+ Post New Thread
Results 1 to 6 of 6
Windows Thread, event id 1004 in Technical; HI Please can some one help me. Our domain has been upgraded from windows 2003 to windows 2008 and now ...
  1. #1
    ricki's Avatar
    Join Date
    Jul 2005
    Location
    uk
    Posts
    1,475
    Thank Post
    20
    Thanked 164 Times in 157 Posts
    Rep Power
    52

    event id 1004

    HI

    Please can some one help me.

    Our domain has been upgraded from windows 2003 to windows 2008 and now we have random machines rebooting at logon on. They appear to come out with this error

    client eventid 1004

    Faulting application winlogon.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x00010b2c.
    ---------------------------------------

    All out clients are on windows xp. It appears to be totally random through out the school different machines. Different Ghost images, different switches. It might reboot at a logon now and not do it again all day.

    We have sniffed the network and found 4 broken switches and have fixed machines spitting out corrup packets and machines with spyware. We have tried updating drivers for machines including nic cards but I have no ideas what causing this or how to find whats causing this has anyone got any ideas.

    Richard

  2. #2
    ricki's Avatar
    Join Date
    Jul 2005
    Location
    uk
    Posts
    1,475
    Thank Post
    20
    Thanked 164 Times in 157 Posts
    Rep Power
    52
    HI

    I have managed to get some of the dump files from bginfo see below

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\technician\errors domain\client\Bginfo.exe.hdmp]
    User Mini Dump File: Only registers, stack and portions of memory are available

    Symbol search path is: *** Invalid ***
    ************************************************** **************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ************************************************** **************************
    Executable search path is:
    Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    Machine Name:
    Debug session time: Wed Dec 1 14:47:07.000 2010 (UTC + 0:00)
    System Uptime: not available
    Process Uptime: 0 days 0:00:04.000
    .................................................. ....
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (c70.c74): Access violation - code c0000005 (first/second chance not available)
    eax=c0000005 ebx=80070000 ecx=0012bb98 edx=00000000 esi=000005a0 edi=00000000
    eip=7c90e514 esp=00129a28 ebp=00129a8c iopl=0 nv up ei ng nz ac pe cy
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
    Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntdll.dll
    *** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
    ntdll+0xe514:
    7c90e514 c3 ret


    Has anyone got an idea how I fix this.

    Richard

  3. #3
    ricki's Avatar
    Join Date
    Jul 2005
    Location
    uk
    Posts
    1,475
    Thank Post
    20
    Thanked 164 Times in 157 Posts
    Rep Power
    52
    HI

    This is the second dump file

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\technician\errors domain\client\winlogon.exe.20110124-112714-00.hdmp]
    User Mini Dump File: Only registers, stack and portions of memory are available

    Symbol search path is: *** Invalid ***
    ************************************************** **************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ************************************************** **************************
    Executable search path is:
    Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    Machine Name:
    Debug session time: Mon Jan 24 11:27:17.000 2011 (UTC + 0:00)
    System Uptime: not available
    Process Uptime: 0 days 1:10:55.000
    .................................................. ..............
    .......................................
    Loading unloaded module list
    ................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (2a4.2a8): Access violation - code c0000005 (first/second chance not available)
    eax=c0000005 ebx=80070000 ecx=00069898 edx=00000000 esi=000009fc edi=00000000
    eip=7c90e514 esp=00067728 ebp=0006778c iopl=0 nv up ei ng nz ac pe cy
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
    ntdll!KiFastSystemCallRet:
    7c90e514 c3 ret

  4. #4
    ricki's Avatar
    Join Date
    Jul 2005
    Location
    uk
    Posts
    1,475
    Thank Post
    20
    Thanked 164 Times in 157 Posts
    Rep Power
    52
    Hi

    Has anyone any ideas what I can try?

    Richard

  5. #5
    Cools's Avatar
    Join Date
    Jan 2009
    Location
    Bedfordshire
    Posts
    498
    Thank Post
    24
    Thanked 62 Times in 57 Posts
    Rep Power
    25
    i have the same problem... random reboots.. since upgrade to 2008 " tell the teachers its system upgrades and i cant stop it from happening" not got around to finding the fault.

  6. #6
    ricki's Avatar
    Join Date
    Jul 2005
    Location
    uk
    Posts
    1,475
    Thank Post
    20
    Thanked 164 Times in 157 Posts
    Rep Power
    52
    HI

    I wish I could all the reboots are corrupting data on the hard drive and I am having to rebuild machines like they are going out of fashion.

    I need to find a solution as quilckly as I can.

    We have tried the following up to now.

    Update drivers on clients and servers
    Update firmware on bios on clients and firmware on network cards on server
    Server motherboard replaced /nic
    Have run network monitoring tools and have found and removed spyware, and corrupt hardware ie client machines with broken hardware or software
    Have upgraded sophos to latest version
    Have clecked all physical wires for loops
    Have run network supervisor and put spannig tree on all switches.
    Have spent hours looking for group policy path errors
    Have had a network wiring company and a repair company in but have still no answer and am runing out of ideas.

    We have found a switch which is conflicting and have reset it and flashed it and cannot fix and am waiting for a replacement.

    This one is a real pain.

    Richard

SHARE:
+ Post New Thread

Similar Threads

  1. Event ID 12294
    By mattx in forum Windows Server 2000/2003
    Replies: 2
    Last Post: 30th March 2010, 09:10 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •