Hallo,
ich habe eine VM (über Hyper-V) mit Windows 2008r2 laufen. Dieser VM ist 2. DC. Nun habe ich folgendes Problem. Sobald ich mich auf der VM anmelden möchte (egal welcher Benutzer) kommt ein Bluescreen mit REGISTRY_ERROR 0x00000051 (0x0000000000000001, 0xfffff8a000024010,
0x00000000008a5000, 0x0000000000000374) und das System staret neu. In den abgesicherten Modus komme ich soweit noch. Wenn ich mich an der VM NICHT anmelde, laufen im Hintergrund alle Dienste normal, er stürtzt halt bei der Anmeldung ab.
Hier die Auswertung der DMP-Datei:
================================================================
Microsoft (R) Windows Debugger Version 6.2.8400.4218 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\071712-64125-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`0160e000 PsLoadedModuleList = 0xfffff800`01852670
Debug session time: Tue Jul 17 23:44:05.748 2012 (UTC + 2:00)
System Uptime: 0 days 0:03:31.312
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 51, {1, fffff8a000024010, 8a8000, 374}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+9eea )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
REGISTRY_ERROR (51)
Something has gone badly wrong with the registry. If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 0000000000000001, (reserved)
Arg2: fffff8a000024010, (reserved)
Arg3: 00000000008a8000, depends on where Windows bugchecked, may be pointer to hive
Arg4: 0000000000000374, depends on where Windows bugchecked, may be return code of
HvCheckHive if the hive is corrupt.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT_SERVER
BUGCHECK_STR: 0x51
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800019b8398 to fffff8000168d1c0
STACK_TEXT:
fffff880`039ee438 fffff800`019b8398 : 00000000`00000051 00000000`00000001 fffff8a0`00024010 00000000`008a8000 : nt!KeBugCheckEx
fffff880`039ee440 fffff800`019213a5 : 00000000`000018f9 00000000`0000453f 00000000`005d1420 fffff800`00000004 : nt! ?? ::NNGAKEGL::`string'+0x9eea
fffff880`039ee4a0 fffff800`0192117c : fffff8a0`00024010 fffff8a0`00024010 fffff8a0`00037a20 00000000`005d1d90 : nt!HvMarkDirty+0x176
fffff880`039ee500 fffff800`018e277b : 00000000`00000001 fffff8a0`00aa465c fffff8a0`00a36a5c fffff8a0`00024010 : nt!HvMarkCellDirty+0x150
fffff880`039ee550 fffff800`018e2554 : fffff8a0`00a36a5c 00000000`ffffffff fffff8a0`00a36a5c fffff8a0`00024010 : nt!CmpMarkKeyValuesDirty+0x14b
fffff880`039ee5f0 fffff800`018e1c5a : fffff8a0`00024010 00000000`ffffffff fffff8a0`00a36a5c fffff8a0`00024010 : nt!CmpFreeKeyValues+0x24
fffff880`039ee620 fffff800`018e1988 : fffff8a0`00024010 00000000`002ab1f0 fffff8a0`00a36a5c fffff8a0`0063da58 : nt!CmpSyncKeyValues+0x7a
fffff880`039ee700 fffff800`018e3c4e : fffff8a0`03f6b000 00000000`0039f168 fffffa80`00000000 00000000`00000000 : nt!CmpCopySyncTree2+0x2a8
fffff880`039ee7b0 fffff800`018e3b67 : 00000000`00000000 00000000`00000002 fffff8a0`03ee57a0 fffff8a0`07ba7b90 : nt!CmpCopySyncTree+0x6e
fffff880`039ee800 fffff800`018e3736 : fffff8a0`03e4dd90 00000000`00000000 00000000`00000001 00000000`00000000 : nt!CmpSaveBootControlSet+0x307
fffff880`039ee9e0 fffff800`0168c453 : fffffa80`04004060 00000000`00000000 fffff880`039eeab0 00000000`00000001 : nt!NtInitializeRegistry+0xc6
fffff880`039eea30 fffff800`01688a10 : fffff800`018e36df 00000000`00000220 00000000`001ef5c8 00000000`001ef8f8 : nt!KiSystemServiceCopyEnd+0x13
fffff880`039eebc8 fffff800`018e36df : 00000000`00000220 00000000`001ef5c8 00000000`001ef8f8 00000000`000a001f : nt!KiServiceLinkage
fffff880`039eebd0 fffff800`0168c453 : fffffa80`04004060 fffff880`039eeca0 fffff880`039eeca0 00000000`00000002 : nt!NtInitializeRegistry+0x6f
fffff880`039eec20 00000000`772120ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001ef878 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772120ba
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+9eea
fffff800`019b8398 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+9eea
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3
FAILURE_BUCKET_ID: X64_0x51_nt!_??_::NNGAKEGL::_string_+9eea
BUCKET_ID: X64_0x51_nt!_??_::NNGAKEGL::_string_+9eea
Followup: MachineOwner
---------
So wie es scheint schießt er sich auf die ntkrnlmp.exe weg. Diese Datei gibt es aber mehrmals im System. Ein Hardwaredefekt kann ich wegen VM (Hyper-V) ausschließen.
Hat Jemand eine Idee, wie ich den Fehler behebe?
Vielen Dank
