We have a quite urgent issue, where company old SBS server BSOD's right before presenting the logon screen.
I ran the mini-dumps via the WinDbg, and got following output:
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: fe39ad88, Terminating object
Arg3: fe39aeec, Process image file name
Arg4: e094c7c4, Explanatory message (ascii)
Debugging Details:
------------------
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
<Failed to Read Entire ETW Buffer (expected 0, read 0)>
PROCESS_OBJECT: fe39ad88
IMAGE_NAME: csrss.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: csrss
FAULTING_MODULE: 00000000
PROCESS_NAME: csrss.exe
EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".
BUGCHECK_STR: 0xF4_IOERR
CUSTOMER_CRASH_COUNT: 5
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
CURRENT_IRQL: 0
STACK_TEXT:
f4a0b4e8 e094b927 000000f4 00000003 fe39ad88 nt!KeBugCheckEx+0x1b
f4a0b50c e094c86c e094c7c4 fe39ad88 fe39aeec nt!PspCatchCriticalBreak+0x75
f4a0b53c feb35fa6 ffffffff c0000006 f4a0b58c nt!NtTerminateProcess+0x7a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 f000e81a f000e2c3 f000e81a f000e81a 0xfeb35fa6
00000000 00000000 f000e2c3 f000e81a f000e81a 0xf000e81a
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe
BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe
Followup: MachineOwner
---------
From the dump it seems as problem in driver, but I can't just get what driver responsible for this.
I will appreciate any hint what could be the culprit, or how to hunt for one.
Thanks!
Best Answer
Call Microsoft PSS and get professional help. Move to backup hardware, unless obviouly "important" is something people realize now. I would say the problem is some disc based problem. Image IO errors indicate something is bad reading from disc, on a critical moment. WHich would mean - rebuild machine using backup.