J_Worth Posted June 3, 2021 Posted June 3, 2021 Hello everyone, I have recently started to provide support to a small secondary school. They have a Server 2019 VM running on ESX and it's just started to Blue Screen. The VM is running the school's RD Gateway. The BSODs are either SYSTEM_SERVICE_EXCEPTION or ATTEMPTED_WRITE_TO_READONLY_MEMORY and it also shows NTFS.sys. Has anyone else come across this before and if so, how did you go about resolving it? Many thanks in advance.
highsky Posted June 3, 2021 Posted June 3, 2021 No recent snapshot? Windows Defender maybe: https://docs.microsoft.com/en-us/answers/questions/351137/attempted-write-to-readonly-memory-what-failed-ntf.html 2
J_Worth Posted June 3, 2021 Author Posted June 3, 2021 Unfortunately not. The VM has been running for a while without any issues. It started to play up at the start of the week - same time as the school's old IT Support contract finished (coincidence?)! I'll take a look at Windows Defender and see if that's the cause. Many thanks.
Jcx500 Posted June 3, 2021 Posted June 3, 2021 (edited) Try re-installing VMware tools could be a driver issue. Another idea is to revert previous windows update Edited June 3, 2021 by Jcx500
3s-gtech Posted June 3, 2021 Posted June 3, 2021 Those issues tend to fit with memory errors, though the server tools/diagnostics should have shown that.
J_Worth Posted June 7, 2021 Author Posted June 7, 2021 Thanks all for the responses. I've reinstalled VMware Tools to no avail. I've migrated the VM across to another host. I've also restored the entire VM to a point at which it is known to be working/stable and the BSOD (attempted write to read only memory). Granted I did just do a quick restored of the VM - perhaps I need to try a full restore instead.
J_Worth Posted June 8, 2021 Author Posted June 8, 2021 Full restore hasn't worked and I've even changed the SCSI controller to Paravirtualised. I'm hoping the school has some support from VMware so I can open a case with them.
J_Worth Posted June 8, 2021 Author Posted June 8, 2021 It was this! More investigation by analysing the Minidump file showed wdfilter.sys as being the culprit. Temporarily disabled Windows Defender and the server is holding up now! Phew! Now to get Windows Defender reinstated... No recent snapshot? Windows Defender maybe: https://docs.microsoft.com/en-us/answers/questions/351137/attempted-write-to-readonly-memory-what-failed-ntf.html 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now