Offline files (CSC service) keeps crashing


  • Hello

    We had a Windows 2003 server and Windows XP and 7 Pro SP1 clients who use offline files perfectly (files stored on a NAS).

    We acquired a new server hardware with Windows 2008 R2 and promoted it and made it the DNS server.

    Syncing Offline Files on Windows XP is still working perfectly; however, the Windows 7 clients are facing CSC service crashes. The moment Sync Center starts syncing, multiple services crash at the same time. Offline files then become "enabled but not active".

    Looking at Event Viewer, we can find the following errors:

    System Logs:

    We can find the follow series of errors:

    • The Windows Audio Endpoint Builder service terminated unexpectedly..
    • The Offline Files service terminated unexpectedly.
    • The Network Connections service terminated unexpectedly.
    • The Superfetch service terminated unexpectedly.
    • The Distributed Link Tracking Client service terminated unexpectedly.
    • The Remote Desktop Services UserMode Port Redirector service terminated unexpectedly.
    • The Desktop Window Manager Session Manager service terminated unexpectedly.
    • The WLAN AutoConfig service terminated unexpectedly.
    • The Portable Device Enumerator Service service terminated unexpectedly.

    Application Logs:

    "Faulting application name: svchost.exe_CscService, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1

    Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c8f9
    Exception code: 0xc0000374
    Fault offset: 0x00000000000c40f2
    Faulting process id: 0x1b30
    Faulting application start time: 0x01cde41cd5d950c9
    Faulting application path: C:\windows\System32\svchost.exe
    Faulting module path: C:\windows\SYSTEM32\ntdll.dll"

    Followed by

    "Version=1 EventType=APPCRASH EventTime=130011181819095480 ReportType=2 Consent=1 ReportIdentifier=62c17243-506e-11e2-af1e-d8d385110588 IntegratorReportIdentifier=62c17242-506e-11e2-af1e-d8d385110588 Response.type=4

    Sig[0].Name=Application Name


    Sig[1].Name=Application Version

    Sig[1].Value=6.1.7600.16385 Sig[2].Name=Application Timestamp Sig[2].Value=4a5bc100 Sig[3].Name=Fault Module Name Sig[3].Value=StackHash_0b9e Sig[4].Name=Fault Module Version Sig[4].Value=6.1.7601.17725 Sig[5].Name=Fault Module Timestamp Sig[5].Value=4ec49b60 Sig[6].Name=Exception Code Sig[6].Value=c0000374 Sig[7].Name=Exception Offset Sig[7].Value=000c380b DynamicSig[1].Name=OS Version DynamicSig[1].Value=6.1.7601. DynamicSig[2].Name=Locale ID DynamicSig[2].Value=1033 DynamicSig[22].Name=Additional Information 1 DynamicSig[22].Value=0b9e DynamicSig[23].Name=Additional Information 2 DynamicSig[23].Value=0b9e2f80ce9f0aad8c46ae8b85f0a8cc DynamicSig[24].Name=Additional Information 3 DynamicSig[24].Value=8c71 DynamicSig[25].Name=Additional Information 4 DynamicSig[25].Value=8c713712067e7c3a767942199f1e0431 UI[2]=C:\Windows\System32\svchost.exe

    UI[5]=Check online for a solution (recommended)

    UI[6]=Check for a solution later (recommended)

    UI[7]=Close UI[8]=Offline Files stopped working and was closed UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available. UI[10]=&Close LoadedModule[0]=C:\Windows\System32\svchost.exe LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll LoadedModule[2]=C:\Windows\system32\kernel32.dll LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll LoadedModule[4]=C:\Windows\system32\msvcrt.dll LoadedModule[5]=C:\Windows\SYSTEM32\sechost.dll LoadedModule[6]=C:\Windows\system32\RPCRT4.dll LoadedModule[7]=C:\Windows\system32\ole32.dll LoadedModule[8]=C:\Windows\system32\GDI32.dll LoadedModule[9]=C:\Windows\system32\USER32.dll LoadedModule[10]=C:\Windows\system32\LPK.dll LoadedModule[11]=C:\Windows\system32\USP10.dll LoadedModule[12]=C:\Windows\system32\IMM32.DLL LoadedModule[13]=C:\Windows\system32\MSCTF.dll LoadedModule[14]=c:\progra~1\hewlet~1\iam\bin\apshook.dll LoadedModule[15]=C:\Windows\system32\ADVAPI32.dll LoadedModule[16]=C:\Windows\system32\SHLWAPI.dll LoadedModule[17]=C:\Windows\System32\CRYPTBASE.dll LoadedModule[18]=c:\windows\system32\audiosrv.dll LoadedModule[19]=c:\windows\system32\POWRPROF.dll LoadedModule[20]=C:\Windows\system32\SETUPAPI.dll LoadedModule[21]=C:\Windows\system32\CFGMGR32.dll LoadedModule[22]=C:\Windows\system32\OLEAUT32.dll LoadedModule[23]=C:\Windows\system32\DEVOBJ.dll LoadedModule[24]=c:\windows\system32\MMDevAPI.DLL LoadedModule[25]=c:\windows\system32\PROPSYS.dll LoadedModule[26]=c:\windows\system32\AVRT.dll LoadedModule[27]=C:\Windows\system32\CLBCatQ.DLL LoadedModule[28]=c:\windows\system32\cscsvc.dll LoadedModule[29]=c:\windows\system32\USERENV.dll LoadedModule[30]=c:\windows\system32\profapi.dll LoadedModule[31]=C:\Windows\System32\pcwum.dll LoadedModule[32]=C:\Windows\System32\PeerDist.dll LoadedModule[33]=C:\Windows\System32\AUTHZ.dll LoadedModule[34]=C:\Windows\system32\taskschd.dll LoadedModule[35]=C:\Windows\System32\SspiCli.dll LoadedModule[36]=C:\Windows\System32\mstask.dll LoadedModule[37]=C:\Windows\WinSxS\ 5b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll LoadedModule[38]=C:\Windows\System32\CRYPTSP.dll LoadedModule[39]=C:\Windows\system32\rsaenh.dll LoadedModule[40]=C:\Windows\System32\RpcRtRemote.dll LoadedModule[41]=C:\Windows\System32\GPAPI.dll LoadedModule[42]=C:\Windows\System32\WTSAPI32.dll LoadedModule[43]=C:\Windows\System32\WINSTA.dll LoadedModule[44]=c:\windows\system32\uxsms.dll LoadedModule[45]=c:\windows\system32\wlansvc.dll LoadedModule[46]=C:\Windows\system32\CRYPT32.dll LoadedModule[47]=C:\Windows\system32\MSASN1.dll LoadedModule[48]=c:\windows\system32\bcrypt.dll LoadedModule[49]=c:\windows\system32\dsrole.dll LoadedModule[50]=C:\Windows\system32\SHELL32.dll LoadedModule[51]=c:\windows\system32\WLANMSM.DLL LoadedModule[52]=c:\windows\system32\WLANSEC.dll LoadedModule[53]=C:\Windows\system32\WS2_32.dll LoadedModule[54]=C:\Windows\system32\NSI.dll LoadedModule[55]=c:\windows\system32\OneX.DLL LoadedModule[56]=c:\windows\system32\eappprxy.dll LoadedModule[57]=c:\windows\system32\dhcpcsvc.DLL LoadedModule[58]=c:\windows\system32\IPHLPAPI.DLL LoadedModule[59]=c:\windows\system32\WINNSI.DLL LoadedModule[60]=c:\windows\system32\eappcfg.dll LoadedModule[61]=c:\windows\system32\wlgpclnt.dll LoadedModule[62]=c:\windows\system32\l2gpstore.dll LoadedModule[63]=c:\windows\system32\wlanutil.dll LoadedModule[64]=c:\windows\system32\SYSNTFY.dll LoadedModule[65]=c:\windows\system32\WinSCard.dll LoadedModule[66]=C:\Windows\System32\msxml6.dll LoadedModule[67]=C:\Windows\System32\secur32.dll LoadedModule[68]=C:\Windows\System32\credssp.dll LoadedModule[69]=C:\Windows\system32\kerberos.DLL LoadedModule[70]=C:\Windows\System32\cryptdll.dll LoadedModule[71]=C:\Windows\system32\WINTRUST.dll LoadedModule[72]=C:\Windows\system32\netcfgx.dll LoadedModule[73]=C:\Windows\system32\slc.dll LoadedModule[74]=C:\Windows\System32\devrtl.DLL LoadedModule[75]=c:\windows\system32\sysmain.dll LoadedModule[76]=c:\windows\system32\trkwks.dll LoadedModule[77]=C:\Windows\System32\ntmarta.dll LoadedModule[78]=C:\Windows\system32\WLDAP32.dll LoadedModule[79]=c:\windows\system32\wdi.dll LoadedModule[80]=C:\Windows\system32\PortableDeviceApi.dll LoadedModule[81]=c:\windows\system32\umrdp.dll LoadedModule[82]=c:\windows\system32\WINSPOOL.DRV LoadedModule[83]=C:\Windows\SYSTEM32\APPHLPDM.DLL LoadedModule[84]=C:\Windows\System32\wer.dll LoadedModule[85]=C:\Windows\System32\apphelp.dll LoadedModule[86]=C:\Windows\System32\portabledeviceconnectapi.dll LoadedModule[87]=C:\Windows\System32\printui.dll LoadedModule[88]=C:\Windows\System32\puiapi.dll LoadedModule[89]=C:\Windows\system32\cscobj.dll LoadedModule[90]=c:\windows\system32\netman.dll LoadedModule[91]=C:\Windows\System32\netshell.dll LoadedModule[92]=C:\Windows\System32\nlaapi.dll LoadedModule[93]=C:\Windows\System32\RASDLG.dll LoadedModule[94]=C:\Windows\System32\MPRAPI.dll LoadedModule[95]=C:\Windows\System32\RASAPI32.dll LoadedModule[96]=C:\Windows\System32\rasman.dll LoadedModule[97]=C:\Windows\System32\rtutils.dll LoadedModule[98]=C:\Windows\system32\hnetcfg.dll LoadedModule[99]=C:\Windows\system32\ATL.DLL LoadedModule[100]=C:\Windows\system32\wbem\wbemprox.dll LoadedModule[101]=C:\Windows\system32\wbemcomn.dll LoadedModule[102]=C:\Windows\system32\wbem\wbemsvc.dll LoadedModule[103]=C:\Windows\system32\wbem\fastprox.dll LoadedModule[104]=C:\Windows\system32\NTDSAPI.dll LoadedModule[105]=c:\windows\system32\pcasvc.dll LoadedModule[106]=c:\windows\system32\AEPIC.dll LoadedModule[107]=c:\windows\system32\sfc.dll LoadedModule[108]=c:\windows\system32\sfc_os.DLL LoadedModule[109]=c:\windows\system32\VERSION.dll LoadedModule[110]=c:\windows\system32\wevtapi.dll FriendlyEventName=Stopped working ConsentKey=APPCRASH AppName=Offline Files AppPath=C:\Windows\System32\svchost.exe"


    As an attempt to sort this problem we tried several options few of which are:

    1. flushing DNS on clients

    2. Updating network drivers

    3. sfc /scannow

    4. Virus and malware scan

    5. Rejoin the computer to domain

    6. Resetting offline files cache

    7. Clean boot

    Notes: users can go the shared folders and browse their content.

    What is really causing the problem!?

    Thank you

    • Editado zahr sábado, 29 de dezembro de 2012 15:54 Moved System Logs above application logs for clarity
    sábado, 29 de dezembro de 2012 15:52


  • Problem solved.

    It was due to having SyncConflictHandling with value of 3 in the registry, which was crashing the CSC service. Changing this to 0 or deleting the whole entry solves it.

    I am thinking that this could be a bug in Windows CSC service?


    • Marcado como Resposta zahr quinta-feira, 24 de janeiro de 2013 11:26
    quinta-feira, 24 de janeiro de 2013 11:26

Todas as Respostas

  • Hi,

    Just to be sure I understand correctly... the NAS holds the files...

    You have added a 2008 R2 DC to your existing domain or created a new domain from scratch?

    Is the NAS domain joined? What is the NAS model name? Does it have the latest firmware updates (what version)?

    Has there been any update in the domain/ forest functional level?

    Is the NAS now pointing to the new DC for authentication?

    Are the clients now pointing to the "new" DC for authentication?

    Any change in Group policy, maybe some WMI scoping?


    sábado, 29 de dezembro de 2012 16:25
  • Hello,

    Thank you for the reply.

    The NAS holds the files and is joined to the domain and can successfully see the users for folder permission. The same configuration we always had and we currently have in other domains. But regardless of the NAS; we tried to make offline files for folders located on the server (not NAS) and on the client computer itself, but same behavior applies.

    The new 2008 R2 was joined to the same domain then promoted. All replication took place successfully.

    Clients are supposed to be pointing to the new DC for authentication because, even when the old DC is offline, and when we make account changes on the new DC AD, the changes apply successfully.

    The Group Policy was replicated from the Windows 2003, we didn't change policies prior to having that problem.

    sábado, 29 de dezembro de 2012 20:56
  • Hi,

    I tried to search for this issue. Let's try to update CSC first. The symptom described here might not match your issue but it’s the latest update of CSC components:

    According to my research it could be caused by incorrect group policy settings so please check if there is any Offline Files related policy enabled. You could simply disable all Offline Files related policies and force an update on clients to see if issue still exists to make sure if it is the cause --- Or create a test OU with no Offline Files policy enabled and create an account for the testing.


    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact

    segunda-feira, 31 de dezembro de 2012 07:35
  • Hello Shaon,

    Thank  you for the reply.

    I tried the hotfix, it didn't change anything.

    I will try disabling all offline files related GPOs, and see what happens.


    segunda-feira, 31 de dezembro de 2012 12:45
  • So there are GPO's that automatically make folders offline?

    You could try to unlink/disable those GPOs temporarily and see if you can manually make the folder available offline from a win 7 client.

    Let us know if you can successfully manually make available offline one of the folders.


    segunda-feira, 31 de dezembro de 2012 16:34
  • Hello,

    The Folder Redirection GPO doesn't seems to have an effect also.
    I created a new OU with no folder redirection GPO applied to it, and moved the computer account to it. Then on the computer gpupdate /force, and then after the restart, tried to make a folder offline and sync it, same crash.

    It is worth nothing that we previously removed a computer from domain, and put it in workgroup instead, and then tried to make some shared folder offline, and still ended up with same crash.
    terça-feira, 1 de janeiro de 2013 21:30
  • By the way, we also tried to create a share on a computer belonging to a different domain.
    On one of the computers facing this problem (with all folder redirection and sync GPOs removed), we accessed that share and made one of its folder available offline (right click > make available offline). It went ok.

    However, as usual, when we went to sync center, or when we right click and sync that folder, the same crash happens again.

    It is worth noting that on some devices, when the sync commences, they are no longer reachable by network, then after couple of minutes, network access is back.
    sexta-feira, 4 de janeiro de 2013 19:23
  • Hello,

    Here is an update. We got computer that had never been joined to our domain before, and has a working offline files feature. We joined this computer to the domain, and tried to sync; CSC started crashing!

    • We removed the device from domain, still crashes.
    • We deleted CSC folder (after disabled offline files), still crashes.
    • We reset group policies while it was disjoined, still crashes.

    So basically a computer that used to have working CSC, started to face the same crash after joining our domain, and continues to face this after removing it from the domain, despite resetting GPOs. So is there some sort of corruption taking place when computers join our domain?

    quarta-feira, 9 de janeiro de 2013 20:20
  • Problem solved.

    It was due to having SyncConflictHandling with value of 3 in the registry, which was crashing the CSC service. Changing this to 0 or deleting the whole entry solves it.

    I am thinking that this could be a bug in Windows CSC service?


    • Marcado como Resposta zahr quinta-feira, 24 de janeiro de 2013 11:26
    quinta-feira, 24 de janeiro de 2013 11:26
  • Thanks for posting the solution! It seems that ms has even an article on this setting:

    quinta-feira, 24 de janeiro de 2013 11:33
  • Yes, we've been to this article, but it isn't related directly to solving the the problem that we faced as it describes another problem.
    domingo, 27 de janeiro de 2013 14:46