none
Windows 2012 server BSOD RRS feed

  • Question

  • Good day

    I recently started at a company where i assist in small IT related tasks.

    Recently we have started to experience some trouble with our server, we will all still be working perfectly fine (via Remote Desktop) then all of a sudden we lose our connection to the server and when i go to see what the problem is, I see the blue screen of death on the screen with the following message:

    "Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you.

    If you'd like to know more, you can search online later for this error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (TSFairShare.sys)"

     If anyone can please assist me in what this means and how to resolve it i would appreciate it seeing as i don't have a clue in connection to servers.

    Monday, November 2, 2015 11:08 AM

Answers

  • As Acreed02 suggest you may want to run driver verifier to find out if there is an underlying problem causing TSFS to crash.  Verifier should make the system crash when the underling (and mis-behaving) driver is loaded so if this is a productions server make sure it is not active at the time.

    I only asked about Citrix because in reading about TSFS There is a quite a few related to Citrix


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Monday, November 2, 2015 2:32 PM
    Moderator

All replies

  •  
    We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Monday, November 2, 2015 11:23 AM
    Moderator
  • Hi can you please explain to me where i will find the DMP files? 
    Monday, November 2, 2015 12:37 PM
  • Eugene

    That is what the wiki is for.  If you get stuck somewhere let us know where.

    The DMPS should be located @ C:\windows\mindump


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Monday, November 2, 2015 12:57 PM
    Moderator
  • https://onedrive.live.com/redir?resid=AC7270AECBF49A9E!113&authkey=!AM0aUwiYRCXu1zw&ithint=file%2cdmp

    Think that link is done in the right way

    Monday, November 2, 2015 1:16 PM
  • You're crashing on TSFairShare.sys, let's run driver verifier and upload the DMP it generates. Instructions for verifier can be found here.

    Below is your DMP info:

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {ffffffffc0000005, fffff88006a589cc, fffff88006837778, fffff88006836fb0}

    Probably caused by : TSFairShare.sys ( TSFairShare!TSFSNotifyIoCompleted+78 )

    Followup: MachineOwner
    ---------

    10: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88006a589cc, The address that the exception occurred at
    Arg3: fffff88006837778, Exception Record Address
    Arg4: fffff88006836fb0, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    TSFairShare!TSFSNotifyIoCompleted+78
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4]

    EXCEPTION_RECORD:  fffff88006837778 -- (.exr 0xfffff88006837778)
    ExceptionAddress: fffff88006a589cc (TSFairShare!TSFSNotifyIoCompleted+0x0000000000000078)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000299a90
    Attempt to read from address 0000000000299a90

    CONTEXT:  fffff88006836fb0 -- (.cxr 0xfffff88006836fb0;r)
    rax=0000000000299a8c rbx=fffffa80e080f2c0 rcx=01d1125dd06f4bce
    rdx=fffffa80e080f2c0 rsi=fffffa812386e900 rdi=0000000000000000
    rip=fffff88006a589cc rsp=fffff880068379b0 rbp=fffff88006837a10
     r8=00000000c0000005  r9=0000000000000001 r10=00000000ffffffff
    r11=0000000000000000 r12=00000000c0000005 r13=fffffa8063072610
    r14=0000000000000000 r15=fffffa80e080f2c0
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    TSFairShare!TSFSNotifyIoCompleted+0x78:
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4] ds:002b:00000000`00299a90=??
    Last set context:
    rax=0000000000299a8c rbx=fffffa80e080f2c0 rcx=01d1125dd06f4bce
    rdx=fffffa80e080f2c0 rsi=fffffa812386e900 rdi=0000000000000000
    rip=fffff88006a589cc rsp=fffff880068379b0 rbp=fffff88006837a10
     r8=00000000c0000005  r9=0000000000000001 r10=00000000ffffffff
    r11=0000000000000000 r12=00000000c0000005 r13=fffffa8063072610
    r14=0000000000000000 r15=fffffa80e080f2c0
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    TSFairShare!TSFSNotifyIoCompleted+0x78:
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4] ds:002b:00000000`00299a90=??
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  0000000000000000

    EXCEPTION_PARAMETER2:  0000000000299a90

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff803fbde0168
    GetUlongFromAddress: unable to read from fffff803fbde01f8
     0000000000299a90 Nonpaged pool

    FOLLOWUP_IP:
    TSFairShare!TSFSNotifyIoCompleted+78
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4]

    BUGCHECK_STR:  AV

    ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

    LAST_CONTROL_TRANSFER:  from fffff88006a584e5 to fffff88006a589cc

    STACK_TEXT:  
    fffff880`068379b0 fffff880`06a584e5 : fffff880`06a5be1c fffff880`06a5d6d0 00000000`c0000005 fffff880`06a5d700 : TSFairShare!TSFSNotifyIoCompleted+0x78
    fffff880`06837a50 fffff880`06a613f3 : fffffa80`a2a77380 00000000`0dd77870 fffffa81`2386e960 fffffa80`63072610 : TSFairShare!TSFSContinuePendedIo+0xdd
    fffff880`06837aa0 fffff880`06a623f9 : fffffa81`2386e960 fffff880`06837b28 00000000`00000000 fffffa80`6375d070 : TSFairShare!CTSSchedulerMgr::ContinueProcessIo+0xcb
    fffff880`06837ad0 fffff880`06a6c0c1 : 081c1d19`00000000 fffff880`06837be0 fffff780`00000006 fffffa80`e2bf0980 : TSFairShare!CTSSchedulerMgr::ProcessNextWorkItem+0x175
    fffff880`06837b70 fffff880`06a5bc1e : 00000000`00000006 fffffa80`63072610 fffffa80`63072610 fffff880`02da5540 : TSFairShare!CTSSchedulerMgr::TSSchedulerWorkerThread+0xb9
    fffff880`06837be0 fffff803`fbab4fa9 : fffffa80`6306c5c0 fffff960`0013ea76 fffff901`00747550 fffff880`06837ec0 : TSFairShare!CTSSchedulerMgr::staticTSSchedulerWorkerThread+0x12
    fffff880`06837c10 fffff803`fbb69a36 : fffff880`02d99180 fffffa80`6306c5c0 fffff880`02da5540 fffffa80`61cda980 : nt!PspSystemThreadStartup+0x59
    fffff880`06837c60 00000000`00000000 : fffff880`06838000 fffff880`06832000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  TSFairShare!TSFSNotifyIoCompleted+78

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: TSFairShare

    IMAGE_NAME:  TSFairShare.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  5010aa56

    IMAGE_VERSION:  6.2.9200.16384

    STACK_COMMAND:  .cxr 0xfffff88006836fb0 ; kb

    BUCKET_ID_FUNC_OFFSET:  78

    FAILURE_BUCKET_ID:  AV_TSFairShare!TSFSNotifyIoCompleted

    BUCKET_ID:  AV_TSFairShare!TSFSNotifyIoCompleted

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:av_tsfairshare!tsfsnotifyiocompleted

    FAILURE_ID_HASH:  {958809dd-8a3c-99ca-13be-af7212106c61}

    Followup: MachineOwner
    ---------


    • Edited by Acreed02 Monday, November 2, 2015 1:22 PM
    Monday, November 2, 2015 1:22 PM
  • Eugene

    Are you by chance running a Citrix VPN? 

    This was related to TSFairShare.sys and is called a memory exception.  Think of fair share as load balancing the available resources.  It can be disabled.

    Some links describing it and how to disable

    http://virtualization.vanbragt.net/index.php/articles/general-articles/fairshare-of-resources-in-rd-session-host

    http://www.ryslander.com/disable-fair-sharing-in-windows-server/

    Microsoft (R) Windows Debugger Version 10.0.10563.566 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\102915-58062-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9200 MP (32 procs) Free x64
    Product: Server, suite: TerminalServer
    Built by: 9200.17438.amd64fre.win8_gdr.150713-1241
    Machine Name:
    Kernel base = 0xfffff803`fba88000 PsLoadedModuleList = 0xfffff803`fbd54a20
    Debug session time: Thu Oct 29 10:23:50.866 2015 (UTC - 5:00)
    System Uptime: 2 days 6:55:41.203
    Loading Kernel Symbols
    .
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    ..............................................................
    ................................................................
    ..............
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, fffff88006a589cc, fffff88006837778, fffff88006836fb0}
    
    Probably caused by : TSFairShare.sys ( TSFairShare!TSFSNotifyIoCompleted+78 )
    
    Followup:     MachineOwner
    ---------
    
    10: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88006a589cc, The address that the exception occurred at
    Arg3: fffff88006837778, Exception Record Address
    Arg4: fffff88006836fb0, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    SYSTEM_SKU:  070715D9
    
    SYSTEM_VERSION:  123456789
    
    BIOS_DATE:  11/08/2012
    
    BASEBOARD_PRODUCT:  X9QR7-TF+/X9QRi-F+
    
    BASEBOARD_VERSION:  123456789
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff88006a589cc
    
    BUGCHECK_P3: fffff88006837778
    
    BUGCHECK_P4: fffff88006836fb0
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    TSFairShare!TSFSNotifyIoCompleted+78
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4]
    
    EXCEPTION_RECORD:  fffff88006837778 -- (.exr 0xfffff88006837778)
    ExceptionAddress: fffff88006a589cc (TSFairShare!TSFSNotifyIoCompleted+0x0000000000000078)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000299a90
    Attempt to read from address 0000000000299a90
    
    CONTEXT:  fffff88006836fb0 -- (.cxr 0xfffff88006836fb0)
    rax=0000000000299a8c rbx=fffffa80e080f2c0 rcx=01d1125dd06f4bce
    rdx=fffffa80e080f2c0 rsi=fffffa812386e900 rdi=0000000000000000
    rip=fffff88006a589cc rsp=fffff880068379b0 rbp=fffff88006837a10
     r8=00000000c0000005  r9=0000000000000001 r10=00000000ffffffff
    r11=0000000000000000 r12=00000000c0000005 r13=fffffa8063072610
    r14=0000000000000000 r15=fffffa80e080f2c0
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    TSFairShare!TSFSNotifyIoCompleted+0x78:
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4] ds:002b:00000000`00299a90=??
    Resetting default scope
    
    CPU_COUNT: 20
    
    CPU_MHZ: 7d0
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 2d
    
    CPU_STEPPING: 7
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000299a90
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff803fbde0168
    Unable to get MmSystemRangeStart
     0000000000299a90 
    
    FOLLOWUP_IP: 
    TSFairShare!TSFSNotifyIoCompleted+78
    fffff880`06a589cc 8a4804          mov     cl,byte ptr [rax+4]
    
    BUGCHECK_STR:  AV
    
    ANALYSIS_VERSION: 10.0.10563.566 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff88006a584e5 to fffff88006a589cc
    
    STACK_TEXT:  
    fffff880`068379b0 fffff880`06a584e5 : fffff880`06a5be1c fffff880`06a5d6d0 00000000`c0000005 fffff880`06a5d700 : TSFairShare!TSFSNotifyIoCompleted+0x78
    fffff880`06837a50 fffff880`06a613f3 : fffffa80`a2a77380 00000000`0dd77870 fffffa81`2386e960 fffffa80`63072610 : TSFairShare!TSFSContinuePendedIo+0xdd
    fffff880`06837aa0 fffff880`06a623f9 : fffffa81`2386e960 fffff880`06837b28 00000000`00000000 fffffa80`6375d070 : TSFairShare!CTSSchedulerMgr::ContinueProcessIo+0xcb
    fffff880`06837ad0 fffff880`06a6c0c1 : 081c1d19`00000000 fffff880`06837be0 fffff780`00000006 fffffa80`e2bf0980 : TSFairShare!CTSSchedulerMgr::ProcessNextWorkItem+0x175
    fffff880`06837b70 fffff880`06a5bc1e : 00000000`00000006 fffffa80`63072610 fffffa80`63072610 fffff880`02da5540 : TSFairShare!CTSSchedulerMgr::TSSchedulerWorkerThread+0xb9
    fffff880`06837be0 fffff803`fbab4fa9 : fffffa80`6306c5c0 fffff960`0013ea76 fffff901`00747550 fffff880`06837ec0 : TSFairShare!CTSSchedulerMgr::staticTSSchedulerWorkerThread+0x12
    fffff880`06837c10 fffff803`fbb69a36 : fffff880`02d99180 fffffa80`6306c5c0 fffff880`02da5540 fffffa80`61cda980 : nt!PspSystemThreadStartup+0x59
    fffff880`06837c60 00000000`00000000 : fffff880`06838000 fffff880`06832000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  TSFairShare!TSFSNotifyIoCompleted+78
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: TSFairShare
    
    IMAGE_NAME:  TSFairShare.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5010aa56
    
    IMAGE_VERSION:  6.2.9200.16384
    
    STACK_COMMAND:  .cxr 0xfffff88006836fb0 ; kb
    
    BUCKET_ID_FUNC_OFFSET:  78
    
    FAILURE_BUCKET_ID:  AV_TSFairShare!TSFSNotifyIoCompleted
    
    BUCKET_ID:  AV_TSFairShare!TSFSNotifyIoCompleted
    
    PRIMARY_PROBLEM_CLASS:  AV_TSFairShare!TSFSNotifyIoCompleted
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:av_tsfairshare!tsfsnotifyiocompleted
    
    FAILURE_ID_HASH:  {958809dd-8a3c-99ca-13be-af7212106c61}
    
    Followup:     MachineOwner
    ---------
    



    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)


    Monday, November 2, 2015 1:26 PM
    Moderator
  • We are running a VPN over our UNTANGLED Firewall, but im not sure if it is a Citrix VPN.
    Monday, November 2, 2015 1:32 PM
  • As Acreed02 suggest you may want to run driver verifier to find out if there is an underlying problem causing TSFS to crash.  Verifier should make the system crash when the underling (and mis-behaving) driver is loaded so if this is a productions server make sure it is not active at the time.

    I only asked about Citrix because in reading about TSFS There is a quite a few related to Citrix


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Monday, November 2, 2015 2:32 PM
    Moderator