none
Windows 2012 - Repeated BSOD bugcheck 0x00000018 by ntoskrnl.exe RRS feed

  • Question

  • I am recently seeing a Dell R730 server running Windows 2012 that has been stable for years now begin to experience BSOD (bluescreenview shows almost all from ntoskrnl.exe (+165da3 +[xyzpicksomething]).

    Event Viewer as always has nothing useful

    >The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000018 (0x0000000000000000, 0xffffe800978e2080, 0x0000000000000010, 0x0000000000000001). 

    Unfortunately, I do not have any machines readily available to install the windows sdk and all the related packages to attempt to analyze the dmp file and I am unable to find any hardware faults.  Memory tested several times both basic, extensive and exhaustive versions; dell lifecycle test also shows all other hardware as green.  Yet, this has gone from a once a month to a every few day occurrence. 

    Is there any possibility someone could help me identify the cause of this?

    Mini dump available for review at

    https://drive.google.com/file/d/1foM1f3cFo2ra3qBEISkaVnBQefWSrbg7/view?usp=sharing

    Thank you in advance, to anyone that would be able and willing to lend some insight.

    Monday, April 22, 2019 10:29 PM

All replies

  • The bugcheck was 18.

    There was no misbehaving driver seen in the crash.

    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    Choose the applicable link for the operating system:
    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html
    https://www.eightforums.com/threads/language-add-or-remove-in-windows-8.5849/
    https://www.sevenforums.com/tutorials/87317-display-language-change.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.

    b) dxdiag:  

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread
    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .

    Monday, April 22, 2019 11:41 PM
  • Hi,

     

    The REFERENCE_BY_POINTER bug check has a value of 0x00000018. This indicates that the reference count of an object is illegal for the current state of the object.

     

    To solve this issue, please make sure that the driver matches calls to the routines that increase and decrease the reference count of the object. Make sure that your driver does not make extra calls to routines that dereference the object (see Parameter 2).

     

    You can use a debugger to help analyze this problem. For more information, see Crash dump analysis using the Windows debuggers (WinDbg). The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.

     

    For more information, please read the following link:

    Bug Check 0x18: REFERENCE_BY_POINTER

    https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x18--reference-by-pointer

     

    Meanwhile, please check this link to download hotfix:

    "0x00000018" Stop error when volumes are mounted in Windows Server 2012 R2 or Windows Server 2012

    https://support.microsoft.com/en-us/help/2973052/0x00000018-stop-error-when-volumes-are-mounted-in-windows-server-2012

     

    Please understand that from our professional level, we do not provide dump analysis. If this problem is more urgent for you I still recommend that you open a case to Microsoft for further professional help.

     

    Hope these are helpful. If you have any question, please feel free to let me know.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, April 23, 2019 6:25 AM
    Moderator
  • We regularly help OP with BSOD in Technet.

    Our sister website, Microsoft Answers, also provides this help routinely.

    If it is server related Microsoft Answers typically refers to Microsoft Technet.


    Tuesday, April 23, 2019 7:50 AM
  • Hi RP-TKC.

    The 0x00000018 (REFERENCE_BY_POINTER) bug check indicates that the reference count of an object is illegal for the current state of the object.
    The memory dump file is pointing to the 
    rdbss.sys (the Microsoft Redirected Drive Buffering SubSystem Driver) file as the responsible. Did you make any change after which the problem started to occur?
    Check the integrity of the operating system files by opening an administrative command prompt and executing the sfc /scannow command; restart the system after completing the check.

    Bye.


    Luigi Bruno
    MCP, MOS, MTA, MCTS, MCSA, MCSE

    Tuesday, April 23, 2019 8:18 AM
  • Hi,

    Was your issue solved?

    If yes, would you like to share your solution in order that other community members could find the helpful reply quickly.

    If no, please reply and tell us the current situation in order to provide further help.

    Best


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 26, 2019 7:05 AM
    Moderator
  • Any update?

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, April 30, 2019 6:12 AM
    Moderator