Windows Server 2008 : Administrator Password reset

I am using Win Ser 2008
Edition - Enterprise
Version - 6.0.6002
SP2 - 64 Bit OS
I followed the steps, I success the whole process in standby server.
But i received an Error Message
"This version of system recovery option is not compatible with the version of windows you are trying to repair"

Hi,
Please refer to the thread below to check if the CPU Architecture, OS Version & Bootloader of Backup and the Recovery Setup Media are matched:
System Recovery Option is not compatible with the version of windows you are trying to repair
http://social.technet.microsoft.com/Forums/windowsserver/en-US/5ea5135f-d6b8-4caa-a0bd-ce4e1a6ed463/system-recovery-option-is-not-compatible-with-the-version-of-windows-you-are-trying-to-repair?forum=windowsbackup
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

What is the most powerful books for Windows server 2008 and R2?

Hi,
There are many books out there that cover Windows server 2k8 and its R2 successor but i wonder which ones to focus on. In the same time, all books are for one purpose, "Windows Server 2008". Each author has his/her own view on the platform. I don't
want to read them all just to avoid confusions and complications.
These are the list of books that i have along with books that i finished reading them:
Exam 70-640 Configuring Windows Server® 2008 Active Directory® (Finished this)
Exam 70-642 Configuring Windows Server 2008 Network Infrastructure (Finished this)
Exam 70-643 Configuring Windows Server 2008 Application Infrastructure
(Finished this)
Exam 70-646 Windows_Server__2008_Server_Administrator_Second_Edition (Finished this)
Mastering_Windows_Server_2008_R2 (Finished this)
McGraw.Hill.Microsoft.Windows.Server.2008.Administration.Feb.2008
McGraw.Hill.Microsoft.Windows.Server.2008.The.Complete.Reference.Feb.2008
OReilly.Windows.Server.2008.The.Definitive.Guide.Mar.2008
Sams.Teach.Yourself.Windows.Server.2008.in.24.Hours.May.2008
Sybex.MCTS.Windows.Server.2008.Active.Directory.Configuration.Study.Guide
Windows Server 2008 Active Directory Resource Kit (Finished this)
Windows Server 2008 Networking and Network Access Protection (Finished this)
Windows Server 2008 Unleashed
Windows Server 2008 R2 Unleashed
Do you think the unfinished books worth reading?
Appreciate your help.

Thank you for the reply. My goal is to read everything (ins and outs) about Win 2008 and R2 platforms before i jump into Win 2012. I have pretty good experience in certain roles in Win 2008 such ADDS and ADCS. As clarified, i've finished a good number of
books but i want to make sure that i didn't miss a single piece of information that maybe covered in another book.
Honestly, i find the Technet docs are informative but daunting. On the other hand, books written by authors are more friendly because authors can throw jokes while explaining a certain technology, which makes the reader more attracted to the topic. In addition,
examples, practices, labbing, and quizzes in the books are more fun.

Autologin on Windows Server 2008 R2 - local Administrator problem

I needed an user to autologin on a Windows Server 2008 R2 server.
Configured it following this guide: http://www.danj.co.uk/2011/06/enable-autologon-for-windows-2008-r2.html
In addition I added the login information by using the Autologon tool from sysinternals: http://technet.microsoft.com/en-us/sysinternals/bb963905.aspx
Now the user I configured autologins successfully. The only downside is that now you can login with the local Administrator account by just hitting enter, as it now doesn't check the password and instead has a blank one. I think this comes from the User
accounts screen where I unticked the checkbox and also the Administrator account is listed. When trying to remove the local Administrator it tells me that it will delete the account. I don't want that.
How do I keep autologin of the user I configured but also have the local Administrator account check his password?

Hello,
please see
http://www.expta.com/2008/04/how-to-enable-autologon-for-windows.html
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

Unable to change password while first logon on windows server 2008 R2 SP1 system

Hi Team,
Ad team has created new account for me with change password on first logon setting
When I logged in on Windows Server 2008 r2 SP1 system with my new credentials I get a error message stating that
"You must change your password before logging on the first time. For assistance, conatct your system administrator or technical support"
Concern:
I do not get password change screen on first logon on the server. How should I change my password on first logon?

Hi,
I got resolution for above issue
Run ==> type "tsconfig.msc" ==> double click "RDP-TCP" ==> change security layer to
RDP Security layer ==> Apply ==> OK

Enabling Windows Server 2008 R2 Built-In Administrator Account

The properties box for my Windows Server 2008 R2 built-in administrator program says the account is disabled. Even the primary user account has virtually no priveliges. How can I, with a mere primary user account available at logon, enable
the built-in administrator account, or otherwise grant my primary user account administrator priveliges? Windows Server 2008 R2 denies my primary user account access/permission for nearly all changes to accounts, programs and OS features.
Stephen W Plunkett

The properties box for my Windows Server 2008 R2 built-in administrator program says the account is disabled. Even the primary user account has virtually no priveliges. How can I, with a mere primary user account available at logon,
enable the built-in administrator account, or otherwise grant my primary user account administrator priveliges? Windows Server 2008 R2 denies my primary user account access/permission for nearly all changes to accounts, programs and OS features.
Stephen W Plunkett
In some of the organisations, default admin accounts on member servers are purposefully locked/disabled through group policy for security reasons.
If you know the password for locked out/disabled admin account then there is a possibility of unlocking/re-enabling the account without using any third party tools.
To do that,
Restart the server
Press F8 and select Safe Mode Without
Networking
Log on to the server with locked out/disabled admin account with its password.
If you could successfully log on to the server then you will have option to unlock and enable the built-in admin account !
Most of the downtime's are caused because of SysAdmin's curiosity ! - Santosh

Windows Server 2008 - password protect network folders

I was tasked to password protect a few folders that are being shared in the network. The folders are stored in the server (that i have admin access) and anyone in the network have full access to the folders and the files inside those folders. The computers linked in the network have different OS - 3 running vista, 2 running xp and 1 windows server 2008. Anybody in the office can use the computers without being prompted for a password (except the server) and the folders are accessible through any of those computers.
The following are my questions:
1. Is it possible to password protect folders shared in the network? If so, if someone wants to access those password protected folder through any of the computers connected to the network, will they be prompted to enter a password to be able to access it or the system will just say "access denied?" If so, please give detailed instructions on how to do it.
2. If it is possible to password protect network folders, is it possible to put different passwords on each folders? If so please give detailed instructions on how to do it.
3. If it is not possible to do any of the mentioned above through windows, is it possible with the use of a third-party software? If so, what are those third party software?

Hi All, First time on this forum and am finding it very interesting (sorry about the proposed as answer above.. hit the wrong key).
I found this topic particularly interesting and am looking to do a similar thing but seemed to have gotten around it quite easily (if I am on the same lines as greggync777 that is).
My problem is this I have a Home Theatre Network set up in my lounge to several locations around the house with around 8 gb of videos/music/pics etc, all works fine on connected pc's with WMC (all using Windows 7) and all is shared by family for entertainment.
I also have a Seperate workstation where I do my work (video editing) which involves storing considerable amounts of footage and more importantly all the work files/folders all of which is confidential, at the moment is also on a seperate pc which also houses 8 hdd with around 6gb of ever growing video information.
My point is that both these PC's ( HTPC and my WORKSTATION) are a bit too noisy despite having installed the best I can afford fans/Samsung eco green hdd's. My desire is to build a main super server running WHS 2008 (The size/Cooling/Noise etc is not a problem due to where it will be located). My main concern is Security with so many in the family having direct access to the Server so I want to restrict which files/folders they can subsequently access once there. I want to be the only one to have access to my work from my PC and everyone else denied access. I have set up a test rig running WHS08 and have set up access with several PC's using passwords for the server etc which was straightforward after creating a user account for them on whs08, therein laid the problem of then how to keep them from accessing my side of the server which is when I hit up on this thread after much searching. Following one of the suggestions above I went to the folder in question (in my case this will be a plus as all my work will be in one main folder with several thousand sub folders) to the security tab/permissions etc and firstly removed access to everyone except the server administrator. I then granted access only to one PC on the network - the one that is my workstation together with a password ( I meant to say upto this point everyone I had given access to the server could access my test folder), went back to my PC and was able to access as normal after entering the password. I then went to every other PC on the network (that has access to the Server) where I am pleased to say all denied me access to my folder. (my work pc by the way is running XPsp3). Not sure if it will work for Greggync777 or if it what he is looking to do but it did for me. I apologise also if I have rambled on a bit for my first thread.
tks Dave

Administrators unable to write to a text file created by another Administrator on Windows Server 2008.

Why are Administrators unable to write to a text file created by another Administrator on Windows Server 2008?
--- The Administrators already have full control so how do I fix this? ---
Example: On a Windows Server 2008 (SP1): user A (who belongs to the Administrators group) logs in and creates a directory C:\foo and creates a file readme.txt in the foo directory. User B (also a member of the Administrators group) logs in and opens C:\foo\readme.txt in notepad. User B types something and tries to save the file. User B cannot save the file…an option to save as some other file name is presented. The security permissions of C:\foo\readme.txt show that Administrators have full control.
Work around 1: Explicitly add user B to have full control over the foo directory. The problem is that all the all other Administrators still need to be added (current and future).
Work around 2: Change the Users security permission to be full control on the foo directory. (this seems dangerous!)
It is interesting to not that this same procedure is not a problem in Windows Vista. (Any insight about the difference?)
Sincerely,
Ian

so there is no way to change this without literally shutting down the UAC?
I have files that I need to modify all the time, and it is very annoying to have to save as to my desktop modify and then copy and paste the file again.
I would also rather not give myself permissions to the entire C:\ Drive even specified Folders or documents, etc......
You can change these settings without bringing down the UAC

1.    Click Start, type gpedit.msc and press Enter.
2.    Expand Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

3.    Double-click “User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode” on the right pane.
a.    Choose “Elevate without prompting” and click OK.
b.    Double-Click “User Account Control: Admin Approval Mode for the Built-in Administrator account”, Click Enable, Apply and then OK
c.     Double-Click “User Account Control: Run all users, including administrators, as standard users”,Click Enable, Apply and then OK
Then reboot the Server. You should now have the ability to modify any document, etc....

Group Policy Administrative Templates not applying on Windows XP SP3 - Windows Server 2008 R2

I have a Windows 2008 R2 domain with windows 7, and Windows XP SP3 client workstations.
I have a group policy to deny all access to removable storage in policies/administrative templates/system in user configuration (actually its in the computer configuration as well)
The problem is the policy is having no effect on the Windows XP machines. It works perfectly on Windows 7 machines.
Group policy in general is working on the Windows XP machines, as I can successfully map drives, push out scheduled tasks, and push out printers. (All preferences I know and I have GP Preferences client side extensions installed).
Its almost like the windows XP machines can't "understand" the admin templates from Windows Server 2008 R2.
Do I need to install something on the windows XP machines? What could be the problem?

> Its almost like the windows XP machines can't "understand" the admin
> templates from Windows Server 2008 R2.
Simply read the "supported on" of these settings... Vista and above
required.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Windows Server 2008 - How to remotely manage account passwords?

I'm hoping to get direction on how to remotely manage 'user accounts' on Windows Server 2008 machines. The remote management would be from an automated perspective. For example, I have a custom application (maybe C#, Java, etc) that runs on one
server that makes connections to various 'Windows Server 2008' servers; and I want it to be able to do the following.
Query Windows Server 2008 box for full list of user accounts
Update password for user account
Lock account
Unlock account
Check policy information to find out when password may expire
I'm trying to find out what may already be available and running on Windows Server 2008 that I can take advantage to get this done programmatically.
-Wes

I agree with Mekac, the gallery should provide a lot of script of what you want to do.
Like ;
https://gallery.technet.microsoft.com/Password-Expiry-Email-177c3e27 - Password Expiry Email Notification.
Regards, Philippe
Don't forget to mark as answer or vote as helpful to help identify good information. ( linkedin endorsement never hurt too :o) )
Answer an interesting question ? Create a
wiki article about it!

[Windows Server 2008 R2] Slow login as administrator

Hello,
the login as an administrator takes too long (about 70 seconds). As an user I can login faster to the server (OS: Windows Server 2008 R2). It took less than 5 seconds.
There are no unnecessary startup items, neither in the task scheduler. I also checked the registry for damaged user profiles with the file extension ".bak". In the event viewer there's an entry with the ID no. 1530 from the source "User Profile
Service". Is this a suspicious issue? How can I accelerate the login as an administrator?

Hi,
Login to the server with administrator credentials and check for any specific policies implemented for admin account.
run rsop.msc or run a command C:\>gpresult /h adminpol.html & Open html file and search for applied group policies for admin user.
Still problem persists, create another user account with full admin right and check for the difference.
Regards, Ravikumar P

Can't log in as the Administrator on Windows Server 2008 R2

Hello,
I have a windows server 2008 R2 (DCSERVER) as the domain controller and about 10 Windows 7 Client machines on the network. I also have configured a WSUS server & File Server on this machine. Everything was working fine, until I added another Windows
7 Machine to the domain. I couldn't login to the domain and got the error "the security database on the server does not have a computer account for this workstation trust". I looked up on Google and tried some tricks - mainly adding the
attributes DNSHostName & ServicePrincipalName to the affected computer and the deleting the computer from the group
(since the previous trick didn't work).
But after trying the above I observed that I can't login to my DCSERVER either. I get the same error - "the security database on the server does not have a computer account for this workstation trust"
Please help me fix this issue.

Hi,
Thanks for your post.
According to your description, you cannot login the domain from Windows 7 client.
Please refer to the following article for troubleshooting:
http://www.computerbusinessconsultants.com/solved-the-security-database-on-the-server-does-not-have-a-computer-account-for-this-workstation-trust-relationship/
Regards.
Vivian Wang

Lms 3.2 and window server 2008 standard: License Server/Daemon Manager is down

LMS 3.2 and window server 2008 standard, get error when we try
Khi truy nhập vào menu chức năng:
License Server/Daemon Manager is down. Please check license.log for more information.
access licensing:
Error communicating with License Server. License Server may be down. Please start the License Server, then refresh the page.
Lincense.txt is file log of LMS
Must I have to active window server 2008 first ?
thank you very much ?

Hi ,
--Add the Casuser to the Administrator Group
and then reset the casuser password:
1. Go to CSCOpx\setup\support> and run the following command:
resetCasuser.exe
2. Restart the daemon manager:
Net stop crmdmgtd
Net start crmdmgtd
Let me know how it works
If above did not help then send me the syslog.log and screen shot of the EventViewer with the latest Application Error that you see there.
--also screen shot of the below directory :
NMSROOT\etc\license
Thanks
Afroj

Unable to open Office files on SharePoint 2010 sites on Windows Server 2008 R2

Setup: Windows SharePoint Server 2010 sp1 on Windows Server 2008 R2 (hosted on VMWare VSphere ESXi 5.1)
Secured using Domain SSL from GlobalSign.
Client OS: Windows 7 Professional 32bit & Windows XP SP3 32 bit
Browsers: IE10, IE9,IE8
Office: Office 2010, Office 2010 sp2 (both 32bit), Office 2007
Problem Description: Only recently, users started having issues with opening Office files (Word, Excel) on SharePoint sites. When you click on an Office file e.g. Word Document, it comes up with the option to select "Ready only" or "Edit"
and choosing either options and re-entering the login credentials results in the
application hanging. If you leave it for a while (about 5 minutes) sometimes the file opens and other times it gives the error "Could not open https://portal.com/XXX/XXX/Document.docx". Even when it opens, it's extremely
sluggish and can't do anything other than end it via Task Manager. Same with excel files.
This happens to all the users all different OS and browsers.
On XP Pro SP3 w/ IE8, when you click on the file, the login prompt keeps popping back up repeatedly and if you click cancel, the file loads up anyway but no way of saving back onto the SharePoint site.
IMPORTANT: One exception is when logged in as a Site Collection Administrator, it
works like a dream bizarrely!!!! Opens, Edits and saves back fine on the SharePoint site.
Have tried following:
1. Repaired Office 2010 Pro; Uninstalled/Re-installed Office 2010 Pro
2. Reset Browser, unticked automatically detect proxy settings.
3. Emptied OfficeOfflineCache on Client
4. Removed WebDAV from the SharePoint server
5. Added Antivirus folder exclusion (We use SEP 11) on the SharePoint Server
Note: PDF files opens fine for all users.
I would immensely appreciate if anybody has got any advice/pointers/suggestions. Desperately out of ideas at the moment.
regards,
Compter Sez No!

Hi,
According to your description, When you try to open a Microsoft Office document from a SharePoint 2010 site in a client application, the document opens slowly and you are prompted to enter your credentials multiple times.
This issue may be because of SharePoint Web Front End (WFE) server(s) has Antivirus software installed and the exceptions are not set correctly.
I recommend to remove the antivirus software or set the correct permissions for the antivirus software to resolve the issue.
To configure the antivirus exceptions, please follow the guidelines in the below articles:
KB943620:
Folders to exclude when you perform a file-level antivirus scan on a server operating system.
KB952167:
Certain folders may have to be excluded from antivirus scanning when you use a file-level antivirus program in SharePoint.
KB943556:
Recommended file and folder exclusions for Microsoft Forefront Client Security or Forefront Endpoint Protection 2010.
Best regards.
Thanks

Cisco LMS 4.1 Installation on Windows Server 2008 R2, Databases not created

Hi There,
As always, I am trying to install LMS 4.1 on windows server 2008 R2 and after the installation and login to the LMS I find the following:
DCRServer is down or may not be completely up. Check if the DCRServer process is running.
And after some troubleshooting I found that the LMS is not creating the CMF database and the other databases. Attached is the installation log file, if someone could help me with it would be appreciated. Please note the following:
1. I have downloaded the installation file from Cisco website twice, so I do not think it is the file that is corrupted, also it is only evaluation license.
2. I have met all the prerequisites and requirement as in the documentation guides, but maybe there is something still wrong.
Thanks,

Also Here is more info output:
C:\Program Files (x86)\CSCOpx>pdshow -brief
Process               State                                     Pid
Tomcat                Program started - No mgt msgs received    1572
TomcatMonitor         Running normally                          2236
Apache                Program started - No mgt msgs received    2436
DataPurge             Administrator has shut down this server   0
DCRServer             Failed to run                             0
CMFOGSServer          Administrator has shut down this server   0
EssentialsDM          Administrator has shut down this server   0
ConfigMgmtServer      Never started                             0
ConfigUtilityService Never started                             0
CTMJrmServer          Administrator has shut down this server   0
ChangeAudit           Never started                             0
SyslogAnalyzer        Program started - No mgt msgs received    2976
ICServer              Running normally                          5096
EnergyWise            Never started                             0
PMCOGSServer          Administrator has shut down this server   0
IPMOGSServer          Administrator has shut down this server   0
IPMProcess            Never started                             0
TISServer             Program started - No mgt msgs received    2544
DFMOGSServer          Program started - No mgt msgs received    876
InventoryCollector    Running normally                          3052
Interactor            Program started - No mgt msgs received    5136
InventoryCollector1   Program started - No mgt msgs received    5144
Interactor1           Program started - No mgt msgs received    5308
PTMServer             Program started - No mgt msgs received    5320
UPMProcess            Never started                             0
TISDiscoveryJobCreate Administrator has shut down this server   0
SyslogCollector       Running normally                          5340
Proxy                 Program started - No mgt msgs received    5348
PMServer              Running normally                          5360
NameServer            Program started - No mgt msgs received    5680
NameServiceMonitor    Running normally                          5876
LicenseServer         Program started - No mgt msgs received    5884
FHPurgeTask           Never started                             0
EventFramework        Program started - No mgt msgs received    5892
EPMServer             Program started - No mgt msgs received    5904
FHServer              Administrator has shut down this server   0
NOSServer             Program started - No mgt msgs received    5580
diskWatcher           Running normally                          5640
DFMMultiProcLogger    Program started - No mgt msgs received    5864
DFMLogServer          Program started - No mgt msgs received    4896
DFMCTMStartup         Administrator has shut down this server   0
DfmBroker             Running normally                          6104
DfmServer             Running normally                          6416
DfmServer1            Running normally                          6424
DCRDevicePoll         Never started                             0
CSRegistryServer      Running normally                          6432
CSDiscovery           Never started                             0
AdapterServer1        Program started - No mgt msgs received    6440
AdapterServer         Program started - No mgt msgs received    6448
C:\Program Files (x86)\CSCOpx>pdshow DCRServer
        Process= DCRServer
        State = Failed to run
        Pid    = 0
        RC     = -3
        Signo = 1073741821
        Start = N/A
        Stop   = 07/02/2012 17:39:06
        Core   = Not applicable
        Info   = Application failed or was registered incorrectly.
C:\Program Files (x86)\CSCOpx>net stop crmdmgtd
The Cisco Prime Daemon Manager service is stopping..........................................
The Cisco Prime Daemon Manager service was stopped successfully.
C:\Program Files (x86)\CSCOpx>bin\perl.exe objects\db\conf\configureDb.pl action=validate dsn=cmf
INFO: C:\PROGRA~2\CSCOpx/objects/db/conf/ConfigureDB.LOCK locked for the operation...
ERROR: [StandardDbUpgrade] : Database cmf is not installed.
INFO: C:\PROGRA~2\CSCOpx/objects/db/conf/ConfigureDB.LOCK released for the future operations...
C:\Program Files (x86)\CSCOpx>bin\perl.exe bin\dbpasswd.pl all
ERROR: There is no database available to change password.
C:\Program Files (x86)\CSCOpx>bin\perl.exe bin\dbRestoreOrig.pl dsn=cmf dmprefix=Cmf npwd=pwd
'cmf' is not a valid data source for the product.

Windows Server 2008 R2 SP1 - BSOD Stop Error 0x00000050 RDPWD.SYS

Hi all,
I have been struggling with a BSOD for the past 5 weeks and have scoured the web trying in vain to find someone else with the same issue.
Environment:
8 x 2008 R2 SP1 Windows Servers (8Gb RAM, 25Gb HDD) with Remote Desktop Services Roles installed, running as part of an RDS Farm. All Servers are VM Guests (hardware version 7) running on VMware vSphere v4.1.0-260247 Hosts (Dell
PowerEdge R710 - 128Gb RAM). Our vSphere 'farm' has 5 Hosts that connect to our EMC SAN via iSCSI with multipath routes.
Each RDS Server is load balanced via a Connection Broker, and each server has the same set of software / vm hardware installed. In a nutshell, each has Symantec Endpoint Protection v11.0.5002.333, Symantec Altiris v7.0, Microsoft Office 2007 as well as
other various software essential to these servers.
Symptoms:
Randomly throughout the day, one (or more) of the RDS Servers will crash with a BSOD more often than not with "caused by driver ntoskrnl.exe" sometimes with "cng.sys" and once with "ksecpkg.sys". So far in the 5 weeks I have had 90 crashes. Yesterday
all 8 of the RDS Servers crashed at some point throughout the day.
On a typical BSOD, it says:
The problem seems to be caused by the following file: ntoskrnl.exe
PAGE_FAULT_IN_NONPAGED_AREA
Technical Information:
*** STOP: 0x00000050 (0xfffffa800c153284, 0x0000000000000001, 0xfffff880053dc0c9, 0x0000000000000000)
*** ntoskrnl.exe - Address 0xfffff8000169ac40 base at 0xfffff8000161e000 DateStamp 0x4e02aaa3
Using BlueScreenView it says "caused by address: ntoskrnl.exe+7cc40" nearly every time.
I have analysed as best I could using Microsoft WinDbg, and this is the output of a typical mini-dump file:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\hqrds01\c$\Windows\Minidump\030112-19359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows (x64)\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01609000 PsLoadedModuleList = 0xfffff800`0184e670
Debug session time: Thu Mar 1 09:14:00.921 2012 (UTC + 0:00)
System Uptime: 0 days 21:31:41.950
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                        Bugcheck Analysis
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa800be83284, 1, fffff8800576f0c9, 0}
Could not read faulting driver name
Probably caused by : RDPWD.SYS ( RDPWD!memcpy+1d9 )
Followup: MachineOwner
1: kd> !analyze -v
*                        Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800be83284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800576f0c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018b8100
fffffa800be83284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800bf70a80 -- (.trap 0xfffff8800bf70a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000023d rbx=0000000000000000 rcx=fffffa800be83284
rdx=ffffffffffe7e63b rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800576f0c9 rsp=fffff8800bf70c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0033401e8 r10=fffff8a0033401e8
r11=fffffa800be83268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax ds:0c40:fffffa80`0be83284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016319fc to fffff80001685c40
STACK_TEXT:
fffff880`0bf70918 fffff800`016319fc : 00000000`00000050 fffffa80`0be83284 00000000`00000001 fffff880`0bf70a80 : nt!KeBugCheckEx
fffff880`0bf70920 fffff800`01683d6e : 00000000`00000001 fffffa80`0be83284 00000000`00000000 fffff8a0`0be85820 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0bf70a80 fffff880`0576f0c9 : fffff880`057547cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0bf70c18 fffff880`057547cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`0576c99d : RDPWD!memcpy+0x1d9
fffff880`0bf70c20 fffff880`0576c9fc : fffff8a0`0f938010 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0bf70c60 fffff880`0576b354 : fffff880`0bf70da0 fffff8a0`033401e8 00000000`00000000 fffff880`0576abfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0bf70d10 fffff880`0576af64 : 00000000`00000031 fffffa80`0bd01895 00000006`0000001f fffff880`05739079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0bf70d50 fffff880`029ba1f8 : fffff8a0`03345000 fffffa80`0bae6e80 fffffa80`0a5c0e60 fffff880`05737e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0bf70df0 fffff880`057378d0 : 00000000`00000000 fffff880`0bf70f10 fffff880`0bf70f08 00000000`00000000 : termdd!IcaRawInput+0x50
fffff880`0bf70e20 fffff880`05736d85 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0bf70e50 fffff880`057367c2 : fffffa80`088e8a28 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0bf70ef0 fffff880`029ba1f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0bf70f60 fffff880`0572c4c5 : fffffa80`088e8a10 fffffa80`0bd01658 00000000`00000000 fffffa80`088e8a10 : termdd!IcaRawInput+0x50
fffff880`0bf70f90 fffff880`029baf3e : fffffa80`0bd01620 fffffa80`0c100420 fffffa80`0bd4b450 fffffa80`0973b9b0 : tdtcp!TdInputThread+0x465
fffff880`0bf71810 fffff880`029b9ae3 : fffffa80`09d902b0 fffffa80`0973b9b0 fffffa80`093d8520 fffffa80`0bd4b450 : termdd!IcaDriverThread+0x5a
fffff880`0bf71840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
The RDS servers are set to reboot automatically, and after a period of 5 minutes or so, the users can reconnect and log back in. On a typical day each server will have around 10 people RDP'd in to them.
The Users connecting to the RDS Servers included XP laptops/desktops and IGEL UD-120-LX Thin Terminals. The XPs have SP3 installed and are fully patched via Symantec Altiris.
Things I have tried:
- Analyse the dump-files (as per above).
- I have tracked each user logging on to the RDS Farm (via batch scripts) and tried to determine if this is caused by the same individual(s) but it appears random.
- Check to see if the crashing Virtual Machine is running on a specific host, but it has happened on all Hosts.
- Check to see if there was anything specific that happened on the day that the crashes started. There were about 5 new poeple introduced to the RDS Farm at that time, but there were using (a) client machines that had been used previously elsewhere with
no issues, (b) software that had been used previously, (c) in a remote location that had previous users using RDS, (d) have not been logged on to a RDS Server when it has crashed.
- Updated Windows Server 2008 R2 SP1 to the latest patches (as of Feb 2012).
- Turned on Verifier (using recommended settings), and then analysed dump-files with the same reference to rdpwd.sys.
- Fixed the Memory Resource Reservation in vSphere to the full 8Gb for all these RDS Servers (so that the memory is not shared at all).
- Ran MEMTEST on a VM Guest with the full 8Gb RAM, on a couple of the ESX Hosts.
- Changed the VMTools Video Driver to the SVGA II driver from the Standard VGA Driver.
- Ran a full AV Scan (using SEP).
- Isolated the Printer Drivers using the Printer Management MMC.
- Ran sfc /scannow of all RDS Servers and rebooted.
The mini-dump file mentioned above is here:https://skydrive.live.com/redir.aspx?cid=48f471f287af2349&resid=48F471F287AF2349!105&parid=48F471F287AF2349!103
I hope someone can help, as what hair I have left (from pulling it out) is turning grey!
Andy

*                        Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800c153284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880053dc0c9, If non-zero, the instruction address which referenced the bad memory
   address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018cd100
fffffa800c153284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800aa48a80 -- (.trap 0xfffff8800aa48a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001ff rbx=0000000000000000 rcx=fffffa800c153284
rdx=ffffffffffee6b8b rsi=0000000000000000 rdi=0000000000000000
rip=fffff880053dc0c9 rsp=fffff8800aa48c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0123923a8 r10=fffff8a0123923a8
r11=fffffa800c153268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax ds:8c40:fffffa80`0c153284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016469fc to fffff8000169ac40
STACK_TEXT:
fffff880`0aa48918 fffff800`016469fc : 00000000`00000050 fffffa80`0c153284 00000000`00000001 fffff880`0aa48a80 : nt!KeBugCheckEx
fffff880`0aa48920 fffff800`01698d6e : 00000000`00000001 fffffa80`0c153284 00000000`00000000 fffff8a0`10919830 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0aa48a80 fffff880`053dc0c9 : fffff880`053c17cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0aa48c18 fffff880`053c17cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`053d999d : RDPWD!memcpy+0x1d9
fffff880`0aa48c20 fffff880`053d99fc : fffff8a0`10cf30d0 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0aa48c60 fffff880`053d8354 : fffff880`0aa48da0 fffff8a0`123923a8 00000000`00000000 fffff880`053d7bfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0aa48d10 fffff880`053d7f64 : 00000000`00000031 fffffa80`0c039de5 00000006`0000001f fffff880`053a6079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0aa48d50 fffff880`012c01f8 : fffff8a0`12393000 fffffa80`0bb7aa60 fffffa80`0b81e9c0 fffff880`053a4e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0aa48df0 fffff880`053a48d0 : 00000000`00000000 fffff880`0aa48f10 fffff880`0aa48f08 fffffa80`0c039ba8 : termdd!IcaRawInput+0x50
fffff880`0aa48e20 fffff880`053a3d85 : fffff880`01716890 fffffa80`0c0327e8 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0aa48e50 fffff880`053a37c2 : fffffa80`0c16e598 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0aa48ef0 fffff880`012c01f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0aa48f60 fffff880`052994c5 : fffffa80`0c16e580 fffffa80`0c039ba8 00000000`00000000 fffffa80`0c16e580 : termdd!IcaRawInput+0x50
fffff880`0aa48f90 fffff880`012c0f3e : fffffa80`0c039b70 fffffa80`0acccf20 fffffa80`0a95c450 fffffa80`0abf9620 : tdtcp!TdInputThread+0x465
fffff880`0aa49810 fffff880`012bfae3 : fffffa80`0c0a6560 fffffa80`0abf9620 fffffa80`087eee80 fffffa80`0a95c450 : termdd!IcaDriverThread+0x5a
fffff880`0aa49840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
Bug Check Code 0x50:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559023%28v=vs.85%29.aspx
Please start by that:
Update all possible drivers
Uninstall all unused programs
Disable all security softwares you have
Run chkdsk /r /f and sfc /scannow
Run memtest86+ to check if all is okay with your RAM. If an error was detected then replace the faulty RAM or contact your manufacturer Technical Support
If this does not help then upload MEMORY.DMP file (You can zip it and divide it using 7-ZIP) using Microsoft Skydrive and post a link here.
You can also contact Microsoft CSS for assistance.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft
Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

Windows Server 2008 : Administrator Password reset

Similar Messages

Maybe you are looking for