Server 2008 R2 SP1 with RRAS takes down entire network

We have a Hyper-V server (2008 R2 SP1) that is running several DC's. These DC's are for different domains and establish outbound VPN connections using RRAS to sync with remote DC's. We have a few of this with 20-30 DC's running on each Hyper-V
server.
Application of SP1 to the host OS went without issue and everything remained normal.
Upgraded a single Hyper-V VM from 2008 R2 to 2008 R2 SP1 and everything connected to the physical switch went down. Ping times went through the roof and timeouts were happening on the local physical network. All Hyper-V guests on all
Hyper-V machines had CPU usage that went from about 0% up to averaging 5% to 7%. The processing taking all the CPU was the LocalServiceNoNetwork one which is related to packet inspection.
Using the process of elimination, we found that if we stopped RRAS on the Hyper-V guest running 2008 R2 SP1 then everything went back to normal. We duplicated the same scenario with a different machine...and again, just stopping RRAS fixed everything.
As soon as RRAS starts, the network crashes.
Has anyone else seen anything like this? I plan on opening a case with PSS tomorrow but thought I'd ask.
Rob
Rob

PSS is useless. They work on the ticket when convenient for their overseas hours and have no idea what is wrong. They keep asking for the same information over and over. We've decided to remove the RRAS component from our VM's. Instead
we've decided to set up a VPN configuration where we use IPSec tunnels for each VM. This allows us to remove all the RRAS roles and the issue goes away with SP1 applied.
There is definitely something wrong with SP1, RRAS and Hyper-V. Maybe Microsoft can figure it out on their own time. It is easier and simpler for us to just remove the component.
For historical reference, the issue seems to be that RRAS with SP1 picks up packets that are not destined for the RRAS tunnel and attempts to retransmit them. This, in turn, saturates the switches with retransmit packets and takes down the entire network.
Microsoft has absolutely no clue on how to resolve the issue and the techs have so little knowledge in real networking troubleshooting that it is laughable.
Rob

Similar Messages

WMF 3.0+ supported on server 2008 r2 SP1 with Config Manager 2012 R2

Hi guys
Is WMF (PowerShell) 3.0+ supported on server 2008 r2 SP1 with Config Manager 2012 R2.
Thanks
NN

Yes supported since SP1 release
Cheers
Paul | sccmentor.wordpress.com

Flash Player goes nuclear - takes down entire network

We have 10 Windows computers on a small unmanaged gigabit network with a DD-WRT Linksys WRT-54GS router and Dlink 2208 hubs, and were having problems with the network dieing, and nobody able to reach the internet or other computers on the network. It started happening suddenly. There are additionally 3 VOIP lines on this network too and they would be killed.
In troubleshooting, I could see an enormous amount of activity coming from one section of the network. Disconnnecting this segment brought the network back online and functioning correctly. Further tracing based on the flashing lights on the front of the hubs narrowed the problem to one computer, a new Windows XP-64 bit computer. When I brought up the Local Area Connection Status in Windows, I could see an enormous number of packets being sent.
Close to a million packets per second were being sent from this computer.
Adobe Flash Player (ver 10,1,82,76) was taking a tremendous amount of CPU time for an idle computer, and killing this in task manager resulted in the network coming back alive immediately.
Is this a known problem with Adobe Flash going nuclear and killing an entire network? I had this problem twice before and was never able to trace it to my satisfaction and now I wonder if this was what happened.
(was originally posted in Flash but I suppose I should have posted it here since it is a player problem)

Yes, sometimes Flash Player doesn't close down when Firefox is shut down. I didn't find any gremlins on my computer during virus analysis, so can't comment on that. I suppose I could find the problem site and SWF, but since I didn't develop it, my concern with Flash is that it can get into such a snit, that it can take down an entire network and not just a computer.
My concern is summarized this way.
1. Was there something else on my computer that caused this problem. (virus etc)
2. If it is Flash causing this problem, perhaps Steve Jobs concerns with Flash were legit?? (I see Apple has backed down)
3. Grandma certainly wouldn't have been able to resolve this issue, and most computer users would have blamed their ISP since their internet was down.
4. How is the average computer user to deal with the complexity that these new technologies sometimes dump on them?
5. Are we headed to systems that are so complicated that these type of isses become more and more common?

Adobe Flash goes nuclear - takes down entire network

We have 10 Windows computers on a small unmanaged gigabit network with a DD-WRT Linksys WRT-54GS router and Dlink 2208 hubs, and were having problems with the network dieing, and nobody able to reach the internet or other computers on the network. It started happening suddenly. There are additionally 3 VOIP lines on this network too and they would be killed.
In troubleshooting, I could see an enormous amount of activity coming from one section of the network. Disconnnecting this segment brought the network back online and functioning correctly. Further tracing based on the flashing lights on the front of the hubs narrowed the problem to one computer, a new Windows XP-64 bit computer. When I brought up the Local Area Connection Status in Windows, I could see an enormous number of packets being sent.
Close to a million packets per second were being sent from this computer.
Adobe Flash Player (ver 10,1,82,76) was taking a tremendous amount of CPU time for an idle computer, and killing this in task manager resulted in the network coming back alive immediately.
Is this a known problem with Adobe Flash going nuclear and killing an entire network?
(I had this problem twice before and was never able to trace it to my satisfaction.)

Yes, sometimes Flash Player doesn't close down when Firefox is shut down. I didn't find any gremlins on my computer during virus analysis, so can't comment on that. I suppose I could find the problem site and SWF, but since I didn't develop it, my concern with Flash is that it can get into such a snit, that it can take down an entire network and not just a computer.
My concern is summarized this way.
1. Was there something else on my computer that caused this problem. (virus etc)
2. If it is Flash causing this problem, perhaps Steve Jobs concerns with Flash were legit?? (I see Apple has backed down)
3. Grandma certainly wouldn't have been able to resolve this issue, and most computer users would have blamed their ISP since their internet was down.
4. How is the average computer user to deal with the complexity that these new technologies sometimes dump on them?
5. Are we headed to systems that are so complicated that these type of isses become more and more common?

Can't browse anything in Windows Server 2008 R2 SP1

Hi,
Need your help and expertise. Suddenly, i can't browse anything in my Windows Server 2008 R2 SP1 with IIS7. I tried already three(3) different browsers (IE8, Firefox & Chrome). Before, i can browse (using IE8 & Firefox) both private (LAN) and public
(Internet) websites be it via ip address or domain name without any issues whatsoever. In fact, i can't even access the local http website (status in IIS7 is Started) my server is hosting.
The only problem occured just yesterday in my server was drive C: got disk full but i was still able to access via RDP the server and free up disk space of 80GB. I tried already to clear the browsser history,
disable the add-ons of IE8 and turn-off the firewall. I have NOT tried to reset IE8 settings, disable third-party
program or service and startup in msconfig as it require reboot of the server. I'm apprehensive
to do things i mentioned i have not tried since the server is up and running for 919 days and 17hours. It is why i tried other browsers that i even installed Chrome just to test and troubleshoot the browsing problem.
Thanks
iootoo

Maybe this one helps.
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/8ca76e02-c80c-4648-8983-33b5715adb41/no-microsoftcom-server-reachable-ie-address-is-not-valid-changes-to-http
or possibly ask over here.
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/home?forum=ieitprocurrentver
Also check IE|Tools|Internet Options|Connection|LAN SETTINGS
is correct and possibly Automatically Detect
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Can't RDP From Windows 7 to Server 2008 R2 SP1

Hello,
We have a server 2008 R2 SP1 with all the latest updates installed as of today (11/12/2014) that runs terminal services.
We started upgrading our office computers to windows 7 x64 and now unable to RDP into the server. They were able to RDP for a few days and now are unable.
Once you hit connect, it asks for a username & password, and then it says configuring remote connection and after about 15-30 seconds it just says can not connect to remote computer.
I am able to RDP from windows 7 into 2003 servers.
Windows XP Computers can RDP just fine.
I went through all the articles that had the updates that needed to be removed/reinstalled for RDP to work and none of them fixed the issue.
This has been going on since Monday 11/10/2014
Any advice or assistance is greatly appreciated.

SP1 Is installed. as well as updated as of 11/12/2104
Here is the only thing that shows up in the logs on the server side:
Attempt to send connect message to Windows video subsystem failed. The relevant status code was 0xd0000001.
System
Provider
[ Name]
Microsoft-Windows-TerminalServices-LocalSessionManager
[ Guid]
{5D896912-022D-40AA-A3A8-4FA5515C76D7}
EventID
20
Version
0
Level
2
Task
0
Opcode
0
Keywords
0x1000000000000000
TimeCreated
[ SystemTime]
2014-11-12T23:47:45.532187000Z
EventRecordID
19249
Correlation
Execution
[ ProcessID]
644
[ ThreadID]
1624
Channel
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Computer
LAXCA-PD-TS01.XXXXXXXXXXXXXXX.local
Security
[ UserID]
S-1-5-18
UserData
EventXML
messageName
connect
errorCode
0xd0000001

How to up Windows Server 2008 R2 SP1 created VM with Windows 8.1 hyper-v manager

Hi
I have VM that created with Windows Server
2008 R2 SP1. This was up without a problem with the windows 8 hyper-v manager. I have recently upgraded my OS with 8.1. Now I have tried to import this VM but it
throwme following message.
This is a real pain when there is no way of doing this. Any help greatly appreciated.
Regards
Radika

Hi,
Brian is right, for mange the Server 2008r2 sp1 we recommend use the Windows 7 or 7.1 platform.
More information:
Remote Server Administration Tools for Windows 7 with Service Pack 1 (SP1)
http://www.microsoft.com/en-us/download/details.aspx?id=7887
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Does installing Desktop Experience on Windows Server 2008 R2 SP1 slow down the server / increase processor usage?

Hello.
I'm running a tekkit classic (Minecraft) Server on a dedicated server I got from OVH, Im just wondering - Im currently using ClamAV for an antivirus, But I would like windows defender.
Im wondering if installing Desktop Experience on my dedi would increase processor usage or slow down the dedi even slightly.
System Specs:
RAM: 32GB DDR3 ECC 1600MHz
CPU: Intel Xeon E3-1245v2
HDD: 2x2TB SATA (Both used, specified as different drives)
OS: Windows Server 2008 R2 SP1
Theres only 1 indev tekkit server currently running on there, Im getting 0-5% processor usage. I may be setting up more modpack servers - but im wondering if installing desktop experience would increase the processor usage or slow the dedi down.
Thanks.
Joseph

Hi Joseph,
This is the forum for Microsoft BizTalk Server, you've asked your question in the wrong forum.
I suggest posting your question in the Windows Server forum
http://social.msdn.microsoft.com/Forums/en-US/home#forum=winserver2008appcompatabilityandcertification&filter=alltypes&sort=lastpostdesc&content=Search
Glenn Colpaert - MCTS BizTalk Server - Blog : http://blog.codit.eu

Unable to Install Windows Server 2012 on Windows Server 2008 R2 SP1 Hyper-V

My attempts to install are failing with a message "Windows cannot install required files. The file may be corrupt or missing....Error code: 0x800705070".
I am posting this on the Wondows 2012 Server forum but I have had exactly the same problem as described below with Windows 2008 R2 SP1.
As the title says this is on a Windows Server 2008 R2 SP1 host with all current updates. I have downloaded the ISO file from a Technet subscription file twice, once by direct download and once by the Akamai downloader. The virtual disk is connected with
the default IDE driver. I mounted both installation images as ISOs, located on a file system on the host server. I have tried installs by deleting the VM and recreating both the VM and a new virtual disk, re-using a previously created virtual disk, and
deleting the partitions in a previously created virtual disk, and executing the format command, and then attempting the install.
I have exactly the same problem trying to create a Windows Server 2008 R2 SP1 VM on the same host OS. With those attempts, I downloaded the Technet subscription iso 4 or 5 times, and burned one to a DVD which I attached to the created VM. Same
error message.
The virtual machines and virtual disks I created and used were all located on an RAID5 array, on a builtin Intel RAID controller using Intel Rapid Storage Technology software version 11.2.0.1066. The host Windows Server 2008 R2 SP1 uses this file system
but the OS is installed on a dedicated drive (C).
I had previously created a guest VM with Windows Server 2008 R2 (several months worth of updates ago) without drama.
I have spent hours reading forums and blog articles on this. A common response is to download the iso another time, and/or burn it to a DVD instead of mounting an iso image. Although I didn't do the later yet with 2012 Server, but I have done these
other steps attempting to install Windows 2008 Server SP1. The install process takes a while (not to mention doing multiple downloads). Given this seems to be a common recommended remedy, and indeed based on posts does seem to eliminate the problem is some
cases, why doesn't somebody change the Microsoft installer program so it does a thorough integrity check at the beginning of the install process?

Jeff,
After the exercise of Windows 2012 Server successfully installing (as I described above) I also successfully installed Windows 2008 R2 on Hyper-V. From my standpoint, I have eliminated the problem (which isn't the same as correcting the problem).
The answer to your specific question regarding Hyper-V support is that the motherboard I am using, an Asus P5Q, is not supported by Windows 2008 R2 because it doesn't use ECC memory, and the vendor doesn't say it supports Windows 2008. But I am sure you
know the motherboard vendors often don't test older motherboards with newer software versions. It appears that in specifying ECC memory Microsoft is trying to protect users of Windows Server from hurting themselves, not saying the software won't run.
Having said that, my suspicion in the beginning was, and still is, that it was some variable(s) left in an unknown state in the Hyper-V environment, which was why after trying to install Windows 2008 R2 several times I tried Windows 2012 which resulted in
the same error, and then encountered the same error trying to install Windows 7 on the same Hyper-V installation. The specific Hyper-V Windows 2008 R2 server had run without any operating problems for months before I started having trouble, and although it
had been quite a while since I had created VMs, that process used to work. The hardware didn't change. What changed was applying updates through Microsoft Update, and a few access control rights I changed, and at least I think, I set back to their original
value.
So in short, no, my hardware isn't supported by Windows 2008 Server. Two, your assertion that you are running the same software configuration that I am is very unlikely to be true. There are an extremely large number of things which are different between
your test system and mine, such as which Windows 2008 components are installed, what updates were installed and in what order they were installed, and what other third party software each of us is running, and between AD, and all the features, a large number
of potential differences in ACLs, options, etc. and I don't for a minute think this particular problem was caused by the underlying hardware.
I do appreciate your taking the time to try to help me, and I hope there is one thing you and I could agree on. Microsoft could pretty easily make it much easier to isolate problems. In this day and age reporting hex error codes (as opposed to doing the
table lookup in the error handling proc), and not providing more diagnostic information seems to me to be almost quaint. And in this case Microsoft can dismiss my problems on the grounds it was all on unsupported hardware. Unfortunately, I think they
are missing an opportunity to make their software better, because in my opinion what I encountered there are a set of conditions which will cause installations to fail that aren't going to get corrected.

Unable to install SQL server 2008 r2 standard edition on windows server 2008 r2 sp1

I am unable to install sql server 2008 r2 standard edition on windows server 2008 r2 sp1.
On the Setup Support Files page, choose Install this step I don't get any other window i.e. nothing happens I waited for 5-10 min. Then I checked the log file.
Final result:                  Failed: see details below
Exit code (Decimal):           -2068053929
Exit facility code:            1212
Exit error code:               87
Exit message:                  Failed: see details below
Start time:                    2014-03-18 14:59:31
End time:                      2014-03-18 15:00:25
=== Verbose logging started: 3/19/2014 9:45:47 Build type: SHIP UNICODE 5.00.7601.00 Calling process: E:\SQL Server 2008 R2 Standard\x64\setup100.exe ===
MSI (c) (10:34) [09:45:47:496]: Note: 1: 2203 2: E:\SQL Server 2008 R2 Standard\x64\redist\watson\dw20sharedamd64.msi 3: -2147287038
MSI (c) (10:34) [09:45:47:496]: MsiOpenPackageEx is returning 2.
=== Verbose logging stopped: 3/19/2014 9:45:47 ===
Please help As i am running out of time as i have to upgrade TFS for that first step is to install SQL server.

Hello,
The following are a few things you can try:
Copy the media to the local disk drive, unzip it (in case you are installing from an ISO file, and run SQL Server setup from there.
Try to unregister and register the Windows Installer with the following two commands:
msiexec /unregister
msiexec /regserver
Try to use Process Monitor to log the detailed error produced when the installation of dw20sharedamd64.msi fails. You can download Process Monitor from the following link:
http://technet.microsoft.com/en-us/sysinternals/bb896645
Share with us the error captured by Process Monitor.
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com

Oracle 11g R2 install problem on Windows Server 2008 R2 SP1

Hi all,
Trying to install the Oracle 11g R2 database onto Windows Server 2008 R2 SP1.
I get as far as running the setup and a black window flashes up on the screen and disappears.
The log files only show the following:
Using paramFile: C:\Temp\database\install\oraparam.ini
Checking monitor: must be configured to display at least 256 colors. Actual 65536 Passed
The number of files bootstrapped for the jre is 0.
The number of files bootstrapped for the oui is 0.
I've tried running setup -debug from the command line but no further information is logged.
Any help in troubleshooting further is appreciated.

That is the complete log file. No error messages or further information is given.
I'm not sure how to check:
Statement of Direction: Oracle Database 11g Release 2 – Microsoft Windows 7 and Windows Server 2008 R2 [ID 867040.1]
I have checked on:
http://docs.oracle.com/cd/E11882_01/install.112/e24283/toc.htm
The server meets all the hardware requirements. The default file share is accessible and it is running a supported browser. The installer is being run with Admin rights. I'm not sure what else I need to check.

Windows Server 2008 R2 SP1 - BSOD Stop Error 0x00000050 RDPWD.SYS

Hi all,
I have been struggling with a BSOD for the past 5 weeks and have scoured the web trying in vain to find someone else with the same issue.
Environment:
8 x 2008 R2 SP1 Windows Servers (8Gb RAM, 25Gb HDD) with Remote Desktop Services Roles installed, running as part of an RDS Farm. All Servers are VM Guests (hardware version 7) running on VMware vSphere v4.1.0-260247 Hosts (Dell
PowerEdge R710 - 128Gb RAM). Our vSphere 'farm' has 5 Hosts that connect to our EMC SAN via iSCSI with multipath routes.
Each RDS Server is load balanced via a Connection Broker, and each server has the same set of software / vm hardware installed. In a nutshell, each has Symantec Endpoint Protection v11.0.5002.333, Symantec Altiris v7.0, Microsoft Office 2007 as well as
other various software essential to these servers.
Symptoms:
Randomly throughout the day, one (or more) of the RDS Servers will crash with a BSOD more often than not with "caused by driver ntoskrnl.exe" sometimes with "cng.sys" and once with "ksecpkg.sys". So far in the 5 weeks I have had 90 crashes. Yesterday
all 8 of the RDS Servers crashed at some point throughout the day.
On a typical BSOD, it says:
The problem seems to be caused by the following file: ntoskrnl.exe
PAGE_FAULT_IN_NONPAGED_AREA
Technical Information:
*** STOP: 0x00000050 (0xfffffa800c153284, 0x0000000000000001, 0xfffff880053dc0c9, 0x0000000000000000)
*** ntoskrnl.exe - Address 0xfffff8000169ac40 base at 0xfffff8000161e000 DateStamp 0x4e02aaa3
Using BlueScreenView it says "caused by address: ntoskrnl.exe+7cc40" nearly every time.
I have analysed as best I could using Microsoft WinDbg, and this is the output of a typical mini-dump file:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\hqrds01\c$\Windows\Minidump\030112-19359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows (x64)\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01609000 PsLoadedModuleList = 0xfffff800`0184e670
Debug session time: Thu Mar 1 09:14:00.921 2012 (UTC + 0:00)
System Uptime: 0 days 21:31:41.950
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                        Bugcheck Analysis
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa800be83284, 1, fffff8800576f0c9, 0}
Could not read faulting driver name
Probably caused by : RDPWD.SYS ( RDPWD!memcpy+1d9 )
Followup: MachineOwner
1: kd> !analyze -v
*                        Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800be83284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800576f0c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018b8100
fffffa800be83284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800bf70a80 -- (.trap 0xfffff8800bf70a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000023d rbx=0000000000000000 rcx=fffffa800be83284
rdx=ffffffffffe7e63b rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800576f0c9 rsp=fffff8800bf70c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0033401e8 r10=fffff8a0033401e8
r11=fffffa800be83268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax ds:0c40:fffffa80`0be83284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016319fc to fffff80001685c40
STACK_TEXT:
fffff880`0bf70918 fffff800`016319fc : 00000000`00000050 fffffa80`0be83284 00000000`00000001 fffff880`0bf70a80 : nt!KeBugCheckEx
fffff880`0bf70920 fffff800`01683d6e : 00000000`00000001 fffffa80`0be83284 00000000`00000000 fffff8a0`0be85820 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0bf70a80 fffff880`0576f0c9 : fffff880`057547cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0bf70c18 fffff880`057547cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`0576c99d : RDPWD!memcpy+0x1d9
fffff880`0bf70c20 fffff880`0576c9fc : fffff8a0`0f938010 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0bf70c60 fffff880`0576b354 : fffff880`0bf70da0 fffff8a0`033401e8 00000000`00000000 fffff880`0576abfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0bf70d10 fffff880`0576af64 : 00000000`00000031 fffffa80`0bd01895 00000006`0000001f fffff880`05739079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0bf70d50 fffff880`029ba1f8 : fffff8a0`03345000 fffffa80`0bae6e80 fffffa80`0a5c0e60 fffff880`05737e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0bf70df0 fffff880`057378d0 : 00000000`00000000 fffff880`0bf70f10 fffff880`0bf70f08 00000000`00000000 : termdd!IcaRawInput+0x50
fffff880`0bf70e20 fffff880`05736d85 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0bf70e50 fffff880`057367c2 : fffffa80`088e8a28 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0bf70ef0 fffff880`029ba1f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0bf70f60 fffff880`0572c4c5 : fffffa80`088e8a10 fffffa80`0bd01658 00000000`00000000 fffffa80`088e8a10 : termdd!IcaRawInput+0x50
fffff880`0bf70f90 fffff880`029baf3e : fffffa80`0bd01620 fffffa80`0c100420 fffffa80`0bd4b450 fffffa80`0973b9b0 : tdtcp!TdInputThread+0x465
fffff880`0bf71810 fffff880`029b9ae3 : fffffa80`09d902b0 fffffa80`0973b9b0 fffffa80`093d8520 fffffa80`0bd4b450 : termdd!IcaDriverThread+0x5a
fffff880`0bf71840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
The RDS servers are set to reboot automatically, and after a period of 5 minutes or so, the users can reconnect and log back in. On a typical day each server will have around 10 people RDP'd in to them.
The Users connecting to the RDS Servers included XP laptops/desktops and IGEL UD-120-LX Thin Terminals. The XPs have SP3 installed and are fully patched via Symantec Altiris.
Things I have tried:
- Analyse the dump-files (as per above).
- I have tracked each user logging on to the RDS Farm (via batch scripts) and tried to determine if this is caused by the same individual(s) but it appears random.
- Check to see if the crashing Virtual Machine is running on a specific host, but it has happened on all Hosts.
- Check to see if there was anything specific that happened on the day that the crashes started. There were about 5 new poeple introduced to the RDS Farm at that time, but there were using (a) client machines that had been used previously elsewhere with
no issues, (b) software that had been used previously, (c) in a remote location that had previous users using RDS, (d) have not been logged on to a RDS Server when it has crashed.
- Updated Windows Server 2008 R2 SP1 to the latest patches (as of Feb 2012).
- Turned on Verifier (using recommended settings), and then analysed dump-files with the same reference to rdpwd.sys.
- Fixed the Memory Resource Reservation in vSphere to the full 8Gb for all these RDS Servers (so that the memory is not shared at all).
- Ran MEMTEST on a VM Guest with the full 8Gb RAM, on a couple of the ESX Hosts.
- Changed the VMTools Video Driver to the SVGA II driver from the Standard VGA Driver.
- Ran a full AV Scan (using SEP).
- Isolated the Printer Drivers using the Printer Management MMC.
- Ran sfc /scannow of all RDS Servers and rebooted.
The mini-dump file mentioned above is here:https://skydrive.live.com/redir.aspx?cid=48f471f287af2349&resid=48F471F287AF2349!105&parid=48F471F287AF2349!103
I hope someone can help, as what hair I have left (from pulling it out) is turning grey!
Andy

*                        Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800c153284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880053dc0c9, If non-zero, the instruction address which referenced the bad memory
   address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018cd100
fffffa800c153284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800aa48a80 -- (.trap 0xfffff8800aa48a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001ff rbx=0000000000000000 rcx=fffffa800c153284
rdx=ffffffffffee6b8b rsi=0000000000000000 rdi=0000000000000000
rip=fffff880053dc0c9 rsp=fffff8800aa48c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0123923a8 r10=fffff8a0123923a8
r11=fffffa800c153268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax ds:8c40:fffffa80`0c153284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016469fc to fffff8000169ac40
STACK_TEXT:
fffff880`0aa48918 fffff800`016469fc : 00000000`00000050 fffffa80`0c153284 00000000`00000001 fffff880`0aa48a80 : nt!KeBugCheckEx
fffff880`0aa48920 fffff800`01698d6e : 00000000`00000001 fffffa80`0c153284 00000000`00000000 fffff8a0`10919830 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0aa48a80 fffff880`053dc0c9 : fffff880`053c17cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0aa48c18 fffff880`053c17cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`053d999d : RDPWD!memcpy+0x1d9
fffff880`0aa48c20 fffff880`053d99fc : fffff8a0`10cf30d0 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0aa48c60 fffff880`053d8354 : fffff880`0aa48da0 fffff8a0`123923a8 00000000`00000000 fffff880`053d7bfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0aa48d10 fffff880`053d7f64 : 00000000`00000031 fffffa80`0c039de5 00000006`0000001f fffff880`053a6079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0aa48d50 fffff880`012c01f8 : fffff8a0`12393000 fffffa80`0bb7aa60 fffffa80`0b81e9c0 fffff880`053a4e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0aa48df0 fffff880`053a48d0 : 00000000`00000000 fffff880`0aa48f10 fffff880`0aa48f08 fffffa80`0c039ba8 : termdd!IcaRawInput+0x50
fffff880`0aa48e20 fffff880`053a3d85 : fffff880`01716890 fffffa80`0c0327e8 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0aa48e50 fffff880`053a37c2 : fffffa80`0c16e598 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0aa48ef0 fffff880`012c01f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0aa48f60 fffff880`052994c5 : fffffa80`0c16e580 fffffa80`0c039ba8 00000000`00000000 fffffa80`0c16e580 : termdd!IcaRawInput+0x50
fffff880`0aa48f90 fffff880`012c0f3e : fffffa80`0c039b70 fffffa80`0acccf20 fffffa80`0a95c450 fffffa80`0abf9620 : tdtcp!TdInputThread+0x465
fffff880`0aa49810 fffff880`012bfae3 : fffffa80`0c0a6560 fffffa80`0abf9620 fffffa80`087eee80 fffffa80`0a95c450 : termdd!IcaDriverThread+0x5a
fffff880`0aa49840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
Bug Check Code 0x50:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559023%28v=vs.85%29.aspx
Please start by that:
Update all possible drivers
Uninstall all unused programs
Disable all security softwares you have
Run chkdsk /r /f and sfc /scannow
Run memtest86+ to check if all is okay with your RAM. If an error was detected then replace the faulty RAM or contact your manufacturer Technical Support
If this does not help then upload MEMORY.DMP file (You can zip it and divide it using 7-ZIP) using Microsoft Skydrive and post a link here.
You can also contact Microsoft CSS for assistance.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft
Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

Unable to change password while first logon on windows server 2008 R2 SP1 system

Hi Team,
Ad team has created new account for me with change password on first logon setting
When I logged in on Windows Server 2008 r2 SP1 system with my new credentials I get a error message stating that
"You must change your password before logging on the first time. For assistance, conatct your system administrator or technical support"
Concern:
I do not get password change screen on first logon on the server. How should I change my password on first logon?

Hi,
I got resolution for above issue
Run ==> type "tsconfig.msc" ==> double click "RDP-TCP" ==> change security layer to
RDP Security layer ==> Apply ==> OK

Unable to reinstall WSUS on air-gapped Windows Server 2008 R2 SP1 server

A co-worker installed WSUS on an air-gapped (not connected to the Internet) server running Windows Server 2008 R2 SP1, but he wasn't sure he'd configured everything properly, and asked me to uninstall and reinstall it. The uninstallation went without
a hitch, but reinstalling through the Server Manager gives the error message "The update could not be found. There may be a network connection issue." The Server Manager log shows the following:
8632: 2014-04-25 15:30:22.578 [Provider]                  System changed since last refresh: False
8632: 2014-04-25 15:30:29.489 [InstallationProgressPage] Loading progress page...
8632: 2014-04-25 15:30:29.520 [InstallationProgressPage] Creating WindowsUpdateDownloader.
8632: 2014-04-25 15:30:29.535 [InstallationProgressPage] Searching for Updates...
8632: 2014-04-25 15:30:29.535 [InstallationProgressPage] Starting asynchronous download.
8632: 2014-04-25 15:30:29.535 [WindowsUpdateDownloader]   Creating session.
8632: 2014-04-25 15:30:29.535 [WindowsUpdateDownloader]   Search query: 'CategoryIDs contains '4e487029-f550-4c22-8b31-9173f3f95786''
8632: 2014-04-25 15:30:29.582 [WindowsUpdateDownloader]   Searching....
8632: 2014-04-25 15:33:07.906 [WindowsUpdateDownloader]   Search failed, HRESULT: -2145107924, message: Exception from HRESULT: 0x8024402C
8632: 2014-04-25 15:33:07.921 [InstallationProgressPage] Search completed, result: Failed.
8632: 2014-04-25 15:33:07.921 [WindowsUpdateDownloader]   Sending failure DownloadComplete event.
8632: 2014-04-25 15:33:07.921 [InstallationProgressPage] Download completed, result: NotStarted.
8632: 2014-04-25 15:33:07.921 [InstallationProgressPage] Error (Id=0) Failure message: 'The update could not be found. There may be a network connection issue. <a href="WSUS.chm::/html/54a9eb1f-5dd1-42d8-ad00-dae55d7b9463.htm">Click here for
more information.</a>'
8632: 2014-04-25 15:33:07.921 [InstallationProgressPage] Invoking LoadFinishPage.
8632: 2014-04-25 15:33:07.921 [InstallationProgressPage] About to load finish page...
8632: 2014-04-25 15:33:07.937 [InstallationFinishPage]    Loading finish page
8632: 2014-04-25 15:33:07.953 [InstallationFinishPage]    Finish page loaded
Any ideas?

Hi,
0x8024402C WU_E_PT_WINHTTP_NAME_NOT_RESOLVED
Winhttp SendRequest/ReceiveResponse failed with 0x2ee7 error. Either the proxy server or target server name cannot be resolved. Corresponding to ERROR_WINHTTP_NAME_NOT_RESOLVED.
Stop/Restart service or reboot the machine if you see this error frequently.
Since the server is not connect to the internet, at least it should have an available upstream server. Did you configure it correctly? The error message indicate that the
name could not resolved, make sure you can resolve the name of the upstream server. Run nslookup check the result.
If it is the only WSUS, then give it internet connection and test.
Hope this helps.

SQL Server 2008 Express SP1 installation failed

Hello guys,
System Info:
Windows 7 64Bit.
Scenario: I have an application, while installation it installs SQLServer 2008 instance with some xyz database name.
Issue: The system already has the SQLServer 2008 R2, and now I am trying to install the application but the SQLServer instance of my application is not getting installed, its giving error saying that the installation failed.
The error code is :
0x84B40000
The below is the log file data.
07/07/2014 16:15:14.283 ======================================================================
07/07/2014 16:15:14.283 Setup launched
07/07/2014 16:15:14.298 Attempting to determine media source
07/07/2014 16:15:14.298 Media source value not specified on command line argument.
07/07/2014 16:15:14.298 Setup is launched from media directly so default the value to the current folder.
07/07/2014 16:15:14.298 Media source: c:\80424454fe36892978\
07/07/2014 16:15:14.298 Attempt to determine media layout based on file 'c:\80424454fe36892978\mediainfo.xml'.
07/07/2014 16:15:14.361 Media layout is detected as: Core
07/07/2014 16:15:14.361 Media LCID is detected as: 1033
07/07/2014 16:15:14.361 Media is a slipstream package
07/07/2014 16:15:14.361 Only patch related actions can run patch setup.exe, so continuing to run setup.exe from media.
07/07/2014 16:15:14.361 /? or /HELP or /ACTION=HELP specified: false
07/07/2014 16:15:14.361 Help display: false
07/07/2014 16:15:14.361 Checking to see if we need to install .Net version 2.0
07/07/2014 16:15:14.376 Determining the cluster status of the local machine.
07/07/2014 16:15:14.376 The local machine is not configured as a cluster node.
07/07/2014 16:15:14.376 Attempting to find media for .Net version 2.0
07/07/2014 16:15:14.376 .Net version 2.0 is installed
07/07/2014 16:15:14.376 RedistMSI::GetExpectedBuildRevision - Setup expects MSI 4.5.6001.22159 at the minimum
07/07/2014 16:15:14.376 Attempting to get Windows Installer version
07/07/2014 16:15:14.376 Windows Installer version detected: 5.0.7601.17807
07/07/2014 16:15:14.376 RedistMSI::IsVistaRTM - Not Vista RTM build
07/07/2014 16:15:14.392 Required version of Windows Installer is already installed
07/07/2014 16:15:14.392 Current running setup.exe full path: c:\80424454fe36892978\setup.exe
07/07/2014 16:15:14.392 Media setup.exe file version detected: 2007.100.2731.23
07/07/2014 16:15:14.392 Locally installed setup.exe full path: c:\Program Files (x86)\Microsoft SQL Server\100\Setup Bootstrap\Release\setup.exe
07/07/2014 16:15:14.408 Local setup.exe file version detected: 2007.100.2731.23
07/07/2014 16:15:14.408 Local setup.exe version 2007.100.2731.23 is equal or greater than media version 2007.100.2731.23, so re-launching setup.exe from local
07/07/2014 16:15:14.408 Media source: c:\80424454fe36892978\
07/07/2014 16:15:14.408 Install media path: c:\80424454fe36892978\x86\setup\
07/07/2014 16:15:14.423 Media layout: Core
07/07/2014 16:15:14.423 Attempting to get execution timestamp
07/07/2014 16:15:14.423 Timestamp: 20140707_161514
07/07/2014 16:15:14.439 Attempting to launch local setup.exe
07/07/2014 16:15:14.439 Attempting to launch process c:\Program Files (x86)\Microsoft SQL Server\100\Setup Bootstrap\Release\setup.exe
07/07/2014 16:15:38.962 Process returned exit code: 0x84B40000
07/07/2014 16:15:38.962 Local setup.exe returned exit code: 0x84B40000
07/07/2014 16:15:38.962 Setup closed with exit code: 0x84C40013
07/07/2014 16:15:38.962 ======================================================================
Please do reply if anyone knows how to fix this issue.
Thanks,
Shiv
0x84B40000

Hi,
You can install SQL server express 2008 on machine having SQL Server 2008 r2 is supported. From what you posted I guess SQL server 2008 r2 is default instance so you need to install SQL server 2008 express SP1 as named instance. Your error matches problem
mentioned in below thread
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/1e8cfab3-4b99-4b4d-82bf-97799dabe34c/failure-when-installing-from-command-prompt-config-file?forum=sqlexpress
If issue is not solved please post complete log files from location
%programfiles%\Microsoft SQL Server\100\Setup Bootstrap\Log\.
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it.
My TechNet Wiki Articles

Server 2008 R2 SP1 with RRAS takes down entire network

Similar Messages

Maybe you are looking for