Blue Screen on Domain controllers after Updates

Question

After patching our Domain controllers (virtual on ESXi 5.5 U2) recently we started getting Blue screens and reboots. Other changes in our environment around this time include enabling vshield drivers and scanning with Trend Micro. I have removed patches
from April but cannot remove Patch KB3020370 - there is no uninstall button. The error still persists, I have removed the Vshield driver and am waiting to see if the issue reoccurs. Can anyone assist in interpreting the details below? Also is it possible to
remove the patch KB3020370? This only appeart to affect Domain Controllers, regular servers appear unaffected.
Thanks
Below is the BugCheck event.
The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000007f (0x0000000000000008, 0x0000000080050031, 0x00000000000406f8, 0xfffff800018c0e14). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 042915-21762-01.
And output from the debug tool.
Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\MiniDump\042815-21762-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Error: Attempts to access 'c:\windows\i386' failed: 0x2 - The system cannot find the file specified.
************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Error                                          c:\windows\i386
************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 7601.18798.amd64fre.win7sp1_gdr.150316-1654
Machine Name:
Kernel base = 0xfffff800`0185e000 PsLoadedModuleList = 0xfffff800`01aa3890
Debug session time: Tue Apr 28 13:20:34.290 2015 (UTC + 1:00)
System Uptime: 0 days 0:27:28.954
Loading Kernel Symbols
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
Loading User Symbols
Loading unloaded module list
*                        Bugcheck Analysis                                    *
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 406f8, fffff800018d4e14}
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
Followup: MachineOwner
kd> !analyze -v
*                        Bugcheck Analysis                                    *
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000406f8
Arg4: fffff800018d4e14
Debugging Details:
BUGCHECK_STR:  0x7f_8
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  System
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER:  from fffff800018cffe9 to fffff800018d0a40
STACK_TEXT:  
fffff800`01620d28 fffff800`018cffe9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000406f8 : nt!KeBugCheckEx
fffff800`01620d30 fffff800`018ce4b2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`01620e70 fffff800`018d4e14 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0276e000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x4
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`018ce4b2 90              nop
SYMBOL_STACK_INDEX:  2
SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  5507a73c
IMAGE_VERSION:  6.1.7601.18798
FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2
BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0x7f_8_nt!kidoublefaultabort+b2
FAILURE_ID_HASH:  {0367acc4-9bb4-ab69-5701-46a2011718e9}
Followup: MachineOwner

Answer 1

Hi,
Dump file displays：
BugCheck 7F, {8, 80050031, 406f8, fffff800018d4e14} and Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 ).
Bug check 0x7F typically occurs after you install a faulty or mismatched hardware (especially memory) or if installed hardware fails.
A double fault can occur when the kernel stack overflows. This overflow occurs if multiple drivers are attached to the same stack. For example, if two file system filter drivers are attached to the same stack and then the file system recurses back in, the stack
overflows.
You may reference the link below for detailed resolution about this problem:
https://msdn.microsoft.com/en-us/library/windows/hardware/ff559244(v=vs.85).aspx
Besides, you may try to restore the server to the state before installing these Windows Update.
Best Regards,
Eve Wang 
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]