David Overton's Blog and Discussion Site
This site is my way to share my views and general business and IT information with you about Microsoft, IT solutions for ISVs, technologists and businesses, large and small. I specialise in Windows Intune and SBS 2008.
This blog is purely the personal opinions of David Overton. If you can't find the information you were looking for e-mail me at admin@davidoverton.com.

To find out more about my Windows Intune BOOK - Microsoft Windows Intune 2.0: Quickstart Administration click here

To find out more about my SBS 2008 BOOK - Small Business Server 2008, Installation, Migration and Configuration click here

Susan B has a system that keeps crashing - my take on why - crash dump analysis on SBS
David Overton's Blog

Buy my books

Windows Intune:Quickstart Administration


This is the RAW book (Read as Written).
Click here for more information
Buy or pre-order today

SBS 2008 - Installation, Migration and Configuration

Small Business Server 2008 – Installation, Migration, and Configuration

Buy today in book or e-book form

Request a Review Copy

Twitter

Syndication

http://msmvps.com/blogs/bradley/archive/2006/06/22/102538.aspx

I started writting this as a simple comment on the site, but it got so long, I have blogged the entry here.

Susan,

Since your crash dumps show 2-3 different error codes - a different one each time, my 1st suspicion would be hardware - have you run the MS memory diagnostic tool on the system otherwise, check for recent driver updates.

If you need a 1hr course in debugging, have a look at http://uksbsguy.com/blogs/doverton/archive/2006/06/21/627.aspx. However we have not had a single instance of your large crash appear through our crash database - I checked, and the crash appears to be in a very well used and known piece of code, the classpnp.sys driver, which hales to NT4 for classic PNP support.

Failing that, time to call PSS.  If you were to do nothing but run

kd -v -y SRV*d:\websymbols*http://msdl.microsoft.com/download/symbols -z memfile.dmp

on each dump you will see the different crash locations.  Lots of different locations normally points to h/w or a rogue driver corrupting memory.  Mark in his teched pres talks about how to turn on verifier to find these types of issues - from the presentation:

HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management
   LargePageMinimum  REG_DWORD  0xFFFFFFFF
   EnforceWriteProtection  REG_DWORD  1
Reboot to take effect

ttfn

David


Posted Fri, Jun 23 2006 7:18 AM by David Overton

Add a Comment

(optional)  
(optional)
(required)  
Remember Me?

(c)David Overton 2006-13