Server 2003 - Blue Screen of Death - please help!

[sharkster]

come in this morning, to find the server is turned off and the UPS is flashing crazy, ive unpluged the UPS and started the server off on the mains. went into event veiwer and error.

 

"000000F4"

 

ive looked on the microsoft site and it gives me to reasons

1. driver problem

2. software problem

 

ONLY - i havn't added no new hardware or installed any new software. not even updated the server, its locked up in a seperate room to wich "I" only have the key.

 

microsoft give these options to resolve this.

1. remove the hotfix 842642 (its not installed)

2. Windows Server 2003 with Service Pack 1 (SP1) . The following registry subkey is enabled:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\GRE_Initialize\SupportLinkedFontConTextOut (im running SP2)

 

also tried the hotfix at the top of the page (sorry the link to the page im looking at is...

A Windows Server 2003-based computer stops responding, and you receive a "Stop 0x000000F4" error message

 

it boots up fine in safe mode, so it is some type of software, driver or update problem

 

any suggestions or help would be much appreciated.

[azrael78]

If it boots in safemode - you could try downloading (and installing) the debugging tools and a copy of WhoCrashed.

 

Then once you have all that installed, reboot it in normal, let it blue-screen and then reboot into safe.

Run WhoCrashed and it may help point you at the culprit.

 

On the other hand it may do absolutely nothing - if you have the time, suggest a repair-install from a Server 2003 SP2 CD.

 

I'm assuming it's NOT a DC or a CA or anything that could be seriously harmed by a repair-install.

 

In any case, before you do ANYTHING - ensure you have backups, even if you have to use NTBackup in safe mode... do it before you change things and try to fix it.

 

Az

[mrtechsystems]

Also I who run a chkdsk on the drives aswell

[sharkster]

its just a file server,

 

ill try the WhoCrashed (never heard of it before but ill give it ago)

 

thanks

[KWestos]

Best of luck!

[Wolfman]

you could also try dumpchk.exe from:

http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx ,

and analyse the dump file. You might get a clue at which device or driver is

causing the problems.

 

 

How to use Dumpchk.exe to check a Memory Dump file

 

also let us know if the chkdsk crashes the server (just in case)

[sharkster]

whocrashed did give me the name of the file that crashes, but it blue screened lol so going to wait till its done its memory dump then boot it into safe mode to look at the results

[sharkster]

Here is the Report...

 

Analysis

--------------------------------------------------------------------------------

 

Crash dump directory: C:\WINDOWS\Minidump

 

Crash dumps are enabled on your computer.

 

 

On Wed 30/09/2009 12:39:19 your computer crashed

This was likely caused by the following module: csrss.exe

Bugcheck code: 0xF4 (0x3, 0x8591ACA0, 0x8591AE04, 0x8094C6E6)

Error: CRITICAL_OBJECT_TERMINATION

file path: C:\WINDOWS\system32\csrss.exe

product: Microsoft® Windows® Operating System

company: Microsoft Corporation

description: Client Server Runtime Process

The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.

[CHR1S]

come in this morning, to find the server is turned off and the UPS is flashing crazy, ive unpluged the UPS and started the server off on the mains. went into event veiwer and error.

 

Is everyone looking to far into this?

 

Server is off, if it was a simple BSOD it would continually reboot or freeze on the BSOD. If the UPS is going ape then the could have been a power surge that it could not handle and it just turned off (Ive seen this happen if the UPS is not big enough for the load) and took something with it?

 

Also I have seen this error for HD/controller issues, what do you run in this server IDE/SATA/SCSI?

 

If your clutching at straws try running memtest too.

[sharkster]

scsi,

thanks

[sharkster]

when i was looking at the proccess before it crashed i found something very strange.

a peice of software that runs in the background kept duplicating itself.

[bossman]

@sharkster:

 

Might be nothing but I found this:csrss.exe Windows process - What is it?

[sharkster]

yeh i seen that from WhoCrashed, had a link to same page,

only it cant be a virus...

1. hasn't infected any other machine

2. sophos aint picked it up

3. no 1 can install on the server (& i havn't)

 

but thanks for looking

[bossman]

@sharkster:

 

When you go in through safemode can you disable the hardware one by one in device manager and then reboot (long winded process but may work).

[CHR1S]

Or any startup progs and non critical services?

[sharkster]

Or any startup progs and non critical services?

 

did start to do this, did about 7-8 non microsoft ones then thought well theres about 20-25 of microsoft ones + non microsoft so was going too take well to long.

 

think i might of cracked it now been on 5min solid

[sharkster]

would just like to say a "BIG THANK YOU" to every body that helped me today,

 

seems like its running fine now, 10min solid

 

ill tell you in the morning if its been running all night, fingers crossed.

 

thanks again,

much appreciated

[JJonas]

What was the cause of the problem?

[sharkster]

ill also just add,

this is what made me laugh at the end...

 

considering it was a file server that had this problem with all the staff work, lesson plans, all the curriculum data on only 2 people came to see me about it.

 

fair enough i work in a small school but TWO people haha

[sharkster]

What was the cause of the problem?

 

a peice of software installed runs in the background (hidden internet filter) runs as services but not just one 5-6 to prevent kids or staff to stop it from running, 3 different ones kept loading up so at the end their was about 20 of each service running, wasn't slowing the maching down or eating up resources just blue screened.

 

- must of just been coincidence it happned when the UPS faild :S

Edited September 30, 2009 by sharkster

[sharkster]

come in this morning and still on

 

cheers again

[azrael78]

In that case - a repair-install may well be your only option.

 

You could try reapplying the latest service pack but this may not help.

 

Give dumpchk.exe a try as well though before you go down the repair route, it may well give more info than WhoCrashed.

 

Az

 

Edit: Ah, I see it's fixed... a fire-drill mid-post will do that for you

Edited October 1, 2009 by azrael78

[bossman]

@sharkster:

 

Nice one bud :-)

[BatchFile]

a couple of mine do that (BSOD) if you try and boot them with a usb drive plugged in....