none
Windows Server 2008 R2 0x000000AB Bugcheck after applying KB4088875 and KB4072650 RRS feed

  • Question

  • We have a Windows 2008 R2 SP1 server that started crashing on Monday after applying KB4088875 and the Hyper V Update KB4072650.  It reboots with a 0x000000AB bugcheck randomly after a random user logs out.

    It is only happening to a single RDS server in the farm and is sporadic. Anyone else having this issue?

    It is a Hyper-V VM Guest.

    Monday, March 19, 2018 10:31 PM

Answers

  • I applied the May 2018 rollup patch (KB4103718) AND the latest BIOS update for the underlying host server. We have been stable for the last 8 hours, which is a recent record in this environment.

    • Marked as answer by Steve Ravida Thursday, May 10, 2018 8:57 PM
    Wednesday, May 9, 2018 8:46 PM

All replies

  • Hi,

    Try check the followinglinks:

    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a Remote Desktop Services session in Windows Server 2008 R2


    Please don't forget to mark the correct answer, to help others who have the same issue. Thameur BOURBITA MCSE | MCSA My Blog : http://bourbitathameur.blogspot.fr/

    Monday, March 19, 2018 10:46 PM
  • The known issues are described here and some of them include BSOD: https://support.microsoft.com/en-us/help/4088875/windows-7-update-kb4088875

    Have you tried to uninstall this KB to see if that helps? In general, I would advise to leave two/three weeks for patches before applying them to production, except those needed for emergency patching. This allows enough time to identify issues and rectify them before pushing to production.


    This posting is provided AS IS with no warranties or guarantees , and confers no rights.

    Ahmed MALEK

    My Website Link

    My Linkedin Profile

    My MVP Profile

    Monday, March 19, 2018 11:41 PM
  • Unfortunately, this hotfix was released in 2011 and is not applicable. We tried it and one released in 2012.
    Tuesday, March 20, 2018 11:09 AM
  • Yes, we uninstalled the patch on the affected server last night. I am going to monitor it today. The strange part is this is the only server exhibiting the issue.
    Tuesday, March 20, 2018 11:11 AM
  • Hello,

    we have the same issue here since 15.03.18. The server crashed 5 times so far. There must be a bug in this patch. We have not installed the 

    KB4072650

    Greetings

    René Schlacht


    • Edited by Senergy10 Tuesday, March 20, 2018 11:28 AM
    Tuesday, March 20, 2018 11:27 AM
  • KB4072650 is for Hyper-V components only. I included it for reference.

    KB4088875 is the issue.

    Tuesday, March 20, 2018 4:25 PM
  • Thank you, this was happening to one of my servers as well.  I have uninstalled this update.  I will it if the issue goes away.
    Wednesday, March 21, 2018 12:49 AM
  • I have seen other threads for machines experiencing BSODs after installing KB4088875. I am writing this as this seems to be a frequently asked question now.

    This posting is provided AS IS with no warranties or guarantees , and confers no rights.

    Ahmed MALEK

    My Website Link

    My Linkedin Profile

    My MVP Profile

    Wednesday, March 21, 2018 1:11 AM
  • I've seen the same problem on two of our customers' terminal servers running Windows Server 2008 R2.

    In all three cases I've seen (two crashes on one server, one crash on another, the following has always shown up in NirSoft BlueScreenView:

    Bug check string: SESSION_SESSION_HAS_VALID_POOL_ON_EXIT
    Bug check code: 0x000000ab
    Caused by driver: ntoskrnl.exe
    Caused by address ntoskrnl.exe+a53a0

    Parameters 1-4 vary, but the above have always been the same where I've seen this issue.

    On both these servers, I will uninstall KB4088875. I will make another post if uninstalling this patch did not resolve the issue for me.

    My procedure for this:

    0. Ensure you have the ability to connect to the server through console (NOT RDP)

    1. "chglogon /disable" to prevent new user logins.

    2. Contact all users, instruct them to save all work, and disconnect WITHOUT LOGGING OUT of the terminal server. (Because logoffs trigger this crash bug!)

    3. Reboot the server! (This part is important to do *before* uninstalling the update, since RDP logoffs trigger this bug. You don't want your server bluescreening in the middle of an uninstall...)

    4. "wusa /uninstall /kb:4088875" to uninstall the problematic update.

    5. Reboot.

    6. "chglogon /enable" to allow new user logins.

    To anyone experiencing this issue: What antivirus software are you running? We're running Trend Micro. I'm just looking to see if antivirus might be a commonality here.

    • Edited by pv2b Wednesday, March 21, 2018 7:47 AM
    • Proposed as answer by kpaulu1991 Thursday, March 22, 2018 6:42 AM
    Wednesday, March 21, 2018 7:36 AM
  • Hi,

    How things are going there on this issue? Will it work to uninstall specific update?

    Please let me know if you would like further assistance.

    Best Regards,
    Eve Wang

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, March 21, 2018 7:58 AM
    Moderator
  • Hello,

    We experience the same problemen with different servers. we're running a different AV

    the servers have all the same update installed, i will check if this uninstall works.

    thanks


    • Edited by kpaulu1991 Wednesday, March 21, 2018 8:15 AM
    Wednesday, March 21, 2018 8:01 AM
  • Yes, uninstalling the patch corrects the issue. I highly recommend it for Win2008 R2 Terminal Servers.
    Wednesday, March 21, 2018 2:29 PM
  • Hi,

    For now uninstalling the update en restart the server did the job.

    Regards.

    Wednesday, March 21, 2018 3:53 PM
  • I think this is related, though I haven't seen anyone else talk about client devices having 0x000000AB bugchecks after KB4088875 or KB4088878 is installed.

    I have four Windows 7 (64-bit) machines this week that have had a bugcheck code of 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT) when users log out. According to BlueScreenView, these are all caused by ntoskrnl.exe

    These computers do have KB4088875 & KB4088878 installed.

    All the machines are 64-bit and support SSE2, so this seems different than the stop errors mentioned in the two KBs.

    Thankfully, we don't automatically approve updates for our servers, only for our computers.

    Wednesday, March 21, 2018 4:08 PM
  • Yes, uninstalling the patch corrects the issue. I highly recommend it for Win2008 R2 Terminal Servers.

    Which patch are you talking about? KB4088875 or KB4088878? Or both?

    The reason i'm asking is, we also have issues with rebooting servers and last night uninstalled KB4088875. <strike>But it's still rebooting.</strike>;
    Update: Patch 
    KB4088875 was still on the server. Tonight i will uninstall and let you know the outcome.



    Thursday, March 22, 2018 11:47 AM
  • We only uninstalled  KB4088875 and thats working for now.
    Thursday, March 22, 2018 12:43 PM
  • I also uninstalled KB4099975 yesterday and it has already blue screen twice since. Uninstalling KB4088878 now.
    Thursday, March 22, 2018 12:48 PM
  • I also uninstalled KB4099975 yesterday and it has already blue screen twice since. Uninstalling KB4088878 now.
    Same.  I have multiple terminal servers that are still BSOD'ing with 0x50 error codes after removing 4088875.  It's the kernel that's causing my crashes, and it looks like KB4074587 updated the kernel.  I'm kind of curious on that update as well....
    Thursday, March 22, 2018 2:32 PM
  • Oh what a mess.

    I just uninstalled 408875 + 408878 from our two 2008 R2 terminal servers and hoped this would stop having the BSODs when user log out (not every time, but quite often). But your posting redcuces this hope a bit.

    Did you also uninstall 408878?

    Since the updates we had the following BSODs:

    PAGE_FAULT_IN_NONAGED_AREA 0x50 code ntoskrnl.exe
    BAD_POOL_HEADER 0x19 code ntoskrnl.exe

    I have checked it. The ntoskrnl.exe was changed on March 9 within the update 408875.

    Update 4074587 was from February 13 and worked here without problems till this weekend, where we installed the March updates.

    The problem started with our DC non responding, because of the known (now! :-()) bug regarding virtual NICs.

    Thursday, March 22, 2018 10:06 PM
  • Microsoft, you're killing us  with these garbage,  obviously untested patch releases! Get your crap together!
    Sunday, March 25, 2018 5:49 PM
  • Thank you.

    AV Solution:
    Yeah it is TM WFBS 9.5.1443 here.

    Monday, March 26, 2018 8:35 AM
  • This is a link with similar problems:  https://social.technet.microsoft.com/Forums/en-US/4e38b454-ae9b-4930-9904-4d374fb29a45/bsod-0x000000ab-windows-2008-sp2-rds?forum=winserverTS

    If anyone want their computer environment troubleshooted this can be done by viewing logs and debugging dump files.

    Please open a separate thread and post the link into this thread.

    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, dxdiag, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There is 1 file for you to find manually:  memory dump file:

    C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results.

    Sometimes the dxdiag file needs to be found and saved manually:  In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    Please remember to mark the replies as answers if they help.

    Monday, March 26, 2018 8:59 AM
  • Same problem here !

    I've applied all recommended patch on one of our W2008 R2 RDS servers. 1 crash per day since then..

    I always apply patch on only one server, wait and see. That time it proved not to be over cautious.

    I was surprised that it always occurred at the end of the working hours. Seems truly to be linked with logoff.


    Uninstalling kb4088875.....



    • Edited by lolix2 Thursday, March 29, 2018 5:03 PM
    Thursday, March 29, 2018 4:50 PM
  • Running 2008 R2 and having same issue. Running Trend Micro and XenApp 7.5. Was super stable before this update. Uninstalling tonight.
    Thursday, March 29, 2018 7:25 PM
  • Microsoft has released an update to fix this 0xAB bugcheck on Windows 7 and 2008 R2. (I haven't tested it yet.)

    https://support.microsoft.com/en-us/help/4099467/stop-error-0xab-when-you-log-off-a-windows-7-sp1-or-windows-server-200 


    • Edited by j_dennis Friday, March 30, 2018 2:37 AM
    Friday, March 30, 2018 2:35 AM
  • going to test this update that supposedly fixes this
    Friday, March 30, 2018 3:25 AM
  • There was a recent Microsoft update for a similar problem dated March 29, 2018:

    https://support.microsoft.com/en-us/help/4099467/stop-error-0xab-when-you-log-off-a-windows-7-sp1-or-windows-server-200

    Friday, March 30, 2018 9:31 AM
  • I have the same issue since 20 march. One reboot per day after. I don't have update who have problem :

    systeminfo | find /i "KB408"
               [238]: KB4089187
               [244]: KB4088881

    I installed update KB4099467 :"https://support.microsoft.com/en-us/help/4099467/stop-error-0xab-when-you-log-off-a-windows-7-sp1-or-windows-server-200" today.

    I wait if i have the same probem today.

    My antivirus is sophos

    This update solve the problem for you ?

    Monday, April 2, 2018 8:33 AM
  • How did you go ? 

    We also have the KB4088881 and KB4100480 updates installed and recently had a BSOD on two RDS.

    -BAD_POOL_HEADER

    -SESSION_HAS_VALID_POOL_ON_EXIT

    Thursday, April 5, 2018 4:54 AM
  • problem solve after applying :
    Question

    https://support.microsoft.com/en-us/help/4099467/stop-error-0xab-when-you-log-off-a-windows-7-sp1-or-windows-server-200

    Thursday, April 5, 2018 5:30 AM
  • uninstalled kb4088875 solved the problem.

    I stopped patching patch patching the patch patching the patch.What for ? Vulnerability, yes but what threat ?

    Waiting for things to stabilize.

    https://www.theregister.co.uk/2018/04/03/microsoft_windows_meltdown_patch_saga/
    Thursday, April 5, 2018 6:26 AM
  • The April patches cause the issue again. Same bugcheck, same problem. Rolling off the April patches now...

    Hopefully Microsoft can get this solved permanently sometime soon.

    Monday, April 16, 2018 11:09 PM
  • The April patches cause the issue again. Same bugcheck, same problem. Rolling off the April patches now...

    Hopefully Microsoft can get this solved permanently sometime soon.


    Did you not try to manually apply https://support.microsoft.com/en-us/help/4099467/stop-error-0xab-when-you-log-off-a-windows-7-sp1-or-windows-server-200 as found in the MS Update Catalog?

    We ran patches last night for all our customers (too early to say if this problem will recur or not) but we also deployed KB4099467 as well. It is not published in Windows Update as far as I can tell, you have to go looking for it manually.

    We installed that hotfix after running the updates, so I know that the hotfix has not been superseded as of now.
    • Edited by pv2b Tuesday, April 17, 2018 5:39 AM
    Tuesday, April 17, 2018 5:38 AM
  • Yes, April's patches actually supercede KB4099467. I've applied that patch, and the issues persist. I've removed the March and April rollups, then reapplied the patch, and the problems persist.

    Removing March and April rollups, AND removing KB4099467 restored stability.

    Whatever the issue is, it appears to be in Win32k.sys versions greater than 6.1.7601.24023. I don't know if the issue is being caused by code in Win32k.sys, but that's the file I've been using for version checks.

    Tuesday, April 17, 2018 2:45 PM
  • Yes, April's patches actually supercede KB4099467. I've applied that patch, and the issues persist. I've removed the March and April rollups, then reapplied the patch, and the problems persist.

    Removing March and April rollups, AND removing KB4099467 restored stability.

    Whatever the issue is, it appears to be in Win32k.sys versions greater than 6.1.7601.24023. I don't know if the issue is being caused by code in Win32k.sys, but that's the file I've been using for version checks.

    Strange. Just last night we brought all our servers up to date with newest updates and then installed KB4099467 at the very end. It did not complain about the hotfix being not applicable, which is typically what happens when an update is superseded.

    I don't want to say you're wrong, just that we've had different experiences on this, which I can't really explain.


    • Edited by pv2b Tuesday, April 17, 2018 2:50 PM
    Tuesday, April 17, 2018 2:49 PM
  • I agree. I verified this in a test environment after rolling the patches off of the production equipment.

    All of the files in KB4099467 are replaced with newer versions in the April 2018 rollup. I've tried every possible configuration of April roll up on/off, March roll up on/off, KB4099467 on/off, etc. and the only stable configuration is March, April and KB4099467 patches off.

    Tuesday, April 17, 2018 8:29 PM
  • I agree. I verified this in a test environment after rolling the patches off of the production equipment.

    All of the files in KB4099467 are replaced with newer versions in the April 2018 rollup. I've tried every possible configuration of April roll up on/off, March roll up on/off, KB4099467 on/off, etc. and the only stable configuration is March, April and KB4099467 patches off.

    I encounter exactly the same situation on an RDS server: March patches uninstalled due to the mentioned problem. Those of April tested then ditto so I tried the patch KB4099467 and still the same bug. I uninstalled those of April leaving the KB4099467 => same problem! This morning I removed the latter, hoping that the situation finally stabilizes ... Until the patches of May!
    Wednesday, April 18, 2018 7:02 AM
  • I agree. I verified this in a test environment after rolling the patches off of the production equipment.

    All of the files in KB4099467 are replaced with newer versions in the April 2018 rollup. I've tried every possible configuration of April roll up on/off, March roll up on/off, KB4099467 on/off, etc. and the only stable configuration is March, April and KB4099467 patches off.

    I can confirm this, I just ran into a bluescreen on a customer terminal server after applying these patches. Looks like we're going to have to roll both March and April back.

    Wednesday, April 18, 2018 8:15 AM
  • I agree. I verified this in a test environment after rolling the patches off of the production equipment.

    All of the files in KB4099467 are replaced with newer versions in the April 2018 rollup. I've tried every possible configuration of April roll up on/off, March roll up on/off, KB4099467 on/off, etc. and the only stable configuration is March, April and KB4099467 patches off.

    Just out of curiosity, what kind of test methodology do you use to quickly verify whether the problem is present/absent? The problem happens sporadically after all, how do you trigger it reliably?
    Wednesday, April 18, 2018 8:24 AM
  • Unfortunately, the test methodology isn't perfect because I cannot reproduce it consistently. I have a AutoIt script logging in a normal user, open a few apps, and log out. Repeat. Repeat. Repeat.

    It takes between 3-7 hours for it to crash the server. If I run the same script without the patches applied, it never crashes.

    It took me a minute to put it all together and realize that Microsoft actually released a patch which causes the exact issue it was intended to correct.

    Wednesday, April 18, 2018 4:28 PM
  • I've tried all of the attempts from previous posts and still have one server crashing every day around 4:00 PM when many users logoff.  All updates removed from March and April roll ups.  The Microsoft fixes never changed any of the symptoms for us.  We did go 7 days without a crash between April 5th and April 12th.  Not sure if it was just a coincidence but the crashes have been right on 4:00 PM since then.  
    Thursday, April 19, 2018 12:22 PM
  • Check your version of Win32k.sys. Make sure it is less than or equal to 6.1.7601.24023 (Win 2008 R2 SP1, x64). That seems to be the latest known stable version.
    Thursday, April 19, 2018 3:56 PM
  • Unfortunately, the test methodology isn't perfect because I cannot reproduce it consistently. I have a AutoIt script logging in a normal user, open a few apps, and log out. Repeat. Repeat. Repeat.

    It takes between 3-7 hours for it to crash the server. If I run the same script without the patches applied, it never crashes.

    It took me a minute to put it all together and realize that Microsoft actually released a patch which causes the exact issue it was intended to correct.

    I've done something similar now on a clone of an affected server.

    What I ended up doing:

    - Clone the affected terminal server
    - Set up a test user
    - Set up the profile of the test user to launch 3 programs through the autostart start menu folder, and also dropped a script that forcelogs off after 20 seconds
    - Made an .RDP file that when clicked connects with these saved credentials
    - Make a BAT file to run mstsc on that .RDP file in a loop

    Let's see if I can get a reliable reproduction of this. I've just had it running for like 15 minutes, no crashes yet, but that's to be expected. The goal is to generate a full memory dump to send to MS.

    I've also opened a support ticket with Microsoft about this, to see if we can get some traction on this. I've already tried wait-and-see without much results.


    • Edited by pv2b Tuesday, April 24, 2018 1:13 PM
    Tuesday, April 24, 2018 1:12 PM
  • I have the same problem. Which Win32k.sys do i have to change? I have more than one of them on the hard drive...
    Wednesday, April 25, 2018 6:23 AM
  • I also have a server 2008 r2 with this problem. Windows Update Match and April are uninstalled and also i installed the hotfix KB4088875.

    But the prblem is the same. Anybody another idea?

    Wednesday, April 25, 2018 6:26 AM
  • Hi Sven Otto,

    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, dxdiag, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There is 1 file for you to find manually:  memory dump file:

    C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results.

    Sometimes the dxdiag file needs to be found and saved manually:  In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    Please remember to mark the replies as answers if they help.

    Wednesday, April 25, 2018 6:30 AM
  • Hi.

    This is the failure:

    ==================================================
    Dump File         : 042418-37892-01.dmp
    Crash Time        : 24.04.2018 16:29:42
    Bug Check String  : SESSION_HAS_VALID_POOL_ON_EXIT
    Bug Check Code    : 0x000000ab
    Parameter 1       : 00000000`00000006
    Parameter 2       : 00000000`00000300
    Parameter 3       : 00000000`00000000
    Parameter 4       : 00000000`00000010
    Caused By Driver  : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+a53a0
    File Description  : NT Kernel & System
    Product Name      : Microsoft® Windows® Operating System
    Company           : Microsoft Corporation
    File Version      : 6.1.7601.24059 (win7sp1_ldr_escrow.180308-1637)
    Processor         : x64
    Crash Address     : ntoskrnl.exe+a53a0
    Stack Address 1   : 
    Stack Address 2   : 
    Stack Address 3   : 
    Computer Name     : 
    Full Path         : C:\Windows\Minidump\042418-37892-01.dmp
    Processors Count  : 6
    Major Version     : 15
    Minor Version     : 7601
    Dump File Size    : 290.064
    Dump File Time    : 24.04.2018 16:31:38
    ==================================================

    It always appears, if random people log off from terminalserver. Then the server resatarts...

    Wednesday, April 25, 2018 6:39 AM
  • Viewing a txt is very limited unless the misbehaving driver is displayed in the txt.  Most often debugging with windbg is needed to find misbehaving drivers or hardware.  If the problem is related to a Windows update there may be no benefit of the debugging as debugging is done to find non-Microsoft drivers or malfunctioning hardware.  If you post the mini dump, and memory dump files they can be debugged with the collected files.

    With the files the debugger commands can be run to see if there is misbehaving drivers or hardware.

    The log files ( msinfo32, dxdiag, drivers, hosts, install, uninstall, event viewer, etc. improves the troubleshooting.)

    Wednesday, April 25, 2018 6:50 AM
  • Here are the logs:

    https://www.dropbox.com/s/beqn879dbrcx1iz/MS-Infos.zip?dl=0

    Wednesday, April 25, 2018 10:09 AM
  • Hi Sven Otto,

    There were no mini or memory dump files posted for debugging in the link.

    There was no dxdiag.

    The link was in a foreign language.

    1) Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.h

    2) Re-run the administrative command prompt command to collect the log files > post 7zip

    3) Open file explorer > this PC > C: > in the right upper corner search for:

    a) c:\Windows\minidump

    b) C:\Windows\MEMORY.DMP

    4) In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread


    Event[39428]:
      Log Name: System
      Source: Microsoft-Windows-WER-SystemErrorReporting
      Date: 2018-04-24T16:31:38.000
      Event ID: 1001
      Task: N/A
      Level: Fehler
      Opcode: N/A
      Keyword: Klassisch
      User: N/A
      User Name: N/A
      Computer: W2K8-TERMINAL
      Description: 
    Der Computer wurde nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x000000ab (0x0000000000000006, 0x0000000000000300, 0x0000000000000000, 0x0000000000000010). Ein volles Abbild wurde gespeichert in: C:\Windows\MEMORY.DMP. Berichts-ID: 042418-37892-01.
    Wednesday, April 25, 2018 2:06 PM
  • Did you get anywhere with Microsoft?
    Saturday, May 5, 2018 1:04 AM
  • Not yet. I'll let the thread know once there are any significant developments.
    Saturday, May 5, 2018 8:37 AM
  • The latest development from Microsoft Support is a recommendation to:

    Have all security updates installed
    Install KB4093113 (Preview of Monthly Rollup, April 17, 2018)
    Uninstall KB4099467 (Stop error 0xAB when you log off a Windows 7 SP1 or Windows Server 2008 R2 SP1 session)

    I have not yet been able to confirm that this is a resolution, but I feel dubious. But it doesn't seem to hurt to have the latest quality updates, and to uninstall the KB that doesn't seem to resolve the issue anyway...

    The combo of all security updates + KB4093113 + KB4099467 is NOT stable in my environment.

    I'm going to be applying this to one customer server tonight, and I will get back to the thread if there are any crashes with this combination of patches.


    • Edited by pv2b Tuesday, May 8, 2018 10:42 AM
    Tuesday, May 8, 2018 10:41 AM
  • I applied the May 2018 rollup patch (KB4103718) AND the latest BIOS update for the underlying host server. We have been stable for the last 8 hours, which is a recent record in this environment.

    • Marked as answer by Steve Ravida Thursday, May 10, 2018 8:57 PM
    Wednesday, May 9, 2018 8:46 PM
  • Steve, Has your server restarted after the last update of May? Thanks
    Friday, May 11, 2018 12:18 PM
  • Hoping that the May patchs are solving the problem, because unpatched server will cause that problem :

    https://blogs.technet.microsoft.com/mckittrick/unable-to-rdp-to-virtual-machine-credssp-encryption-oracle-remediation/

    Monday, May 14, 2018 6:51 AM
  • No, we have been stable since the May update.
    Monday, May 14, 2018 3:00 PM
  • As an update, we yesterday saw a crash with the latest recommendation from Microsoft's support on this issue that I mentioned earlier.

    We have not yet deployed the May updates to this server.

    Wednesday, May 16, 2018 8:02 AM