Hi, we have a terminal server based on Server 2019 that consists of 10 RD Hosts.We have 300 users. Some users use remoteapp.
We got a blue screen in some of the hosts. There are no extra drivers etc. on the hosts other than printer drivers. Printer drivers have been previously tested on different servers. Memory Dump is listed below. How can we interpret this output?
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffff888d8dc2e080, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
Page 2001e206a too large to be in the dump file.
Page 2001d3369 too large to be in the dump file.
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 17763.1.amd64fre.rs5_release.180914-1434
SYSTEM_MANUFACTURER: Microsoft Corporation
VIRTUAL_MACHINE: HyperV
SYSTEM_PRODUCT_NAME: Virtual Machine
SYSTEM_SKU: None
SYSTEM_VERSION: Hyper-V UEFI Release v1.0
BIOS_VENDOR: Microsoft Corporation
BIOS_VERSION: Hyper-V UEFI Release v1.0
BIOS_DATE: 11/26/2012
BASEBOARD_MANUFACTURER: Microsoft Corporation
BASEBOARD_PRODUCT: Virtual Machine
BASEBOARD_VERSION: Hyper-V UEFI Release v1.0
DUMP_TYPE: 1
BUGCHECK_P1: ffff888d8dc2e080
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: csrss.exe
CRITICAL_PROCESS: csrss.exe
EXCEPTION_CODE: (HRESULT) 0x8da82080 (2376605824) - <Unable to get error code text>
ERROR_CODE: (NTSTATUS) 0x8da82080 - <Unable to get error code text>
CPU_COUNT: 8
CPU_MHZ: 95a
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 55
CPU_STEPPING: 4
CPU_MICROCODE: 6,55,4,0 (F,M,S,R) SIG: FFFFFFFF'00000000 (cache) FFFFFFFF'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXPNP: 1 (!blackboxpnp)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xEF
CURRENT_IRQL: 0
ANALYSIS_SESSION_TIME: 04-10-2020 12:32:30.0140
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
EXCEPTION_RECORD: 000000d8d1b3df30 -- (.exr 0xd8d1b3df30)
ExceptionAddress: 00000226f7fab5c0
ExceptionCode: 00000000
ExceptionFlags: 00000000
NumberParameters: -776798208
Parameter[0]: 0000000000000000
Parameter[1]: 0000022600000000
Parameter[2]: 0000000000000000
Parameter[3]: 0000000000000000
Parameter[4]: 0000022600010000
Parameter[5]: 00000226fc6f0000
Parameter[6]: 00000226f7fa0100
Parameter[7]: 00000226fc06fb18
Parameter[8]: 000000d8d1b3e040
Parameter[9]: 000000d8d1b3de10
Parameter[10]: 00000226f7fab5c0
Parameter[11]: 0000004400000000
Parameter[12]: 00000226f7fab5c0
Parameter[13]: 0000000000000000
Parameter[14]: 0000000000000000
CONTEXT: 00007ffc74278ca5 -- (.cxr 0x7ffc74278ca5)
rax=441f0f000b720615 rbx=e0814150247c8948 rcx=0fed8548f08b0000
rdx=c38b44000000c284 rsi=cb8b00000090840f rdi=e18108e9c1c3b70f
rip=0b5c6a15ff482024 rsp=ffffffbf007f0000 rbp=00660000f88141ff
r8=f981c80b00ff0000 r9=8b48217200010000 r10=d1b70f000b5cae05
r11=8b108b4852048d4c r12=4cb60f4610e8c1c1 r13=0f0375c83b440dc2
r14=0b5c82058b48c9b7 r15=548d486a73083b00
iopl=1 ov dn di pl zr na pe cy
cs=4930 ss=5e41 ds=7b8b es=4938 fs=e38b gs=5f41 efl=ccc35c41
4930:2024 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0b5c6a15ff482024
BAD_STACK_POINTER: ffffffbf007f0000
STACK_TEXT:
fffff184`02187c78 fffff802`1ec9fc8d : 00000000`000000ef ffff888d`8dc2e080 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff184`02187c80 fffff802`1ebdcf07 : 00000000`00000000 ffff888d`8dc2e080 00000000`00000000 fffff802`1e5426e4 : nt!PspCatchCriticalBreak+0xfd
fffff184`02187d20 fffff802`1ea9780c : ffff888d`00000000 00000000`00000000 ffff888d`8dc2e080 ffff888d`8dc2e358 : nt!PspTerminateAllThreads+0x146873
fffff184`02187d90 fffff802`1ea99349 : ffffffff`ffffffff fffff184`02187ec0 ffff888d`8dc2e080 000000d8`d1b3d901 : nt!PspTerminateProcess+0xe0
fffff184`02187dd0 fffff802`1e5d8305 : ffff888d`000020ec ffff888d`8da82080 ffff888d`8dc2e080 000000d8`d1b3d940 : nt!NtTerminateProcess+0xa9
fffff184`02187e40 00007ffc`77f5fce4 : 00007ffc`73e983a1 00000226`ffffffff 00000000`00000001 ffffffff`ee1e5d00 : nt!KiSystemServiceCopyEnd+0x25
000000d8`d1b3cfc8 00007ffc`73e983a1 : 00000226`ffffffff 00000000`00000001 ffffffff`ee1e5d00 00000000`0000046c : ntdll!NtTerminateProcess+0x14
000000d8`d1b3cfd0 00007ffc`77f91a68 : 00000226`f7f26640 00007ffc`73e98270 00000226`f7f26658 00007ffc`73cce9dd : CSRSRV!CsrUnhandledExceptionFilter+0x131
000000d8`d1b3d060 00007ffc`77f63400 : 00007ffc`77d17a08 00000000`00000000 00000000`00000000 00007ffc`77ec6a6f : ntdll!LdrpLogFatalUserCallbackException+0x98
000000d8`d1b3d1a0 00007ffc`77f6477f : 00007ffc`7802a000 00007ffc`77ec0000 0000ddc4`001ed000 000000d8`d1b3d750 : ntdll!KiUserCallbackDispatcherHandler+0x20
000000d8`d1b3d1e0 00007ffc`77ec4bef : 000000d8`d1b3d750 00000000`00000000 00007ffc`77d9d0e8 00007ffc`77cf0000 : ntdll!RtlpExecuteHandlerForException+0xf
000000d8`d1b3d210 00007ffc`77f634ee : 000000d8`d1b3df30 00007ffc`74278ca5 00000000`00000000 00007ffc`74263e72 : ntdll!RtlDispatchException+0x40f
000000d8`d1b3d940 00007ffc`77cf7cf6 : ffffffff`00000201 00000226`f7ef1580 0000000c`0000002d 00007ffc`77f06a03 : ntdll!KiUserExceptionDispatch+0x2e
000000d8`d1b3e730 00007ffc`77cf7c76 : 00000000`002e0000 00000000`0000002d 00000000`0000002d 00000001`0000002e : USER32!DefDlgProcWorker+0x66
000000d8`d1b3e7f0 00007ffc`77cfca66 : 00000000`00000000 00000000`00000000 00000000`0000000c 00007ffc`77ed01fe : USER32!DefDlgProcW+0x36
000000d8`d1b3e830 00007ffc`77cfc78c : 00000000`00000008 00007ffc`77f5f4f0 00000000`001301d6 00000000`80000000 : USER32!UserCallWinProcCheckWow+0x266
000000d8`d1b3e9b0 00007ffc`77d17a08 : 000000d8`d1b3eac8 00000000`00000000 00000000`00000000 00000000`00000000 : USER32!DispatchClientMessage+0x9c
000000d8`d1b3ea10 00007ffc`77f63494 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : USER32!_fnNCDESTROY+0x38
000000d8`d1b3ea70 00007ffc`74c41f24 : 00007ffc`77d015df 00000000`00008002 00000000`00000000 00000000`00000000 : ntdll!KiUserCallbackDispatcherContinue
000000d8`d1b3eaf8 00007ffc`77d015df : 00000000`00008002 00000000`00000000 00000000`00000000 000000d8`d1b3ebc8 : win32u!NtUserCreateWindowEx+0x14
000000d8`d1b3eb00 00007ffc`77cff642 : 00000000`000002fc 000000d8`00000001 00000000`00010101 00000000`00010101 : USER32!VerNtUserCreateWindowEx+0x20f
000000d8`d1b3ee90 00007ffc`77d1f19a : 0000439d`851d0a0e ffffffff`0000004b 00000000`00000000 00000000`00000002 : USER32!InternalCreateDialog+0x612
000000d8`d1b3f070 00007ffc`77d63836 : 00000000`00000000 000000d8`d1b3f1d0 000000d8`d1b3f3f0 00000226`f7fb07a0 : USER32!InternalDialogBox+0x106
000000d8`d1b3f0d0 00007ffc`77d62275 : 00000000`00000000 00000000`00000095 00000000`000002f8 00000000`00000032 : USER32!SoftModalMessageBox+0x7e6
000000d8`d1b3f220 00007ffc`77d62fb2 : 00000000`00000000 00000000`00000010 00000000`0000000e 00000000`00000800 : USER32!MessageBoxWorker+0x319
000000d8`d1b3f3d0 00007ffc`73e39726 : 00000000`00000001 00007ffc`73e4a9e0 00007113`625f8fb2 00000000`00000002 : USER32!MessageBoxTimeoutW+0x192
000000d8`d1b3f4d0 00007ffc`73e39bfd : 00000000`00000000 00007ffc`73e4a9e0 00000000`00000000 00000000`00000000 : winsrvext!HardErrorHandler+0x32a
000000d8`d1b3f690 00007ffc`73e3a0ee : 00000226`f7f98f00 00000000`00000001 00000000`00000000 000000d8`d1b3f900 : winsrvext!ProcessHardErrorRequest+0xe9
000000d8`d1b3f700 00007ffc`73e9872d : 00000226`f7ef7db0 00007ffc`77f33a2e 00000000`00000000 000000d8`d1cc0000 : winsrvext!UserHardErrorEx+0x4be
000000d8`d1b3f7c0 00007ffc`73e97ec5 : 00000226`f7ef79f0 00000000`00000000 00000000`00000000 000000d8`d1cc0000 : CSRSRV!QueueHardError+0x1a5
000000d8`d1b3f800 00007ffc`77f2a27f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CSRSRV!CsrApiRequestThread+0x2525
000000d8`d1b3fc90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2f
THREAD_SHA1_HASH_MOD_FUNC: 243502d633fd810f3a77e6153eeed955d23a59af
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2d5957ffba98cb17c4474657af1391290476cdba
THREAD_SHA1_HASH_MOD: 5255f96f63ab75cf0bb2e1adc18592ee682a40d7
FOLLOWUP_IP:
ntdll!NtTerminateProcess+14
00007ffc`77f5fce4 c3 ret
FAULT_INSTR_CODE: c32ecdc3
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: ntdll!NtTerminateProcess+14
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 125ac1e8
IMAGE_VERSION: 10.0.17763.802
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 14
FAILURE_BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_8da82080_STACKPTR_ERROR_ntdll!NtTerminateProcess
BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_8da82080_STACKPTR_ERROR_ntdll!NtTerminateProcess
PRIMARY_PROBLEM_CLASS: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_8da82080_STACKPTR_ERROR_ntdll!NtTerminateProcess
TARGET_TIME: 2020-04-07T05:14:52.000Z
OSBUILD: 17763
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 131216
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer DataCenter
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1996-08-06 18:11:50
BUILDDATESTAMP_STR: 180914-1434
BUILDLAB_STR: rs5_release
BUILDOSVER_STR: 10.0.17763.1.amd64fre.rs5_release.180914-1434
ANALYSIS_SESSION_ELAPSED_TIME: d97
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xef_csrss.exe_bugcheck_critical_process_8da82080_stackptr_error_ntdll!ntterminateprocess
FAILURE_ID_HASH: {cb1f5d2d-babc-5182-2d49-32f9d8f0ee1e}
Followup: MachineOwner
---------
0: kd> kL
# Child-SP RetAddr Call Site
00 fffff184`02187c78 fffff802`1ec9fc8d nt!KeBugCheckEx
01 fffff184`02187c80 fffff802`1ebdcf07 nt!PspCatchCriticalBreak+0xfd
02 fffff184`02187d20 fffff802`1ea9780c nt!PspTerminateAllThreads+0x146873
03 fffff184`02187d90 fffff802`1ea99349 nt!PspTerminateProcess+0xe0
04 fffff184`02187dd0 fffff802`1e5d8305 nt!NtTerminateProcess+0xa9
05 fffff184`02187e40 00007ffc`77f5fce4 nt!KiSystemServiceCopyEnd+0x25
06 000000d8`d1b3cfc8 00007ffc`73e983a1 ntdll!NtTerminateProcess+0x14
07 000000d8`d1b3cfd0 00007ffc`77f91a68 CSRSRV!CsrUnhandledExceptionFilter+0x131
08 000000d8`d1b3d060 00007ffc`77f63400 ntdll!LdrpLogFatalUserCallbackException+0x98
09 000000d8`d1b3d1a0 00007ffc`77f6477f ntdll!KiUserCallbackDispatcherHandler+0x20
0a 000000d8`d1b3d1e0 00007ffc`77ec4bef ntdll!RtlpExecuteHandlerForException+0xf
0b 000000d8`d1b3d210 00007ffc`77f634ee ntdll!RtlDispatchException+0x40f
0c 000000d8`d1b3d940 00007ffc`77cf7cf6 ntdll!KiUserExceptionDispatch+0x2e
0d 000000d8`d1b3e730 00007ffc`77cf7c76 USER32!DefDlgProcWorker+0x66
0e 000000d8`d1b3e7f0 00007ffc`77cfca66 USER32!DefDlgProcW+0x36
0f 000000d8`d1b3e830 00007ffc`77cfc78c USER32!UserCallWinProcCheckWow+0x266
10 000000d8`d1b3e9b0 00007ffc`77d17a08 USER32!DispatchClientMessage+0x9c
11 000000d8`d1b3ea10 00007ffc`77f63494 USER32!_fnNCDESTROY+0x38
12 000000d8`d1b3ea70 00007ffc`74c41f24 ntdll!KiUserCallbackDispatcherContinue
13 000000d8`d1b3eaf8 00007ffc`77d015df win32u!NtUserCreateWindowEx+0x14
14 000000d8`d1b3eb00 00007ffc`77cff642 USER32!VerNtUserCreateWindowEx+0x20f
15 000000d8`d1b3ee90 00007ffc`77d1f19a USER32!InternalCreateDialog+0x612
16 000000d8`d1b3f070 00007ffc`77d63836 USER32!InternalDialogBox+0x106
17 000000d8`d1b3f0d0 00007ffc`77d62275 USER32!SoftModalMessageBox+0x7e6
18 000000d8`d1b3f220 00007ffc`77d62fb2 USER32!MessageBoxWorker+0x319
19 000000d8`d1b3f3d0 00007ffc`73e39726 USER32!MessageBoxTimeoutW+0x192
1a 000000d8`d1b3f4d0 00007ffc`73e39bfd winsrvext!HardErrorHandler+0x32a
1b 000000d8`d1b3f690 00007ffc`73e3a0ee winsrvext!ProcessHardErrorRequest+0xe9
1c 000000d8`d1b3f700 00007ffc`73e9872d winsrvext!UserHardErrorEx+0x4be
1d 000000d8`d1b3f7c0 00007ffc`73e97ec5 CSRSRV!QueueHardError+0x1a5
1e 000000d8`d1b3f800 00007ffc`77f2a27f CSRSRV!CsrApiRequestThread+0x2525
1f 000000d8`d1b3fc90 00000000`00000000 ntdll!RtlUserThreadStart+0x2f
0: kd> r
rax=ffff888d8da82080 rbx=ffff888d8dc2e003 rcx=00000000000000ef
rdx=ffff888d8dc2e080 rsi=ffff888d8dc2e080 rdi=ffff888d8dc2e080
rip=fffff8021e5c7050 rsp=fffff18402187c78 rbp=00000000c0000000
r8=0000000000000000 r9=0000000000000000 r10=7ffffffffffffffc
r11=fffff18402187e38 r12=00007ffc77f63401 r13=00000000c0000005
r14=0000000000000000 r15=00000000c0000005
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeBugCheckEx:
fffff802`1e5c7050 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff184`02187c80=00000000000000ef