DATA DUMP, 0x0000000A, ntkrnlmp.exe

Hi everyone, here is some background first. I am trying to do a "proof of concept" for a disaster recovery project.

I am trying to recover a root domain controller from an IBM xSeries 365 to an IBM xSeries 360. In two weeks during a live test I have to go from an IBM 365 to a Dell PowerEdge 6650. That should be fun, hah.

I load a plain jane copy of Windows 2003 w/SP1 onto the 360 and then I then boot into Directory Services Restore Mode. At this point restore the data drives D: (NTDS.dit) and E: (Logs) from the Root DC (the 365). I then restore C: and System State. Upon reboot I am getting a 0x0000000A stop event. If I reboot it is the same stop and parameters each time. The system will boot just fine into Safe Mode, Safe Mode with Networking, or Directory Services Restore Mode.

Both system HALs are ACPI Multprocessor PCs, but the CPUs themselves are not the same. Could this be the issue? Should I try a inplace upgrade/repair?

IBM xSeries 365
OS Name Microsoft(R) Windows(R) Server 2003, Enterprise Edition
Version 5.2.3790 Service Pack 1 Build 3790
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name ROOT-DC
System Manufacturer IBM
System Model eServer xSeries 365 -[88626RX]-
System Type X86-based PC
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
Processor x86 Family 15 Model 2 Stepping 6 GenuineIntel ~3000 Mhz
BIOS Version/Date IBM -[RDJT33AUS-1.13]-, 6/8/2005
SMBIOS Version 2.3
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume3
Locale United States
Hardware Abstraction Layer Version = "5.2.3790.1830 (srv03_sp1_rtm.050324-1447) "
User Name DOMAIN\Admin
Time Zone Eastern Standard Time
Total Physical Memory 3,583.20 MB
Available Physical Memory 1.89 GB
Total Virtual Memory 1.36 GB
Available Virtual Memory 9.93 MB
Page File Space 2.00 GB
Page File C:\pagefile.sys

IBM xSeries 360
OS Name Microsoft(R) Windows(R) Server 2003, Enterprise Edition
Version 5.2.3790 Service Pack 1 Build 3790
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name ROOT-DC
System Manufacturer IBM
System Model eServer xSeries 360 -[86862RY]-
System Type X86-based PC
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
Processor x86 Family 15 Model 1 Stepping 1 GenuineIntel ~1500 Mhz
BIOS Version/Date IBM -[RUKT58AUS-1.14]-, 6/1/2004
SMBIOS Version 2.3
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.2.3790.1830 (srv03_sp1_rtm.050324-1447) "
User Name DOMAIN\Admin
Time Zone Eastern Standard Time
Total Physical Memory 3,583.39 MB
Available Physical Memory 2.93 GB
Total Virtual Memory 1.33 GB
Available Virtual Memory 963.23 MB
Page File Space 2.00 GB
Page File C:\pagefile.sys

Dump Info
Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Dump\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: D:\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (8 procs) Free x86 compatible
Product: LanManNt, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Thu Feb 9 10:03:31.640 2006 (GMT-5)
System Uptime: 0 days 0:01:05.296
Loading Kernel Symbols
.....................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {16, 1b, 0, 80847491}

Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+4c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80847491, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000016

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KeSetEvent+4c
80847491 385816 cmp [eax+0x16],bl

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80847491 to 80837ed5

IRP_ADDRESS: 8a64d008

DEVICE_OBJECT: 8ab2d020

DRIVER_OBJECT: 8ab14030

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42435e60

MODULE_NAME: nt

FAULTING_MODULE: f71fd000 Ntfs

STACK_TEXT:
baac4b34 80847491 badb0d00 00000000 e1459268 nt!KiTrap0E+0x2a7
baac4bb8 80829ebf 01ac4168 00000000 00000000 nt!KeSetEvent+0x4c
baac4c10 8084ef55 8a64d048 baac4c5c baac4c50 nt!IopCompleteRequest+0x239
baac4c60 808472e1 00000000 00000000 00000000 nt!KiDeliverApc+0xbb
baac4c70 8095d6a8 00000000 e12ca928 8a548d88 nt!KiCheckForKernelApcDelivery+0x1c
baac4cb0 809317ff 8a548e68 8a548e68 baac4d14 nt!MmMapViewOfSection+0x285
baac4d34 80834d3f 000004b8 ffffffff 006cf6c8 nt!NtMapViewOfSection+0x206
baac4d34 7c82ed54 000004b8 ffffffff 006cf6c8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
006cf5f4 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!KeSetEvent+4c
80847491 385816 cmp [eax+0x16],bl

FAULTING_SOURCE_CODE:

 

Hi,

The culprit is faulty memory. You can run memtest to stress the ram. If memtest reports the ram is faulty, ram is bad. However Memtest is not a perfect tool to test the memory as some faulty ram can pass memtest.

Suggestion
1. Check the temperature of the CPU and make sure that it is not overheat (ie temperature < 60C)
Make sure that the CPU fan works properly
2. Reseat the memory stick to another memory slot. Reseat video card as well.
3. Downclock the ram. Check to default setting if you video card is overclocked.
4. Clean the dust inside the computer case
5. Make sure that the ram is compatible to the motherboard
6. Check the bios setting about memory timing and make sure that it is on
For example : DIMM1 and DIMM2 do not have the same timing.
DIMM1: Corsair CMX512-3200C2 512 MB PC3200 DDR SDRAM (2.5-3-3-8 @ 200 MHz) (2.0-3-3-7 @ 166 MHz)
DIMM2: Corsair CMX512-3200C2 512 MB PC3200 DDR SDRAM (3.0-3-3-8 @ 200 MHz)
DIMM3: Corsair CMX512-3200C2 512 MB PC3200 DDR SDRAM (3.0-3-3-8 @ 200 MHz)
7. Make sure that your PSU has adequate power to drive all the hardware including USB devices
8. Run chkdsk /r at command prompt
9. Run 3DMark 2005 to test your video card
10. Upgrade BIOS and make sure that the motherboard has no leaking capacitor

If it still crashes, diagnostic which memory stick is faulty
Take out one memory stick. If windows does not crash, the removed memory stick is faulty.

 

Sorry for not following up on this. I ended up getting it to work, but by doing things a different way. Our domain controllers look like this.

C:\ : Operating System
D:\ : Active Directory Database
E:\ : Active Directory Logs

I ended up only restoring E:\ and System State (which took care of the DB on D:\) in Directory Services Restore Mode and the machine is up and running fine. I did have to do some other things since C:\ wasn't restored like reinstalling...

Admin Tools
Support Tools
GPO Console
Antivirus Software

...but it took minimal time for that to be done.