Windows Server Troubleshooting - Blue Screen

Click here to start saving with ING DIRECT!

Home | Up | Methodology | Architecture | Memory | Processor | Registry | File System | Network | Active Directory | Contents

Get the Book

Major Topics
Methodology
Architecture
Tools
Memory
Processor
Registry
File System
Network
Active Directory
Contents
Other Topics
Task Manager
System Monitor
Computer Management
SystemInfo
Device Manager
Auditing
Start Options
Terminal Services
Blue Screen
Help Center
Fault Tolerance
Microsoft
More Information
More Detail

eXpert Genealogy

Memory from Crucial.com


2003-2006 Team Approach Limited
All rights reserved


When Windows detects a error while in user mode, it shuts down the offending application and initiates Dr. Watson. Although it is unfortunate that the application failed, other applications and the operating system are protected and continue the operate normally.

When Windows detects an error in kernel mode, it stops everything to prevent further damage. This is much more serious because all applications stop. The Control Panel System properties has a Startup and Recovery dialog which allows you to specify options for a kernel mode system failure.

 

A kernel mode system failure will produce a STOP error message commonly known as the blue screen of death. The following are examples of the blue screen of death. The critical information to look for on the screen is the name of the program that caused of the failure. In the first example we see that it is wdmaud.sys and in the second example we see  wxyz.sys. Once we know the module, we can determine who will provide the fix for this problem. In most cases, kernel mode errors come from Windows code and we look to Microsoft for hotfixes or service packs. In some cases it is a device driver vendor and we must get the fix from the companies that supply the device driver. Most companies maintain support web sites where fixed and improved drivers can be downloaded.


Stop Errors are caused by software running in kernel mode either

  • encountering an software bug or
  • encountering a hardware problem that cannot be resolved.

Most kernel mode software is part of Microsoft's Windows operating system but some device drivers come from other companies. In many cases, the stop error can only be fixed by a hotfix or service pack provided by Microsoft. In other cases, a new device driver will fix the problem. In these cases, knowing which organization will provide the solution is the important information.  Knowing exactly what bug is encountered does not help us, because we are not able to fix the software.

In some cases, as specific hardware problem is identified.

Code Text Description
0x0000007B INACCESSIBLE_BOOT_DEVICE Check hard disk hardware.
During startup, %systemroot% became inaccessible
0x0000002E DATA_BUS_ERROR Replace faulty memory if this is repeated.
A parity error in the system memory.

In many other cases, it is a device driver problem and you need to do the following

  • Check that you have adequate disk space, especially for new installations
  • Disable any newly installed drivers. You might also want to disable a service associated with the driver or any newly installed programs
  • If the computer will not start normally, try starting it in Last Known Good Configuration or in safe mode, and then remove or disable newly added programs or drivers
  • Ensure that you have the latest system BIOS

The following table describes some of the stop errors.

Code Text Description
0x0000000A IRQ NOT LESS OR EQUAL Drivers are using improper memory addresses.
0x0000001E KMODE_EXCEPTION_NOT_HANDLED Disable any newly installed drivers. You might also want to disable a service associated with the driver or any newly installed programs
0x00000050 PAGE_FAULT_IN_NONPAGED_AREA Requested data is not found in memory. This might be caused by a printer driver or remote access driver.
0x00000024 NTFS_FILE_SYSTEM The hard disk is fragmented or there is excessive file I/O. This Stop error may also be cause by drive-mirroring or some antivirus software.
0x0000007F UNEXPECTED_KERNEL_MODE_TRAP This is usually caused by a hardware failure.
0x4C000221 BAD_IMAGE_CHECKSUM This message might be caused by a corrupted system file or driver or a hardware problem.
0x4C00021A FATAL_SYSTEM_ERROR The Windows Logon Process system process terminated unexpectedly.
0x00000077 KERNEL_STACK_INPAGE_ERROR Bad sectors on the hard disk, Defective or loose cabling, improper SCSI termination, or the controller not seeing the hard disk, Another device is causing a resource conflict with the storage controller, Failing RAM
0x0000007A KERNEL_DATA_INPAGE_ERROR a bad sector in a paging file, a virus, a disk controller error, defective hardware, or failing RAM
0x00000079 MISMATCHED_HAL the hardware abstraction layer (HAL) and the kernel or the computer type do not match. This error occurs when single-processor and multiprocessor configuration files are mixed on the same system.

Keyboard Exercise

Caution! This exercise will cause your system fail to a blue screen. Ensure that you have backup all of your data and you are prepared to reinstall Windows and all applications of your computer. Do not delete any registry entries other than those in CurrentControlSet, because this is the only section that can be repaired by using the Last Known Good Configuration.

Use REGEDIT and find the key in the current control set that corresponds to your disk controller. For computers with an IDE controller, it is at

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi

Delete this key and reboot your system. It will not start and will produce a blue screen indicating an INACCESSIBLE_BOOT_DEVICE. Restart your computer again, but this time press F8 during the startup to get the startup options. Select the Last Known Good Configuration and your system should start normally. If your system does not start normally, you will need to reinstall everything.