A
A
Artem2017-05-03 13:21:29
System administration
Artem, 2017-05-03 13:21:29

Windows server restarts due to BugCheck error, what should I do?

Windows 2012 Server R2 reboots intermittently with a BugCheck error. Error code: 0x00000050 (common) or 0x000000c5, 0x00000019, 0x00000018, 0x000000d1 (rare).
The system manager is good, on the server hardware:
46e1950c53.jpg
The disks are configured like this:
d65f4cdfbd.jpg
What was done:

  • reinstalled most of the drivers from standard to vendor (using Snappy)
  • naturally, chkdsk all drives
  • suspected hacking - checked everything with kaspersky, installed outpost firewall, antimalware - nothing was found
  • Installed all Windows updates through Update Center

BlueScreenView shows the following:
657c48b188.jpg
How to interpret, unfortunately, I do not know - there is not enough admin qualification.
At the time of the reboot, quite heavy processes are running, but, IMHO, the server should not reboot because of this - after all, it is designed to constantly work with applications under any reasonable load.
There is also a folder in the system, in subfolders of which there are more than 850 thousand files. I don't think this is the reason - NTFS seems to allow a lot more, but suddenly...
Please help me to recognize and fix the problem.

Answer the question

In order to leave comments, you need to log in

3 answer(s)
A
Artem, 2017-05-03
@devspec

In general, this is some kind of tin ...
Today I got a level-up in Windows administration)
I downloaded the Windows Drivers Kit, analyzed the last dump using WinDbg and a character set.
It turned out that the server was crashing due to open SMB ports. This is some kind of new Windows vulnerability, for which, in my opinion, even the update has not yet been released (or it was released, but it didn’t come to me). Closed the ports and removed SMB1 from the Windows component set - half a day the flight is normal.
More details, if anyone needs it, can be read here or here . The situation is rather non-trivial (for me personally), so I decided to publish the result of its solution here.

M
Maxim Grishin, 2017-05-03
@vesper-bot

Check the hardware memory (memtest or whatever is more advanced now). Random bugchecks usually indicate that the memory somewhere does not store data. This problem is further exacerbated by ASLR, which can write the code or data of any process to a bad memory block.

V
vreitech, 2017-05-03
@fzfx

most of all it looks like a problem with the RAM. check the RAM using the boot disk with memtest.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question