Windows 2003 BSOD during user logon

Hello,

I am looking for some help on the BSOD that's occuring on W2K3 during user logon. Below is the windbg log which I have generated from the memory.dmp file as per your another KB article. ANy help in identifying the root cause will be greatly appreciated. - steve

Begin Log

Opened log file 'c:debuglog.txt'
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [\\dunham-fp\c$\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.101019-0340
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Fri May 25 11:46:34.959 2012 (UTC + 1:00)
System Uptime: 0 days 0:13:41.937
Loading Kernel Symbols
..................................
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................
...............................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffcfff8, 0, 8089b738, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+28b )
Followup: MachineOwner
---------
0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffcfff8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8089b738, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------

READ_ADDRESS: fffcfff8
FAULTING_IP:
nt!ExFreePoolWithTag+28b
8089b738 668b4602 mov ax,word ptr [esi+2]
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 1
TRAP_FRAME: f78f6c6c -- (.trap 0xfffffffff78f6c6c)
.trap 0xfffffffff78f6c6c
ErrCode = 00000000
eax=fffcff00 ebx=fffcfffe ecx=00000000 edx=fffcfffe esi=fffcfff6 edi=00000000
eip=8089b738 esp=f78f6ce0 ebp=f78f6d2c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExFreePoolWithTag+0x28b:
8089b738 668b4602 mov ax,word ptr [esi+2] ds:0023:fffcfff8=????
.trap
Resetting default scope
LAST_CONTROL_TRANSFER: from 808692d3 to 8087c4e0
STACK_TEXT:
f78f6c04 808692d3 00000050 fffcfff8 00000000 nt!KeBugCheckEx+0x1b
f78f6c54 80836c4c 00000000 fffcfff8 00000000 nt!MmAccessFault+0x813
f78f6c54 8089b738 00000000 fffcfff8 00000000 nt!KiTrap0E+0xdc
f78f6d2c 80912f4c fffcfffe 00000000 808ad2c0 nt!ExFreePoolWithTag+0x28b
f78f6d48 80912ff1 e59912e0 e5972adc f78f6d80 nt!CmpCleanUpKcbValueCache+0x51
f78f6d58 80827551 e59912e0 00000000 89b96db0 nt!CmpCleanUpKcbCacheWithLock+0x14
f78f6d80 8082db10 00000000 00000000 89b96db0 nt!CmpDelayCloseWorker+0x25b
f78f6dac 8092083b 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78f6ddc 8083fe9f 8082da53 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+28b
8089b738 668b4602 mov ax,word ptr [esi+2]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ExFreePoolWithTag+28b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cbdaf65
FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
Followup: MachineOwner
---------
eax=ffdff13c ebx=00000000 ecx=00000000 edx=fffcfffe esi=ffdff120 edi=808b4160
eip=8087c4e0 esp=f78f6bec ebp=f78f6c04 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8087c4e0 5d pop ebp
ChildEBP RetAddr Args to Child
f78f6c04 808692d3 00000050 fffcfff8 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f78f6c54 80836c4c 00000000 fffcfff8 00000000 nt!MmAccessFault+0x813 (FPO: [Non-Fpo])
f78f6c54 8089b738 00000000 fffcfff8 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ f78f6c6c)
f78f6d2c 80912f4c fffcfffe 00000000 808ad2c0 nt!ExFreePoolWithTag+0x28b (FPO: [Non-Fpo])
f78f6d48 80912ff1 e59912e0 e5972adc f78f6d80 nt!CmpCleanUpKcbValueCache+0x51 (FPO: [Non-Fpo])
f78f6d58 80827551 e59912e0 00000000 89b96db0 nt!CmpCleanUpKcbCacheWithLock+0x14 (FPO: [Non-Fpo])
f78f6d80 8082db10 00000000 00000000 89b96db0 nt!CmpDelayCloseWorker+0x25b (FPO: [Non-Fpo])
f78f6dac 8092083b 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb (FPO: [Non-Fpo])
f78f6ddc 8083fe9f 8082da53 00000001 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start end module name
80800000 80a7f000 nt ntkrnlmp.exe Tue Oct 19 15:47:01 2010 (4CBDAF65)
80a7f000 80aab000 hal halmacpi.dll Sat Feb 17 05:48:26 2007 (45D6972A)
b858f000 b85ba000 RDPWD RDPWD.SYS Fri Jun 24 14:05:10 2011 (4E048B86)
b8812000 b881d000 TDTCP TDTCP.SYS Sat Feb 17 05:44:32 2007 (45D69640)
b964a000 b96ae000 srv srv.sys Thu Feb 17 16:58:17 2011 (4D5D53A9)
b9f1e000 b9f31000 dump_HpCISSs2 dump_HpCISSs2.sys Fri Jun 22 04:33:49 2007 (467B431D)
b9f31000 b9f46000 Cdfs Cdfs.SYS Sat Feb 17 06:27:08 2007 (45D6A03C)
b9f6e000 b9f8c000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Fri Jan 20 23:33:18 2012 (4F19F9BE)
b9f8c000 b9fea000 eeCtrl eeCtrl.sys Fri Jan 20 23:33:15 2012 (4F19F9BB)
b9fea000 b9ffb000 Fips Fips.SYS Sat Feb 17 06:26:33 2007 (45D6A019)
b9ffb000 ba071000 mrxsmb mrxsmb.sys Wed Jul 06 15:34:54 2011 (4E14728E)
ba099000 ba0c9000 rdbss rdbss.sys Wed Feb 24 15:54:03 2010 (4B854B9B)
ba0c9000 ba133000 SPBBCDrv SPBBCDrv.sys Sun Aug 09 02:37:14 2009 (4A7E284A)
ba133000 ba15d000 afd afd.sys Thu Feb 10 13:42:18 2011 (4D53EB3A)
ba15d000 ba187000 ipnat ipnat.sys Sat Feb 17 05:59:08 2007 (45D699AC)
ba187000 ba1b8000 netbt netbt.sys Sat Feb 17 06:28:57 2007 (45D6A0A9)
ba1b8000 ba24c000 tcpip tcpip.sys Sat Aug 15 10:53:38 2009 (4A8685A2)
ba2ec000 ba305000 ipsec ipsec.sys Sat Feb 17 06:29:28 2007 (45D6A0C8)
ba375000 ba388d00 NAVENG NAVENG.SYS Wed Apr 25 09:38:43 2012 (4F97B813)
ba389000 ba3ae000 SYMEVENT SYMEVENT.SYS Wed Jun 24 21:14:58 2009 (4A428942)
ba3ae000 ba530780 NAVEX15 NAVEX15.SYS Wed Apr 25 09:36:43 2012 (4F97B79B)
ba531000 ba57b000 SRTSP SRTSP.SYS Tue Aug 11 04:20:28 2009 (4A80E37C)
ba643000 ba658000 usbhub usbhub.sys Sat Feb 17 06:13:05 2007 (45D69CF1)
ba678000 ba682000 ndisuio ndisuio.sys Sat Feb 17 05:58:25 2007 (45D69981)
ba688000 ba692000 Dxapi Dxapi.sys Tue Mar 25 07:06:01 2003 (3E7FFFD9)
ba698000 ba6a2000 dump_diskdump dump_diskdump.sys Sat Feb 17 06:07:44 2007 (45D69BB0)
ba6b8000 ba6c1000 kbdhid kbdhid.sys Sat Feb 17 06:05:42 2007 (45D69B36)
ba6d8000 ba6e5000 netbios netbios.sys Sat Feb 17 05:58:29 2007 (45D69985)
ba6e8000 ba6f5000 wanarp wanarp.sys Sat Feb 17 05:59:17 2007 (45D699B5)
ba71c000 ba71f500 scsichng scsichng.sys Fri Aug 24 03:59:47 2007 (46CE49A3)
ba720000 ba76a000 update update.sys Sat Feb 17 06:28:59 2007 (45D6A0AB)
ba76a000 ba7a1000 rdpdr rdpdr.sys Sat Feb 17 05:51:00 2007 (45D697C4)
ba7ad000 ba7afa80 awlegacy awlegacy.sys Tue Jan 16 10:27:35 2007 (45ACA897)
ba7c9000 ba7db000 raspptp raspptp.sys Sat Feb 17 06:29:20 2007 (45D6A0C0)
ba7db000 ba7f4000 ndiswan ndiswan.sys Sat Feb 17 06:29:22 2007 (45D6A0C2)
ba7f4000 ba808000 rasl2tp rasl2tp.sys Sat Feb 17 06:29:02 2007 (45D6A0AE)
ba808000 ba82f000 ks ks.sys Sat Feb 17 06:30:40 2007 (45D6A110)
ba82f000 ba843000 redbook redbook.sys Sat Feb 17 06:07:26 2007 (45D69B9E)
ba843000 ba858000 cdrom cdrom.sys Sat Feb 17 06:07:48 2007 (45D69BB4)
ba858000 ba866000 msgpc msgpc.sys Sat Feb 17 05:58:37 2007 (45D6998D)
ba868000 ba875000 Npfs Npfs.SYS Sat Feb 17 05:50:36 2007 (45D697AC)
ba878000 ba883000 Msfs Msfs.SYS Sat Feb 17 05:50:33 2007 (45D697A9)
ba888000 ba894000 vga vga.sys Sat Feb 17 06:10:30 2007 (45D69C56)
ba8a8000 ba8b1080 SRTSPX SRTSPX.SYS Tue Aug 11 04:20:44 2009 (4A80E38C)
ba8e8000 ba8f6000 HIDCLASS HIDCLASS.SYS Tue Mar 25 07:10:17 2003 (3E8000D9)
ba8f8000 ba90d000 serial serial.sys Sat Feb 17 06:06:46 2007 (45D69B76)
ba90d000 ba920000 i8042prt i8042prt.sys Sat Feb 17 06:30:40 2007 (45D6A110)
ba920000 ba940000 hpqilo2 hpqilo2.sys Mon Jul 16 22:36:14 2007 (469BE4CE)
ba940000 ba95c000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 06:10:30 2007 (45D69C56)
ba95c000 baac4000 ati2mtag ati2mtag.sys Thu Apr 06 04:03:52 2006 (44348518)
baac4000 baaee000 USBPORT USBPORT.SYS Sat Feb 17 06:12:59 2007 (45D69CEB)
baaee000 bab69000 Wdf01000 Wdf01000.sys Thu Nov 02 08:54:18 2006 (4549B23A)
bab80000 babe8000 bxvbdx bxvbdx.sys Wed May 23 03:17:20 2007 (4653A430)
bf800000 bf9d3000 win32k win32k.sys Thu Jun 02 15:25:58 2011 (4DE79D76)
bf9d3000 bf9ea000 dxg dxg.sys Sat Feb 17 06:14:39 2007 (45D69D4F)
bf9ea000 bfa2d000 ati2dvag ati2dvag.dll Thu Apr 06 04:04:15 2006 (4434852F)
bfa2d000 bfa6c000 ati2cqag ati2cqag.dll Thu Apr 06 02:57:18 2006 (4434757E)
bfa6c000 bfaa2000 atikvmag atikvmag.dll Thu Apr 06 03:25:29 2006 (44347C19)
bff60000 bff7e000 RDPDD RDPDD.dll Sat Feb 17 14:01:19 2007 (45D70AAF)
f7107000 f7109c00 aw_host5 aw_host5.sys Tue Jan 16 10:13:19 2007 (45ACA53F)
f714b000 f716a000 Mup Mup.sys Tue Apr 12 20:05:46 2011 (4DA4A28A)
f716a000 f71a9000 NDIS NDIS.sys Sat Feb 17 06:28:49 2007 (45D6A0A1)
f71a9000 f723e000 Ntfs Ntfs.sys Sat Feb 17 06:27:23 2007 (45D6A04B)
f72a6000 f72cc000 KSecDD KSecDD.sys Sat Feb 17 05:46:32 2007 (45D696B8)
f72cc000 f72f1000 fltmgr fltmgr.sys Sat Feb 17 05:51:08 2007 (45D697CC)
f72f1000 f7304000 CLASSPNP CLASSPNP.SYS Sat Feb 17 06:28:16 2007 (45D6A080)
f7304000 f7321000 lsi_scsi lsi_scsi.sys Sat Feb 10 04:53:47 2007 (45CD4FDB)
f7321000 f7340000 SCSIPORT SCSIPORT.SYS Sat Feb 17 06:28:41 2007 (45D6A099)
f7340000 f7351000 symmpi symmpi.sys Mon Dec 13 21:03:14 2004 (41BE0392)
f7351000 f736f000 storport storport.sys Sat Feb 17 06:07:48 2007 (45D69BB4)
f736f000 f7382000 HpCISSs2 HpCISSs2.sys Fri Jun 22 04:33:49 2007 (467B431D)
f7382000 f739f000 atapi atapi.sys Sat Feb 17 06:07:34 2007 (45D69BA6)
f739f000 f73c9000 volsnap volsnap.sys Sat Feb 17 06:08:23 2007 (45D69BD7)
f73c9000 f73f5000 dmio dmio.sys Sat Feb 17 06:10:44 2007 (45D69C64)
f73f5000 f741c000 ftdisk ftdisk.sys Sat Feb 17 06:08:05 2007 (45D69BC5)
f741c000 f7432000 pci pci.sys Sat Feb 17 05:59:03 2007 (45D699A7)
f7432000 f7466000 ACPI ACPI.sys Sat Feb 17 05:58:47 2007 (45D69997)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 07:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Sat Feb 17 05:58:57 2007 (45D699A1)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 06:07:32 2007 (45D69BA4)
f74b7000 f74c7000 MountMgr MountMgr.sys Sat Feb 17 06:05:35 2007 (45D69B2F)
f74c7000 f74d2000 PartMgr PartMgr.sys Sat Feb 17 06:29:25 2007 (45D6A0C5)
f74d7000 f74e7000 disk disk.sys Sat Feb 17 06:07:51 2007 (45D69BB7)
f74e7000 f74f3000 Dfs Dfs.sys Sat Feb 17 05:51:17 2007 (45D697D5)
f7507000 f7511000 crcdisk crcdisk.sys Sat Feb 17 06:09:50 2007 (45D69C2E)
f7537000 f7540000 hidusb hidusb.sys Tue Mar 25 07:10:17 2003 (3E8000D9)
f7547000 f7550000 watchdog watchdog.sys Sat Feb 17 06:11:45 2007 (45D69CA1)
f7557000 f7562000 TDI TDI.SYS Sat Feb 17 06:01:19 2007 (45D69A2F)
f7567000 f7571000 serenum serenum.sys Sat Feb 17 06:06:44 2007 (45D69B74)
f7587000 f7594000 WDFLDR WDFLDR.SYS Thu Nov 02 08:54:05 2006 (4549B22D)
f75a7000 f75b1000 mouclass mouclass.sys Tue Mar 25 07:03:09 2003 (3E7FFF2D)
f75c7000 f75d2000 kbdclass kbdclass.sys Sat Feb 17 06:05:39 2007 (45D69B33)
f75d7000 f75e6000 intelppm intelppm.sys Sat Feb 17 05:48:30 2007 (45D6972E)
f75e7000 f75f6000 termdd termdd.sys Sat Feb 17 05:44:32 2007 (45D69640)
f75f7000 f7602000 cpqcidrv cpqcidrv.sys Fri Jun 22 19:55:11 2007 (467C1B0F)
f7607000 f7610000 ndistapi ndistapi.sys Fri Jul 08 15:08:19 2011 (4E170F53)
f7617000 f7622000 ptilink ptilink.sys Sat Feb 17 06:06:38 2007 (45D69B6E)
f7627000 f7636000 raspppoe raspppoe.sys Sat Feb 17 05:59:23 2007 (45D699BB)
f7657000 f7667000 bxnd52x bxnd52x.sys Fri May 25 22:29:07 2007 (46575523)
f7667000 f7675000 NDProxy NDProxy.SYS Wed Nov 03 13:25:59 2010 (4CD162E7)
f7677000 f7682000 fdc fdc.sys Sat Feb 17 06:07:16 2007 (45D69B94)
f7687000 f7690000 raspti raspti.sys Sat Feb 17 05:59:23 2007 (45D699BB)
f7697000 f76a0000 mssmbios mssmbios.sys Sat Feb 17 05:59:12 2007 (45D699B0)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 07:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 07:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 07:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 07:08:08 2003 (3E800058)
f7777000 f777e000 dxgthk dxgthk.sys Tue Mar 25 07:05:52 2003 (3E7FFFD0)
f777f000 f7785580 tpfilter tpfilter.sys Mon Sep 08 20:31:39 2008 (48C57D9B)
f7787000 f778c180 usbuhci usbuhci.sys Sat Feb 17 06:13:02 2007 (45D69CEE)
f778f000 f7795b80 usbehci usbehci.sys Sat Feb 17 06:12:56 2007 (45D69CE8)
f7797000 f779f000 audstub audstub.sys Tue Mar 25 07:09:12 2003 (3E800098)
f77af000 f77b6d80 usbccgp usbccgp.sys Sat Feb 17 06:13:08 2007 (45D69CF4)
f77b7000 f77bf000 mouhid mouhid.sys Tue Mar 25 07:03:12 2003 (3E7FFF30)
f77c7000 f77cd300 HIDPARSE HIDPARSE.SYS Sat Feb 17 06:12:35 2007 (45D69CD3)
f77ef000 f77f7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 07:08:36 2003 (3E800074)
f77f7000 f77fe000 Null Null.SYS Tue Mar 25 07:03:05 2003 (3E7FFF29)
f77ff000 f7806000 Beep Beep.SYS Tue Mar 25 07:03:04 2003 (3E7FFF28)
f7807000 f780f000 mnmdd mnmdd.SYS Tue Mar 25 07:07:53 2003 (3E800049)
f780f000 f7817000 RDPCDD RDPCDD.sys Tue Mar 25 07:03:05 2003 (3E7FFF29)
f7817000 f781f000 rasacd rasacd.sys Tue Mar 25 07:11:50 2003 (3E800136)
f7897000 f7899980 compbatt compbatt.sys Sat Feb 17 05:58:51 2007 (45D6999B)
f789b000 f789e900 BATTC BATTC.SYS Sat Feb 17 05:58:46 2007 (45D69996)
f789f000 f78a2500 Gernuwa Gernuwa.sys Thu Feb 22 04:03:53 2007 (45DD1629)
f798b000 f798c280 swenum swenum.sys Sat Feb 17 06:05:56 2007 (45D69B44)
f798d000 f798e580 USBD USBD.SYS Tue Mar 25 07:10:39 2003 (3E8000EF)
f79c3000 f79c4b00 awechomd awechomd.sys Wed Dec 02 06:41:48 2009 (4B160C2C)
Unloaded modules:
f77e7000 f77ef000 usbccgp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00008000
ba6c8000 ba6d1000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
f772f000 f7737000 mouhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00008000
ba6b8000 ba6c6000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
ba898000 ba8a1000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
f7637000 f7640000 halfinch.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
f7527000 f7531000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000A000
f74f7000 f7504000 WDFLDR.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
f723e000 f72a6000 bxvbdx.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00068000
Closing open log file c:debuglog.txt


End log

 

Thanks Arie. The problem is that we can't log into the server interactively as it BSODs within a couple of minutes. As the above steps you suggested involve GUI I can't think of a way to accomplish this.