Windows 2012 server crashes.

**crashtestmac** · 21st August 2013

I have put this in Windows 8 section but it is a server 2012 issue.

I have a home server that is doing my nut in. It keeps blue screening. I have sorted it out before and i removed Serviio as that was causing it to fail, at least the FFDSHOW was.

TiWorker has caused problems before but it has reared its head again after it all working great for 2 months running Plex.

The box is a HP Microserver
250gb c:
6tb raid 5 d:

this is the crash dump.

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.




Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available


Symbol search path is: srv*c:\cache*http://msdl.microsoft.com/download/symbols;srv*
Executable search path is: srv*
Windows 8 Kernel Version 9200 MP (2 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Built by: 9200.16628.amd64fre.win8_gdr.130531-1504
Machine Name:
Kernel base = 0xfffff802`45883000 PsLoadedModuleList = 0xfffff802`45b4fa20
Debug session time: Tue Aug 20 22:49:45.696 2013 (UTC + 1:00)
System Uptime: 0 days 0:03:10.668
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007f6`baad8018).  Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 3B, {c0000005, fffff80245ce0b58, fffff880077b7550, 0}


Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1b0 )


Followup: MachineOwner
---------


1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80245ce0b58, Address of the instruction which caused the bugcheck
Arg3: fffff880077b7550, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.


Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.


FAULTING_IP: 
nt!CmpKcbCacheLookup+1b0
fffff802`45ce0b58 418b41f4        mov     eax,dword ptr [r9-0Ch]


CONTEXT:  fffff880077b7550 -- (.cxr 0xfffff880077b7550)
rax=00000000000001ea rbx=0000000000000000 rcx=0000000000000273
rdx=00000000000000d1 rsi=fffff8a001bae010 rdi=fffff880077b8180
rip=fffff80245ce0b58 rsp=fffff880077b7f50 rbp=0000000000000005
 r8=0000000000000009  r9=ef1a3078ca47d90e r10=000000000000ffff
r11=0000000000000000 r12=fffff8a00279fa70 r13=fffff880077b85a8
r14=0000000000000005 r15=fffff880077b81f8
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!CmpKcbCacheLookup+0x1b0:
fffff802`45ce0b58 418b41f4        mov     eax,dword ptr [r9-0Ch] ds:002b:ef1a3078`ca47d902=????????
Resetting default scope


DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT


BUGCHECK_STR:  0x3B


PROCESS_NAME:  TiWorker.exe


CURRENT_IRQL:  0


LAST_CONTROL_TRANSFER:  from fffff80245ce325d to fffff80245ce0b58


STACK_TEXT:  
fffff880`077b7f50 fffff802`45ce325d : fffff880`077b8180 fffff8a0`00000006 fffff880`077b8590 fffff880`077b8570 : nt!CmpKcbCacheLookup+0x1b0
fffff880`077b8040 fffff802`45cce659 : fffff880`01200000 00000000`00000801 fffff880`077b8680 00000000`00000000 : nt!CmpBuildHashStackAndLookupCache+0x37d
fffff880`077b84b0 fffff802`45caca85 : fffffa80`08355720 fffffa80`08355720 00000000`0000019c 00000000`00000000 : nt!CmpParseKey+0x319
fffff880`077b8830 fffff802`45cbc3f8 : 00000000`00000000 fffff880`077b89f8 00000000`00000040 fffffa80`066c0730 : nt!ObpLookupObjectName+0x806
fffff880`077b8980 fffff802`45ce7521 : 00000000`00000000 00000096`b632c150 fffff8a0`0a721001 fffff802`45c9141d : nt!ObOpenObjectByName+0x258
fffff880`077b8a50 fffff802`45ce8f4b : fffffa80`07b37080 ffff9802`30a7f5a8 00000096`b632c700 00000000`00000000 : nt!CmOpenKey+0x2a0
fffff880`077b8c00 fffff802`458dc453 : fffffa80`07b0a080 fffffa80`07b0a080 fffff880`077b8cc0 00000000`0000002e : nt!NtOpenKeyEx+0xf
fffff880`077b8c40 000007fc`72513c4b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000096`b632bb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fc`72513c4b




FOLLOWUP_IP: 
nt!CmpKcbCacheLookup+1b0
fffff802`45ce0b58 418b41f4        mov     eax,dword ptr [r9-0Ch]


SYMBOL_STACK_INDEX:  0


SYMBOL_NAME:  nt!CmpKcbCacheLookup+1b0


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: nt


IMAGE_NAME:  ntkrnlmp.exe


DEBUG_FLR_IMAGE_TIMESTAMP:  51a966cd


STACK_COMMAND:  .cxr 0xfffff880077b7550 ; kb


BUCKET_ID_FUNC_OFFSET:  1b0


FAILURE_BUCKET_ID:  0x3B_nt!CmpKcbCacheLookup


BUCKET_ID:  0x3B_nt!CmpKcbCacheLookup


Followup: MachineOwner
---------


1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80245ce0b58, Address of the instruction which caused the bugcheck
Arg3: fffff880077b7550, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.


Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.


FAULTING_IP: 
nt!CmpKcbCacheLookup+1b0
fffff802`45ce0b58 418b41f4        mov     eax,dword ptr [r9-0Ch]


CONTEXT:  fffff880077b7550 -- (.cxr 0xfffff880077b7550)
rax=00000000000001ea rbx=0000000000000000 rcx=0000000000000273
rdx=00000000000000d1 rsi=fffff8a001bae010 rdi=fffff880077b8180
rip=fffff80245ce0b58 rsp=fffff880077b7f50 rbp=0000000000000005
 r8=0000000000000009  r9=ef1a3078ca47d90e r10=000000000000ffff
r11=0000000000000000 r12=fffff8a00279fa70 r13=fffff880077b85a8
r14=0000000000000005 r15=fffff880077b81f8
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!CmpKcbCacheLookup+0x1b0:
fffff802`45ce0b58 418b41f4        mov     eax,dword ptr [r9-0Ch] ds:002b:ef1a3078`ca47d902=????????
Resetting default scope


DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT


BUGCHECK_STR:  0x3B


PROCESS_NAME:  TiWorker.exe


CURRENT_IRQL:  0


LAST_CONTROL_TRANSFER:  from fffff80245ce325d to fffff80245ce0b58


STACK_TEXT:  
fffff880`077b7f50 fffff802`45ce325d : fffff880`077b8180 fffff8a0`00000006 fffff880`077b8590 fffff880`077b8570 : nt!CmpKcbCacheLookup+0x1b0
fffff880`077b8040 fffff802`45cce659 : fffff880`01200000 00000000`00000801 fffff880`077b8680 00000000`00000000 : nt!CmpBuildHashStackAndLookupCache+0x37d
fffff880`077b84b0 fffff802`45caca85 : fffffa80`08355720 fffffa80`08355720 00000000`0000019c 00000000`00000000 : nt!CmpParseKey+0x319
fffff880`077b8830 fffff802`45cbc3f8 : 00000000`00000000 fffff880`077b89f8 00000000`00000040 fffffa80`066c0730 : nt!ObpLookupObjectName+0x806
fffff880`077b8980 fffff802`45ce7521 : 00000000`00000000 00000096`b632c150 fffff8a0`0a721001 fffff802`45c9141d : nt!ObOpenObjectByName+0x258
fffff880`077b8a50 fffff802`45ce8f4b : fffffa80`07b37080 ffff9802`30a7f5a8 00000096`b632c700 00000000`00000000 : nt!CmOpenKey+0x2a0
fffff880`077b8c00 fffff802`458dc453 : fffffa80`07b0a080 fffffa80`07b0a080 fffff880`077b8cc0 00000000`0000002e : nt!NtOpenKeyEx+0xf
fffff880`077b8c40 000007fc`72513c4b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000096`b632bb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fc`72513c4b




FOLLOWUP_IP: 
nt!CmpKcbCacheLookup+1b0
fffff802`45ce0b58 418b41f4        mov     eax,dword ptr [r9-0Ch]


SYMBOL_STACK_INDEX:  0


SYMBOL_NAME:  nt!CmpKcbCacheLookup+1b0


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: nt


IMAGE_NAME:  ntkrnlmp.exe


DEBUG_FLR_IMAGE_TIMESTAMP:  51a966cd


STACK_COMMAND:  .cxr 0xfffff880077b7550 ; kb


BUCKET_ID_FUNC_OFFSET:  1b0


FAILURE_BUCKET_ID:  0x3B_nt!CmpKcbCacheLookup


BUCKET_ID:  0x3B_nt!CmpKcbCacheLookup


Followup: MachineOwner
---------

Anyone any ideas for what i can try, google is not helping much...
Ta

**raelmadrid** · 21st August 2013

obvious one but are all windows updates done?

i'm running 2012 x64 on hp microserver here, not had 1 crash since install

**tombott** · 21st August 2013

Have you run a memory check on it?
If not get hold of Hiren boot CD and use the memory test utility.

**crashtestmac** · 21st August 2013

I think i will have to run a mem check and and hdd check.

It has 8gb of RAM in it, i have had a LOT of failures, but i used to have it set to reboot when error and no password so it logged straight in. Now i have PLEX running on it and active over the web it seems a bit daft to have it running with no password.

It has become more noticeable because you have to log it in to use plex.

**hoponbaby** · 21st August 2013

MY one server running 12 had been waiting to be restarted after windows updates for a few weeks, finally did it and it went in to a reboot loop which I couldn't get it to recover from, ended up doing a full reinstall

Thankfully the only thing on there was a couple of VM's which I just moved to another host.

**keyser666** · 20th September 2013

Can you run driver identifier? Also is that the only dump?
I would advise if you have that hardware that it would probably be easier to use a hypervisor and use that instead of the the OS on the machine itself. You can then create as many snapshots as you want along the way and always revert back. Also gives you the opportunity to create as many images as you want fro various different uses