event id 1004

[ricki]

HI

 

Please can some one help me.

 

Our domain has been upgraded from windows 2003 to windows 2008 and now we have random machines rebooting at logon on. They appear to come out with this error

 

client eventid 1004

 

Faulting application winlogon.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x00010b2c.

---------------------------------------

 

All out clients are on windows xp. It appears to be totally random through out the school different machines. Different Ghost images, different switches. It might reboot at a logon now and not do it again all day.

 

We have sniffed the network and found 4 broken switches and have fixed machines spitting out corrup packets and machines with spyware. We have tried updating drivers for machines including nic cards but I have no ideas what causing this or how to find whats causing this has anyone got any ideas.

 

Richard

[ricki]

HI

 

I have managed to get some of the dump files from bginfo see below

 

Microsoft ® Windows Debugger Version 6.12.0002.633 X86

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [C:\technician\errors domain\client\Bginfo.exe.hdmp]

User Mini Dump File: Only registers, stack and portions of memory are available

 

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: SingleUserTS

Machine Name:

Debug session time: Wed Dec 1 14:47:07.000 2010 (UTC + 0:00)

System Uptime: not available

Process Uptime: 0 days 0:00:04.000

......................................................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(c70.c74): Access violation - code c0000005 (first/second chance not available)

eax=c0000005 ebx=80070000 ecx=0012bb98 edx=00000000 esi=000005a0 edi=00000000

eip=7c90e514 esp=00129a28 ebp=00129a8c iopl=0 nv up ei ng nz ac pe cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297

Unable to load image C:\WINDOWS\system32\ntdll.dll, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntdll.dll

*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll

ntdll+0xe514:

7c90e514 c3 ret

 

 

Has anyone got an idea how I fix this.

 

Richard

[ricki]

HI

 

This is the second dump file

 

Microsoft ® Windows Debugger Version 6.12.0002.633 X86

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [C:\technician\errors domain\client\winlogon.exe.20110124-112714-00.hdmp]

User Mini Dump File: Only registers, stack and portions of memory are available

 

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: SingleUserTS

Machine Name:

Debug session time: Mon Jan 24 11:27:17.000 2011 (UTC + 0:00)

System Uptime: not available

Process Uptime: 0 days 1:10:55.000

................................................................

.......................................

Loading unloaded module list

................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(2a4.2a8): Access violation - code c0000005 (first/second chance not available)

eax=c0000005 ebx=80070000 ecx=00069898 edx=00000000 esi=000009fc edi=00000000

eip=7c90e514 esp=00067728 ebp=0006778c iopl=0 nv up ei ng nz ac pe cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

ntdll!KiFastSystemCallRet:

7c90e514 c3 ret

[ricki]

Hi

 

Has anyone any ideas what I can try?

 

Richard

[Cools]

i have the same problem... random reboots.. since upgrade to 2008 " tell the teachers its system upgrades and i cant stop it from happening" not got around to finding the fault.

[ricki]

HI

 

I wish I could all the reboots are corrupting data on the hard drive and I am having to rebuild machines like they are going out of fashion.

 

I need to find a solution as quilckly as I can.

 

We have tried the following up to now.

 

Update drivers on clients and servers

Update firmware on bios on clients and firmware on network cards on server

Server motherboard replaced /nic

Have run network monitoring tools and have found and removed spyware, and corrupt hardware ie client machines with broken hardware or software

Have upgraded sophos to latest version

Have clecked all physical wires for loops

Have run network supervisor and put spannig tree on all switches.

Have spent hours looking for group policy path errors

Have had a network wiring:drunken_smilie: company and a repair company in but have still no answer and am runing out of ideas.

 

We have found a switch which is conflicting and have reset it and flashed it and cannot fix and am waiting for a replacement.

 

This one is a real pain.

 

Richard