locked
Fully Patched System Getting 3B BSOD 2FA + NetMotion. RRS feed

  • Question

  • .DMP file: https://1drv.ms/u/s!AiZr-tzSl9_AmFF4sFvWoXuexcos

    I'm battling a BSOD that is occuring during the initial 2FA logon.  Netmotion is also installed and set to authenticated as the device.

    Any help is much appreciated.  I can't seem to figure out what is causing the BSOD, when I attempt to open the .dmp in windbg it errors out when attempting to find symbols:

    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

    /BG


    -BrianG (http://supportishere.com)


    Friday, July 20, 2018 3:55 PM

All replies

  • Hi,

    Can you help us determine if the bsod issue is related to the 3-party software Netmotion? Try to uninstall this software and login again. 

    If it is related to the 3-party software, please try to update/reinstall it?

    What have you recently done before the problem happen?Have you update the software/ install the software?

    Look in Device Manager to see if any devices are marked with the exclamation point (!).

    Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, July 23, 2018 7:00 AM
  • Vivian,

    Thanks for your help.

    I cannot reproduce the error when Netmotion is uninstalled.  It seems to occur after attempting a logon.  They are running the latest available in their environment 11.40.18434.

    The image was produced using VMWare and is fully patched with Windows Updates.  Win 7 x64 Enterprise.

    I'll check on the event viewer,  and post anything interesting.

    In the meantime here is another .dmp displaying the same error, this time without 2FA.

    https://1drv.ms/u/s!AiZr-tzSl9_AmGjh00UDoQF6K5tQ


    -BrianG (http://supportishere.com)

    Wednesday, July 25, 2018 6:14 PM
  • Hi Brian Gonzalez,

    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive or drop box to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a))  dxdiag:  In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    b) memory dump:  open file explorer > this PC > C: > in the right upper corner search for C:\windows\memory.dmp > zip > post a one drive or drop box share link into the thread

    Open the website for the computer or motherboard manufacturer > support > enter the product or serial number or model > select the operating system > view drivers > post a URL or hyperlink into the thread

    Open device manager > click view > show hidden devices > expand all rows > look for any row displaying an icon that is a yellow triangle with a black exclamation mark or an unknown device > post an image into the thread using a one drive or drop box share link

    Post the over clocking history.  Return all settings to stock and make sure that there is no over clocking during the troubleshooting.

    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .




    Friday, July 27, 2018 2:44 AM