Win2K3 / Stop 8E (& initially 0A) / Multiple Hosts, Early Dec 07

[Guest Jon Kloske]

Hi,

 

We have at least 4 terminal servers running the same version of 2K3, with

varying sets of software under different usage patterns, and as of about a

week ago, they all started bluescreening randomly.

 

We've been so far unable to pin down a cause, however it seems that it's

related to either the network or terminal services since unplugging the

network cable or having no users log in seems to alleviate the problem

(until users start logging in, and then it crashes between 1 and 4 times a

day with a STOP 8E mostly.)

 

We've tried various combinations of rolling back windows updates to before

the problems occurred, installing all the windows updates we could find, and

finally doing clean system installs.

 

Nothing has helped. Any intelligent suggestions on what to try next would be

appreciated. Also, I'd be grateful if responders could CC me on replies to

this group if possible.

 

Regards,

Jon.

[Guest Dave Patrick]

Re: Win2K3 / Stop 8E (& initially 0A) / Multiple Hosts, Early Dec 07

 

One of these articles may help.

 

http://support.microsoft.com/kb/905909/en-us

http://support.microsoft.com/kb/940720/en-us

http://support.microsoft.com/kb/921597/en-us

http://support.microsoft.com/kb/932755/en-us

 

 

--

 

Regards,

 

Dave Patrick ....Please no email replies - reply in newsgroup.

Microsoft Certified Professional

Microsoft MVP [Windows]

http://www.microsoft.com/protect

 

"Jon Kloske" wrote:

> Hi,

>

> We have at least 4 terminal servers running the same version of 2K3, with

> varying sets of software under different usage patterns, and as of about a

> week ago, they all started bluescreening randomly.

>

> We've been so far unable to pin down a cause, however it seems that it's

> related to either the network or terminal services since unplugging the

> network cable or having no users log in seems to alleviate the problem

> (until users start logging in, and then it crashes between 1 and 4 times a

> day with a STOP 8E mostly.)

>

> We've tried various combinations of rolling back windows updates to before

> the problems occurred, installing all the windows updates we could find,

> and finally doing clean system installs.

>

> Nothing has helped. Any intelligent suggestions on what to try next would

> be appreciated. Also, I'd be grateful if responders could CC me on replies

> to this group if possible.

>

> Regards,

> Jon.

>

[Guest Jon Kloske]

Re: Win2K3 / Stop 8E (& initially 0A) / Multiple Hosts, Early Dec 07

 

Hi Dave,

 

First, here's a quick rundown of the KB articles you provided (I'd actually

found them all previously, I apologise for not being clearer:)

 

-------

 

Thanks for the quick reply.

> http://support.microsoft.com/kb/905909/en-us

 

We were already running service pack 2. However, see the rest of this email

at the end of the KB responses.

 

> http://support.microsoft.com/kb/940720/en-us

 

We don't have citrix apps or clients installed.

 

> http://support.microsoft.com/kb/921597/en-us

 

We aren't using hot-swap drives or anything tricky here. Unless terminal

services remapping client drives to the server could be triggering this (I

thought this used UNC though...) then it's not the problem. In any event,

we're already running SP2 which is supposed to fix this.

 

> http://support.microsoft.com/kb/932755/en-us

 

This is a Dell PE2850 running off the local onboard PERC, not a HP Proliant

Smart Array.

 

--------

 

We've just upgraded them all to R2, and haven't had the problems since. We

initially thought the first KB article you provided was the most likely when

we came across it, but we'd confirmed we were fully patched so we looked

elsewhere. Now that we've re-installed, I'd have dearly liked to check the

file versions on the kernels listed on the KB article in case for some

reason they were not updated in spite of the service pack showing as being

installed.

 

The other problem with all this is that now that it's xmas we're not getting

the same server loads or users, so there's every chance it's not actually

fixed; but then that's the joy of random errors I guess.

 

I was mostly posting to see if it was something that was happening to others

or if there were any known viruses or rootkits out there hitting 2k3 boxes

that might have caused this.

 

Jon.

[Guest Jon Kloske]

Re: Win2K3 / Stop 8E (& initially 0A) / Multiple Hosts, Early Dec 07

 

Hi Dave,

 

None of these articles pertained to our issue.

 

We've upgraded everything to R2, and until yesterday everything was happy

again. Then yesterday, and again today, one of the servers unexpectedly

bluescreened again.

 

We're getting incomplete memory dumps, even though we've turned on all the

dump options.

 

These systems are identical Dell PowerEdge 2850s from different batches.

 

Examining the dump files we do get; the crashes appear in different files,

some in drivers, some in the kernel, some in the filesystem filter

drivers... once we got one in the smb redirectors etc...

 

We can't really see a pattern with them and I'm not sure what else I should

be looking for. Does anyone have any suggestions no matter how crazy*?

 

Regards,

Jon.

 

* crazy, but with method in the madness :)

 

 

"Dave Patrick" <DSPatrick@nospam.gmail.com> wrote in message

news:CD62B2A5-00CA-4C3E-BE26-B7FDDF036989@microsoft.com...

> One of these articles may help.

>

> http://support.microsoft.com/kb/905909/en-us

> http://support.microsoft.com/kb/940720/en-us

> http://support.microsoft.com/kb/921597/en-us

> http://support.microsoft.com/kb/932755/en-us

>

>

> --

>

> Regards,

>

> Dave Patrick ....Please no email replies - reply in newsgroup.

> Microsoft Certified Professional

> Microsoft MVP [Windows]

> http://www.microsoft.com/protect

>

> "Jon Kloske" wrote:

>> Hi,

>>

>> We have at least 4 terminal servers running the same version of 2K3, with

>> varying sets of software under different usage patterns, and as of about

>> a week ago, they all started bluescreening randomly.

>>

>> We've been so far unable to pin down a cause, however it seems that it's

>> related to either the network or terminal services since unplugging the

>> network cable or having no users log in seems to alleviate the problem

>> (until users start logging in, and then it crashes between 1 and 4 times

>> a day with a STOP 8E mostly.)

>>

>> We've tried various combinations of rolling back windows updates to

>> before the problems occurred, installing all the windows updates we could

>> find, and finally doing clean system installs.

>>

>> Nothing has helped. Any intelligent suggestions on what to try next would

>> be appreciated. Also, I'd be grateful if responders could CC me on

>> replies to this group if possible.

>>

>> Regards,

>> Jon.

>>

>

[Guest Jon Kloske]

Re: Win2K3 / Stop 8E (& initially 0A) / Multiple Hosts, Early Dec 07

 

(reposting this since it still hasn't made its way back past my ISPs

newsserver since Dec 28.)

 

----- Original Message -----

From: "Jon Kloske" <jonshanz@tpg.com.au>

Newsgroups: microsoft.public.windows.server.general

Sent: Friday, December 28, 2007 12:41 PM

Subject: Re: Win2K3 / Stop 8E (& initially 0A) / Multiple Hosts, Early Dec

07

 

> Hi Dave,

>

> First, here's a quick rundown of the KB articles you provided (I'd

> actually found them all previously, I apologise for not being clearer:)

>

> -------

>

> Thanks for the quick reply.

>

>> http://support.microsoft.com/kb/905909/en-us

>

> We were already running service pack 2. However, see the rest of this

> email at the end of the KB responses.

>

>

>> http://support.microsoft.com/kb/940720/en-us

>

> We don't have citrix apps or clients installed.

>

>

>> http://support.microsoft.com/kb/921597/en-us

>

> We aren't using hot-swap drives or anything tricky here. Unless terminal

> services remapping client drives to the server could be triggering this (I

> thought this used UNC though...) then it's not the problem. In any event,

> we're already running SP2 which is supposed to fix this.

>

>

>> http://support.microsoft.com/kb/932755/en-us

>

> This is a Dell PE2850 running off the local onboard PERC, not a HP

> Proliant Smart Array.

>

> --------

>

> We've just upgraded them all to R2, and haven't had the problems since. We

> initially thought the first KB article you provided was the most likely

> when we came across it, but we'd confirmed we were fully patched so we

> looked elsewhere. Now that we've re-installed, I'd have dearly liked to

> check the file versions on the kernels listed on the KB article in case

> for some reason they were not updated in spite of the service pack showing

> as being installed.

>

> The other problem with all this is that now that it's xmas we're not

> getting the same server loads or users, so there's every chance it's not

> actually fixed; but then that's the joy of random errors I guess.

>

> I was mostly posting to see if it was something that was happening to

> others or if there were any known viruses or rootkits out there hitting

> 2k3 boxes that might have caused this.

>

> Jon.