2003 enterprise server keeps rebooting with BugCheck 50, {ffffbff8, 0, 8089b522, 0}

[Double R]

Hello - I have a citrix server (PS 4.0 enterprise) running windows
2003 SP1. This system has all of a sudden started rebooting on it's
own... Originally, the reboot was blaming UPHClean, so i uninstalled
it and it still is rebooting randomly... I cannot pinpoint the reboot
- it seems to happen when someone either logs off a session in citrix,
or opens a session... I cannot pinpoint exactly what's going on to
make the reboot occur... this is the most recent bug check (any help
would be GREATLY appreciated - let me know if you need more info too):


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\Mini072907-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs)
Free x86 compatible
Product: Server, suite: Enterprise TerminalServer
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Sun Jul 29 17:59:03.182 2007 (GMT-4)
System Uptime: 0 days 14:58:01.809
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffbff8, 0, 8089b522, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+28b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffbff8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8089b522, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: ffffbff8

FAULTING_IP:
nt!ExFreePoolWithTag+28b
8089b522 668b4602 mov ax,word ptr [esi+2]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 1

TRAP_FRAME: f71e2c6c -- (.trap fffffffff71e2c6c)
ErrCode = 00000000
eax=ffffbf00 ebx=ffffbffe ecx=00000000 edx=ffffbffe esi=ffffbff6
edi=00000000
eip=8089b522 esp=f71e2ce0 ebp=f71e2d2c iopl=0 nv up ei pl nz
na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
nt!ExFreePoolWithTag+0x28b:
8089b522 668b4602 mov ax,word ptr [esi+2] ds:
0023:ffffbff8=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 808689ee to 8087b6be

STACK_TEXT:
f71e2c04 808689ee 00000050 ffffbff8 00000000 nt!KeBugCheckEx+0x1b
f71e2c54 80837d0a 00000000 ffffbff8 00000000 nt!MmAccessFault+0x813
f71e2c54 8089b522 00000000 ffffbff8 00000000 nt!KiTrap0E+0xdc
f71e2d2c 8093aeba ffffbffe 00000000 808ad280 nt!ExFreePoolWithTag
+0x28b
f71e2d48 8091a265 e20ceae8 e7c60518 f71e2d80 nt!CmpCleanUpKcbValueCache
+0x51
f71e2d58 80828314 e20ceae8 00000000 8a788b40 nt!
CmpCleanUpKcbCacheWithLock+0x15
f71e2d80 8083f72e 00000000 00000000 8a788b40 nt!CmpDelayCloseWorker
+0x25c
f71e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f71e2ddc 80841a96 8083f671 00000001 00000000 nt!PspSystemThreadStartup
+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+28b
8089b522 668b4602 mov ax,word ptr [esi+2]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42435e60

SYMBOL_NAME: nt!ExFreePoolWithTag+28b

FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b

BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b

Followup: MachineOwner
------------------------------------------------------------------------------------

Event Logs around this time show the following:

The reason supplied by user domainname\user for the last unexpected
shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x00000050 (0xffffbff8, 0x00000000, 0x8089b522,
0x00000000)
Comment: 0x00000050 (0xffffbff8, 0x00000000, 0x8089b522, 0x00000000)

------------------------------------------------------------------------------------

This thread looks a lot like the problem I am having... I am going to
uninstall SP1 to see if it resolves the problem... http://www.mcse.ms/message729326.html

 

[David Parkes]

Is it an evaluation version you are running? This is one of the symptoms
when you run a 180 day trial and it expires.

"Double R" <rviola81@hotmail.com> wrote in message
news:1185809443.724889.31990@22g2000hsm.googlegroups.com...
> Hello - I have a citrix server (PS 4.0 enterprise) running windows
> 2003 SP1. This system has all of a sudden started rebooting on it's
> own... Originally, the reboot was blaming UPHClean, so i uninstalled
> it and it still is rebooting randomly... I cannot pinpoint the reboot
> - it seems to happen when someone either logs off a session in citrix,
> or opens a session... I cannot pinpoint exactly what's going on to
> make the reboot occur... this is the most recent bug check (any help
> would be GREATLY appreciated - let me know if you need more info too):
>
>
> Microsoft (R) Windows Debugger Version 6.6.0007.5
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [c:\Mini072907-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/
> download/symbols
> Executable search path is:
> Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs)
> Free x86 compatible
> Product: Server, suite: Enterprise TerminalServer
> Built by: 3790.srv03_sp1_rtm.050324-1447
> Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
> Debug session time: Sun Jul 29 17:59:03.182 2007 (GMT-4)
> System Uptime: 0 days 14:58:01.809
> Loading Kernel Symbols
> .............................................................................................................................
> Loading User Symbols
> Loading unloaded module list
> ..........
> *******************************************************************************
> *
> *
> * Bugcheck
> Analysis *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 50, {ffffbff8, 0, 8089b522, 0}
>
>
> Could not read faulting driver name
> Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+28b )
>
> Followup: MachineOwner
> ---------
>
> 0: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck
> Analysis *
> *
> *
> *******************************************************************************
>
> PAGE_FAULT_IN_NONPAGED_AREA (50)
> Invalid system memory was referenced. This cannot be protected by try-
> except,
> it must be protected by a Probe. Typically the address is just plain
> bad or it
> is pointing at freed memory.
> Arguments:
> Arg1: ffffbff8, memory referenced.
> Arg2: 00000000, value 0 = read operation, 1 = write operation.
> Arg3: 8089b522, If non-zero, the instruction address which referenced
> the bad memory
> address.
> Arg4: 00000000, (reserved)
>
> Debugging Details:
> ------------------
>
>
> Could not read faulting driver name
>
> READ_ADDRESS: ffffbff8
>
> FAULTING_IP:
> nt!ExFreePoolWithTag+28b
> 8089b522 668b4602 mov ax,word ptr [esi+2]
>
> MM_INTERNAL_CODE: 0
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
> BUGCHECK_STR: 0x50
>
> PROCESS_NAME: System
>
> CURRENT_IRQL: 1
>
> TRAP_FRAME: f71e2c6c -- (.trap fffffffff71e2c6c)
> ErrCode = 00000000
> eax=ffffbf00 ebx=ffffbffe ecx=00000000 edx=ffffbffe esi=ffffbff6
> edi=00000000
> eip=8089b522 esp=f71e2ce0 ebp=f71e2d2c iopl=0 nv up ei pl nz
> na po nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010202
> nt!ExFreePoolWithTag+0x28b:
> 8089b522 668b4602 mov ax,word ptr [esi+2] ds:
> 0023:ffffbff8=????
> Resetting default scope
>
> LAST_CONTROL_TRANSFER: from 808689ee to 8087b6be
>
> STACK_TEXT:
> f71e2c04 808689ee 00000050 ffffbff8 00000000 nt!KeBugCheckEx+0x1b
> f71e2c54 80837d0a 00000000 ffffbff8 00000000 nt!MmAccessFault+0x813
> f71e2c54 8089b522 00000000 ffffbff8 00000000 nt!KiTrap0E+0xdc
> f71e2d2c 8093aeba ffffbffe 00000000 808ad280 nt!ExFreePoolWithTag
> +0x28b
> f71e2d48 8091a265 e20ceae8 e7c60518 f71e2d80 nt!CmpCleanUpKcbValueCache
> +0x51
> f71e2d58 80828314 e20ceae8 00000000 8a788b40 nt!
> CmpCleanUpKcbCacheWithLock+0x15
> f71e2d80 8083f72e 00000000 00000000 8a788b40 nt!CmpDelayCloseWorker
> +0x25c
> f71e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
> f71e2ddc 80841a96 8083f671 00000001 00000000 nt!PspSystemThreadStartup
> +0x2e
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!ExFreePoolWithTag+28b
> 8089b522 668b4602 mov ax,word ptr [esi+2]
>
> SYMBOL_STACK_INDEX: 3
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: nt
>
> IMAGE_NAME: ntkrnlmp.exe
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 42435e60
>
> SYMBOL_NAME: nt!ExFreePoolWithTag+28b
>
> FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
>
> BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
>
> Followup: MachineOwner
> ------------------------------------------------------------------------------------
>
> Event Logs around this time show the following:
>
> The reason supplied by user domainname\user for the last unexpected
> shutdown of this computer is: System Failure: Stop error
> Reason Code: 0x805000f
> Bug ID:
> Bugcheck String: 0x00000050 (0xffffbff8, 0x00000000, 0x8089b522,
> 0x00000000)
> Comment: 0x00000050 (0xffffbff8, 0x00000000, 0x8089b522, 0x00000000)
>
> ------------------------------------------------------------------------------------
>
> This thread looks a lot like the problem I am having... I am going to
> uninstall SP1 to see if it resolves the problem...
> http://www.mcse.ms/message729326.html
>

 

[Double R]

No, it is not a trial version... it is a volume license install used
from MSDN - Thanks for the info though... any other idea's?

 

[nelson]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

I too had this happen last night...any ideas out there?

"Double R" wrote:

> No, it is not a trial version... it is a volume license install used
> from MSDN - Thanks for the info though... any other idea's?
>
>

 

[Double R]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

On Aug 1, 7:42 am, nelson <nel...@discussions.microsoft.com> wrote:
> I too had this happen last night...any ideas out there?
>
> "Double R" wrote:
> > No, it is not a trial version... it is a volume license install used
> > from MSDN - Thanks for the info though... any other idea's?

Hey Nelson... these are the type of things i have been experimenting
with... first off...

- Do you have "Diskeeper" installed on the system?
- Is the server a citrix server? If so, what install of citrix?
- Do you have SP1 installed for 2003?
- What Anti-Virus do you have on the system? (I have norton corporate
10)

I have read a few things with this... 1 - I have learned that SP1 has
issue's (I have not uninstalled it yet though). 2 - I have
uninstalled Diskeeper, as i have found it to get corrupted easily and
gets into the OS kernal and causes issue's...

I have also noticed - that when the server reboots, there is an
application pop up window on the console that says "C:\program files
\citrix\server resource manager\memory optimization management\data
\alt*.tmp has been tampered with - Please contact executive software
for assistance" - Executive software is Diskeeper, hence another
reason i uninstalled it... I did this, this morning and have not had
the issue yet... will keep you update - let me know if you find
anything out as well...

 

[nelson]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

No diskeeper
no Citrix
Do have SP2 installed
Running McAffee

Other than that...no idea

"Double R" wrote:

> On Aug 1, 7:42 am, nelson <nel...@discussions.microsoft.com> wrote:
> > I too had this happen last night...any ideas out there?
> >
> > "Double R" wrote:
> > > No, it is not a trial version... it is a volume license install used
> > > from MSDN - Thanks for the info though... any other idea's?
>
> Hey Nelson... these are the type of things i have been experimenting
> with... first off...
>
> - Do you have "Diskeeper" installed on the system?
> - Is the server a citrix server? If so, what install of citrix?
> - Do you have SP1 installed for 2003?
> - What Anti-Virus do you have on the system? (I have norton corporate
> 10)
>
> I have read a few things with this... 1 - I have learned that SP1 has
> issue's (I have not uninstalled it yet though). 2 - I have
> uninstalled Diskeeper, as i have found it to get corrupted easily and
> gets into the OS kernal and causes issue's...
>
> I have also noticed - that when the server reboots, there is an
> application pop up window on the console that says "C:\program files
> \citrix\server resource manager\memory optimization management\data
> \alt*.tmp has been tampered with - Please contact executive software
> for assistance" - Executive software is Diskeeper, hence another
> reason i uninstalled it... I did this, this morning and have not had
> the issue yet... will keep you update - let me know if you find
> anything out as well...
>
>

 

[Double R]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

What is the system brand? I am wondering if it's a system driver or
something... Mine is a custom server w/ an ASUS P5L-VM 1394
motherboard in it... i am thinking it may also be memory at this
point... still doing some research... anything you find out, let me
know and i'll do the same.

 

[nelson]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

Brand new Dell server with W2003 Enterprise.

"Double R" wrote:

> What is the system brand? I am wondering if it's a system driver or
> something... Mine is a custom server w/ an ASUS P5L-VM 1394
> motherboard in it... i am thinking it may also be memory at this
> point... still doing some research... anything you find out, let me
> know and i'll do the same.
>
>

 

[Double R]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

Turns out to be a memory problem for me... ran memscope -
http://www.m2ktech.com/MemScope_Memory_Tester.htm on my server and
returned several memory read/write operation errors... ran on several
other servers and came up clean... ordered new memory and will let you
know if it resolves the problem 100%

 

[nelson]

Re: 2003 enterprise server keeps rebooting with BugCheck 50, {ffff

Good Luck. I haven't seen the problem in over a week now, strange. Seems to
have happened right after a Windows update though.

"Double R" wrote:

> Turns out to be a memory problem for me... ran memscope -
> http://www.m2ktech.com/MemScope_Memory_Tester.htm on my server and
> returned several memory read/write operation errors... ran on several
> other servers and came up clean... ordered new memory and will let you
> know if it resolves the problem 100%
>
>
>