We have problems with a Windows Server 2008 R2 File Server. At random the file server loses all it's shares and the homedrive and application shares are not available anymore. A reboot seems the only way to solve this, untill it happens again. Today we had
another crash and we were able to create a manual dump of the Server service. I have used WinDBG to analyze the dump, but I'm not really confident what I can use from this dump. Here is a copy of the dump:
Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\NLHFDFS01\svchost.DMP]
User Mini Dump File with Full Memory: Only application data is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred http://msdl.microsoft.com/download/symbols
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name:
Debug session time: Wed Apr 29 10:47:14.000 2015 (UTC + 2:00)
System Uptime: 31 days 21:18:36.690
Process Uptime: 31 days 21:18:33.000
................................................................
................................................................
.................
Loading unloaded module list
................................................................
ntdll!NtWaitForSingleObject+0xa:
00000000`77a705fa c3 ret
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for wuaueng.dll -
GetUrlPageData2 (WinHttp) failed: 12029.
FAULTING_IP:
+1fcd4b0
00000000`00000000 ?? ???
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000000000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000077a1a000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=0000000077920000 rsi=00000000ffffffff rdi=00000000000000c8
rip=0000000077a705fa rsp=00000000000af4c8 rbp=0000000000000000
r8=00000000000000f8 r9=00000000000af178 r10=0000000000000000
r11=00000000779200f8 r12=0000000000000000 r13=00000000002de110
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtWaitForSingleObject+0xa:
00000000`77a705fa c3 ret
FAULTING_THREAD: 000000000000016c
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: svchost.exe
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fefdc210dc to 0000000077a705fa
STACK_TEXT:
00000000`000af4c8 000007fe`fdc210dc : 00000000`02fa08c0 00000000`77a41da8 00000000`a4378ba8 00000000`01c9e060 : ntdll!NtWaitForSingleObject+0xa
00000000`000af4d0 000007fe`ffbdaffb : 00000000`ffffffff 000007fe`ffbd344c 00000000`00000000 00000000`000000c8 : KERNELBASE!WaitForSingleObjectEx+0x79
00000000`000af570 000007fe`ffbd9d61 : 00000000`002f6a70 00000000`000000c8 00000000`00000000 00000000`00000000 : sechost!ScSendResponseReceiveControls+0x13b
00000000`000af660 000007fe`ffbd9c16 : 00000000`000af7c8 00000000`00000000 00000000`00000000 00000000`00000000 : sechost!ScDispatcherLoop+0x121
00000000`000af770 00000000`ff251c09 : 00000000`00000003 00000000`002de110 00000000`00000020 00000000`00000000 : sechost!StartServiceCtrlDispatcherW+0x14e
00000000`000af7c0 00000000`ff25242e : 00000000`00000000 00000000`ff252329 01d0694a`57cae81a 00000000`2117ef12 : svchost!wmain+0x18a
00000000`000af7f0 00000000`778159ed : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : svchost!ScCreateWellKnownSids+0x2fd
00000000`000af830 00000000`77a4ba01 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`000af860 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
STACK_COMMAND: ~0s; .ecxr ; kb
FOLLOWUP_IP:
sechost!ScSendResponseReceiveControls+13b
000007fe`ffbdaffb 85c0 test eax,eax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: sechost!ScSendResponseReceiveControls+13b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: sechost
IMAGE_NAME: sechost.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5be05e
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_sechost.dll!ScSendResponseReceiveControls
BUCKET_ID: X64_APPLICATION_FAULT_STATUS_BREAKPOINT_sechost!ScSendResponseReceiveControls+13b
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_sechost.dll!scsendresponsereceivecontrols
FAILURE_ID_HASH: {bb63494f-e1c6-d49e-12fa-866691bbfd47}
Followup: MachineOwner
---------
Can anyone help on this?