Server 2019 VM BSOD on VMware ESX

[J_Worth]

Hello everyone,

 

I have recently started to provide support to a small secondary school. They have a Server 2019 VM running on ESX and it's just started to Blue Screen. The VM is running the school's RD Gateway.

 

 

The BSODs are either SYSTEM_SERVICE_EXCEPTION or ATTEMPTED_WRITE_TO_READONLY_MEMORY and it also shows NTFS.sys.

 

Has anyone else come across this before and if so, how did you go about resolving it?

 

Many thanks in advance.

[highsky]

No recent snapshot?

 

Windows Defender maybe:

 

https://docs.microsoft.com/en-us/answers/questions/351137/attempted-write-to-readonly-memory-what-failed-ntf.html

[J_Worth]

Unfortunately not. The VM has been running for a while without any issues. It started to play up at the start of the week - same time as the school's old IT Support contract finished (coincidence?)!

 

I'll take a look at Windows Defender and see if that's the cause.

 

Many thanks.

[Jcx500]

Try re-installing VMware tools could be a driver issue.

 

Another idea is to revert previous windows update

Edited June 3, 2021 by Jcx500

[3s-gtech]

Those issues tend to fit with memory errors, though the server tools/diagnostics should have shown that.

[J_Worth]

Thanks all for the responses. I've reinstalled VMware Tools to no avail. I've migrated the VM across to another host. I've also restored the entire VM to a point at which it is known to be working/stable and the BSOD (attempted write to read only memory). Granted I did just do a quick restored of the VM - perhaps I need to try a full restore instead.

[J_Worth]

Full restore hasn't worked and I've even changed the SCSI controller to Paravirtualised. I'm hoping the school has some support from VMware so I can open a case with them.

[J_Worth]

It was this! More investigation by analysing the Minidump file showed wdfilter.sys as being the culprit. Temporarily disabled Windows Defender and the server is holding up now! Phew!

 

Now to get Windows Defender reinstated...

 

No recent snapshot?

 

Windows Defender maybe:

 

https://docs.microsoft.com/en-us/answers/questions/351137/attempted-write-to-readonly-memory-what-failed-ntf.html