none
BSOD mrxsmb20.sys on Windows 10 RRS feed

  • Question

  • We have recently deployed some new machines at our college. They are Lenovo Thinkstations. Some users are getting a blue screen that has a stop code of: RDR_FILE_SYSTEM and mrxsmb20.sys is what failed. In the event long is showing that is has rebooted from a bugcheck. I can send anyone the memory.dmp. Can someone please help? 
    Thursday, November 21, 2019 9:00 PM

All replies

  • Bug Check 0x27: RDR_FILE_SYSTEM

    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.

    b) dxdiag:  

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread
    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .

    Friday, November 22, 2019 2:43 AM
  • I just joined Technet yesterday and do not have permission to post links. Do you know how to get around that? 
    Friday, November 22, 2019 2:53 PM
  • Others had posted links by skipping spaces in link (deactivates the link)
    Friday, November 22, 2019 2:56 PM
  • I did not get any files from the cmd. But I have the mem dump file and dxdiag. Let me know if there is anything else i can try to get files for the cmd. Here you are: https://limestone0-my.sharepoint.com/:f:/g/personal/ rleggett_limestone_edu/EgSVdZHGrWlLmTrYnDyREeABLAyT0ZRFm9O9TjxD6EkoYQ?e=ePtpOm
    Friday, November 22, 2019 3:17 PM
  • When posting share links please use one drive, drop box, or google drive

    The administrative command prompt should collect many files.

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    Also run this command:

    md "%USERPROFILE%\Desktop\CollectedFiles"&wmic /output:"%USERPROFILE%\Desktop\CollectedFiles\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\CollectedFiles"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\CollectedFiles\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp" > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.txt"&del "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\CollectedFiles\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\CollectedFiles\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\CollectedFiles\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\CollectedFiles\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\Collected

    Friday, November 22, 2019 4:05 PM
  • I don't get anything back when I run these. I am running it as administrator. Are you able to view my memory.dmp file that i posted? its a one drive link. 
    Saturday, November 23, 2019 4:20 PM

  • Place the computer in clean boot:  

    https://www.tenforums.com/tutorials/41804-perform-clean-boot-windows-10-troubleshoot-software-conflicts.html

    List any antivirus and firewall software installed on the computer.

    The commands in the prior post should work (they are regularly used).

    The link that was posted displayed 404.

    The logs are needed for troubleshooting.

    Saturday, November 23, 2019 5:14 PM