %s.
>
> FAULTING_IP:
> nt!ObfDereferenceObject+2c
> fffff800`020de00c f0480fc11f lock xadd qword ptr [rdi],rbx
>
> CONTEXT: fffff8800ce20140 -- (.cxr 0xfffff8800ce20140)
> rax=0000000000000001 rbx=ffffffffffffffff rcx=005690c0005690c0
> rdx=0000000000000000 rsi=005690c0005690c0 rdi=005690c000569090
> rip=fffff800020de00c rsp=fffff8800ce20b20 rbp=0000000000000000
> r8=0000000000005aa0 r9=0000000000000170 r10=fffff80002067000
> r11=fffff8800ce20b78 r12=0000000000000000 r13=000007fefda9b710
> r14=0000000000000001 r15=0000000000000000
> iopl=0 nv up ei ng nz na po nc
> cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
> nt!ObfDereferenceObject+0x2c:
> fffff800`020de00c f0480fc11f lock xadd qword ptr [rdi],rbx
> ds:002b:005690c0`00569090=????????????????
> Resetting default scope
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
> BUGCHECK_STR: 0x3B
>
> PROCESS_NAME: csrss.exe
>
> CURRENT_IRQL: 0
>
> LAST_CONTROL_TRANSFER: from fffff960000987e3 to fffff800020de00c
>
> STACK_TEXT:
> fffff880`0ce20b20 fffff960`000987e3 : 00000000`00000000 00000000`00000000
> 00000000`00000001 00000000`00000000 : nt!ObfDereferenceObject+0x2c
> fffff880`0ce20b80 fffff960`00180545 : 00000000`00000000 00000000`00000001
> 00000000`00000000 00000000`00000000 :
> win32k!DrvCloseLocalGraphicsDevices+0x83
> fffff880`0ce20bb0 fffff960`00163ea6 : 00000000`00000000 fffffa80`08ac0080
> fffff880`0ce20ca0 00000000`00000005 : win32k!xxxRemoteDisconnect+0x1cd
> fffff880`0ce20bf0 fffff800`020d8153 : fffffa80`08ac0080 00000000`00000005
> 00000000`00000020 00000000`00000000 : win32k!NtUserCallNoParam+0x36
> fffff880`0ce20c20 000007fe`fda83d3a : 00000000`00000000 00000000`00000000
> 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
> 00000000`002df9f8 00000000`00000000 : 00000000`00000000 00000000`00000000
> 00000000`00000000 00000000`00000000 : 0x7fe`fda83d3a
>
>
> FOLLOWUP_IP:
> win32k!DrvCloseLocalGraphicsDevices+83
> fffff960`000987e3 4c8b1d7eaa2c00 mov r11,qword ptr
> [win32k!gPhysDispVGA (fffff960`00363268)]
>
> SYMBOL_STACK_INDEX: 1
>
> SYMBOL_NAME: win32k!DrvCloseLocalGraphicsDevices+83
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: win32k
>
> IMAGE_NAME: win32k.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc5e0
>
> STACK_COMMAND: .cxr 0xfffff8800ce20140 ; kb
>
> FAILURE_BUCKET_ID: X64_0x3B_win32k!DrvCloseLocalGraphicsDevices+83
>
> BUCKET_ID: X64_0x3B_win32k!DrvCloseLocalGraphicsDevices+83
>
> Followup: MachineOwner
> ---------
>
>
>
> --
>
> Tomasen

Yes I do use online version of the microsoft symbol server .

full memory dump is a little bit ... since it has 8G memory . But I will try
that once I have time for this.

I will make sure disable drive/printer mapping see if any diffrence.

--
Thanks

Tomasen

"RCan" <> wrote in message
news:uMo#...
> Hi Tomase,
>
> yes that could be an faulty driver but also by several other possible
> reasons :-(
> Can u also create a full memory dump and analyze it on the same way ?
> Also did you had configured the public symbols ? You could also use the
> online version of the microsoft symbol server ->
> http://support.microsoft.com/kb/311503
>
> PS : Are u allowing here drive/printer mapping for your RDP clients ?
>
> Regards
> Ramazan
>
> "Tomasen" <> wrote in message
> news:...
>> Windows 2008 Server x64. Set to allow only one session to logon.
>>
>> It crash randomly when logon by using remote desktop clients.
>>
>> I got crash dumps, dont know where to send it to.
>>
>> Not every crash crashed at the same position. But it looks like it
>> related to device io , maybe possible graphic driver? But I try upgrade
>> nivdia's driver every time, but no help at all.
>>
>> The problem been more annoying when using mac remote desktop client,
>> almost crash everytime, unless server just booted up.
>>
>>
>> ----------
>>
>>
>> Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>> Loading Dump File [C:\Windows\Minidump\022610-47845-01.dmp]
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is: *** Invalid ***
>> ************************************************** **************************
>> * Symbol loading may be unreliable without a symbol search path. *
>> * Use .symfix to have the debugger choose a symbol path. *
>> * After setting your symbol path, use .reload to refresh symbol
>> locations. *
>> ************************************************** **************************
>> Executable search path is:
>> ************************************************** *******************
>> * Symbols can not be loaded because symbol path is not initialized. *
>> * *
>> * The Symbol Path can be set by: *
>> * using the _NT_SYMBOL_PATH environment variable. *
>> * using the -y <symbol_path> argument when starting the debugger. *
>> * using .sympath and .sympath+ *
>> ************************************************** *******************
>> Unable to load image ntoskrnl.exe, Win32 error 0n2
>> *** ERROR: Module load completed but symbols could not be loaded for
>> ntoskrnl.exe
>> Windows 7 Kernel Version 7600 MP (4 procs) Free x64
>> Product: Server, suite: Enterprise TerminalServer SingleUserTS
>> Machine Name:
>> Kernel base = 0xfffff800`02067000 PsLoadedModuleList =
>> 0xfffff800`022a4e50
>> Debug session time: Fri Feb 26 18:15:57.494 2010 (GMT+8)
>> System Uptime: 0 days 21:01:05.571
>> ************************************************** *******************
>> * Symbols can not be loaded because symbol path is not initialized. *
>> * *
>> * The Symbol Path can be set by: *
>> * using the _NT_SYMBOL_PATH environment variable. *
>> * using the -y <symbol_path> argument when starting the debugger. *
>> * using .sympath and .sympath+ *
>> ************************************************** *******************
>> Unable to load image ntoskrnl.exe, Win32 error 0n2
>> *** ERROR: Module load completed but symbols could not be loaded for
>> ntoskrnl.exe
>> Loading Kernel Symbols
>> .................................................. .............
>> .................................................. ..............
>> .................................................. ..............
>> .......
>> Loading User Symbols
>> Loading unloaded module list
>> .....
>> ************************************************** *****************************
>> * *
>> * Bugcheck Analysis *
>> * *
>> ************************************************** *****************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 3B, {c0000005, fffff800020de00c, fffff8800ce20140, 0}
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> ************************************************** ***********************
>> *** ***
>> *** ***
>> *** Your debugger is not using the correct symbols ***
>> *** ***
>> *** In order for this command to work properly, your symbol path ***
>> *** must point to .pdb files that have full type information. ***
>> *** ***
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>> *** contain the required information. Contact the group that ***
>> *** provided you with these symbols if you need this command to ***
>> *** work. ***
>> *** ***
>> *** Type referenced: nt!_KPRCB ***
>> *** ***
>> ************************************************** ***********************
>> ************************************************** ***********************
>> *** ***
>> *** ***
>> *** Your debugger is not using the correct symbols ***
>> *** ***
>> *** In order for this command to work properly, your symbol path ***
>> *** must point to .pdb files that have full type information. ***
>> *** ***
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>> *** contain the required information. Contact the group that ***
>> *** provided you with these symbols if you need this command to ***
>> *** work. ***
>> *** ***
>> *** Type referenced: nt!_KPRCB ***
>> *** ***
>> ************************************************** ***********************
>> ************************************************** ***********************
>> *** ***
>> *** ***
>> *** Your debugger is not using the correct symbols ***
>> *** ***
>> *** In order for this command to work properly, your symbol path ***
>> *** must point to .pdb files that have full type information. ***
>> *** ***
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>> *** contain the required information. Contact the group that ***
>> *** provided you with these symbols if you need this command to ***
>> *** work. ***
>> *** ***
>> *** Type referenced: nt!_KPRCB ***
>> *** ***
>> ************************************************** ***********************
>> ************************************************** *******************
>> * Symbols can not be loaded because symbol path is not initialized. *
>> * *
>> * The Symbol Path can be set by: *
>> * using the _NT_SYMBOL_PATH environment variable. *
>> * using the -y <symbol_path> argument when starting the debugger. *
>> * using .sympath and .sympath+ *
>> ************************************************** *******************
>> ************************************************** *******************
>> * Symbols can not be loaded because symbol path is not initialized. *
>> * *
>> * The Symbol Path can be set by: *
>> * using the _NT_SYMBOL_PATH environment variable. *
>> * using the -y <symbol_path> argument when starting the debugger. *
>> * using .sympath and .sympath+ *
>> ************************************************** *******************
>> Probably caused by : ntoskrnl.exe ( nt+7700c )
>>
>> Followup: MachineOwner
>> ---------
>>
>> 1: kd> .reload
>> Loading Kernel Symbols
>> .................................................. .............
>> .................................................. ..............
>> .................................................. ..............
>> .......
>> Loading User Symbols
>> Loading unloaded module list
>> .....
>> 1: kd> !analyze -v
>> ************************************************** *****************************
>> * *
>> * Bugcheck Analysis *
>> * *
>> ************************************************** *****************************
>>
>> SYSTEM_SERVICE_EXCEPTION (3b)
>> An exception happened while executing a system service routine.
>> Arguments:
>> Arg1: 00000000c0000005, Exception code that caused the bugcheck
>> Arg2: fffff800020de00c, Address of the exception record for the exception
>> that caused the bugcheck
>> Arg3: fffff8800ce20140, Address of the context record for the exception
>> that caused the bugcheck
>> Arg4: 0000000000000000, zero.
>>
>> Debugging Details:
>> ------------------
>>
>>
>> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
>> referenced memory at 0x%08lx. The memory could not be %s.
>>
>> FAULTING_IP:
>> nt!ObfDereferenceObject+2c
>> fffff800`020de00c f0480fc11f lock xadd qword ptr [rdi],rbx
>>
>> CONTEXT: fffff8800ce20140 -- (.cxr 0xfffff8800ce20140)
>> rax=0000000000000001 rbx=ffffffffffffffff rcx=005690c0005690c0
>> rdx=0000000000000000 rsi=005690c0005690c0 rdi=005690c000569090
>> rip=fffff800020de00c rsp=fffff8800ce20b20 rbp=0000000000000000
>> r8=0000000000005aa0 r9=0000000000000170 r10=fffff80002067000
>> r11=fffff8800ce20b78 r12=0000000000000000 r13=000007fefda9b710
>> r14=0000000000000001 r15=0000000000000000
>> iopl=0 nv up ei ng nz na po nc
>> cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
>> nt!ObfDereferenceObject+0x2c:
>> fffff800`020de00c f0480fc11f lock xadd qword ptr [rdi],rbx
>> ds:002b:005690c0`00569090=????????????????
>> Resetting default scope
>>
>> CUSTOMER_CRASH_COUNT: 1
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>>
>> BUGCHECK_STR: 0x3B
>>
>> PROCESS_NAME: csrss.exe
>>
>> CURRENT_IRQL: 0
>>
>> LAST_CONTROL_TRANSFER: from fffff960000987e3 to fffff800020de00c
>>
>> STACK_TEXT:
>> fffff880`0ce20b20 fffff960`000987e3 : 00000000`00000000 00000000`00000000
>> 00000000`00000001 00000000`00000000 : nt!ObfDereferenceObject+0x2c
>> fffff880`0ce20b80 fffff960`00180545 : 00000000`00000000 00000000`00000001
>> 00000000`00000000 00000000`00000000 :
>> win32k!DrvCloseLocalGraphicsDevices+0x83
>> fffff880`0ce20bb0 fffff960`00163ea6 : 00000000`00000000 fffffa80`08ac0080
>> fffff880`0ce20ca0 00000000`00000005 : win32k!xxxRemoteDisconnect+0x1cd
>> fffff880`0ce20bf0 fffff800`020d8153 : fffffa80`08ac0080 00000000`00000005
>> 00000000`00000020 00000000`00000000 : win32k!NtUserCallNoParam+0x36
>> fffff880`0ce20c20 000007fe`fda83d3a : 00000000`00000000 00000000`00000000
>> 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
>> 00000000`002df9f8 00000000`00000000 : 00000000`00000000 00000000`00000000
>> 00000000`00000000 00000000`00000000 : 0x7fe`fda83d3a
>>
>>
>> FOLLOWUP_IP:
>> win32k!DrvCloseLocalGraphicsDevices+83
>> fffff960`000987e3 4c8b1d7eaa2c00 mov r11,qword ptr
>> [win32k!gPhysDispVGA (fffff960`00363268)]
>>
>> SYMBOL_STACK_INDEX: 1
>>
>> SYMBOL_NAME: win32k!DrvCloseLocalGraphicsDevices+83
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> MODULE_NAME: win32k
>>
>> IMAGE_NAME: win32k.sys
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc5e0
>>
>> STACK_COMMAND: .cxr 0xfffff8800ce20140 ; kb
>>
>> FAILURE_BUCKET_ID: X64_0x3B_win32k!DrvCloseLocalGraphicsDevices+83
>>
>> BUCKET_ID: X64_0x3B_win32k!DrvCloseLocalGraphicsDevices+83
>>
>> Followup: MachineOwner
>> ---------
>>
>>
>>
>> --
>>
>> Tomasen
>