Windows Server 2019 KMODE_EXCEPTION_NOT_HANDLED

Richard01 · Jun 7, 2021

Hello,
im getting bsod on windows server multiple times a week can you help me fix this problem?
Thanks

C:\Users\Administrator>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Users\Administrator>

Code:

C:\Users\Administrator>Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.1697

Image Version: 10.0.17763.1935

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\Users\Administrator>

Code:

SFCFix version 3.0.2.1 by niemiro.
Start time: 2021-06-07 16:11:31.766
Microsoft Windows Server 10 Build 17763 - amd64
Not using a script file.




AutoAnalysis::
WARNING: Failed to check store directories with return code 1 and error code ERROR_FILE_NOT_FOUND. COMPONENTS hive may be corrupt.


WARNING: Components hive failed load test and may be corrupt.


WARNING: Components hive failed final reload test with error code ERROR_PRIVILEGE_NOT_HELD and may be corrupt.


SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.



Failed to process registry database in location 1.
Failed to load registry hive C:\WINDOWS\System32\config\COMPONENTS into key HKEY_LOCAL_MACHINE\COMPONENTS with error code ERROR_PRIVILEGE_NOT_HELD.

Failed to process registry database in location 2 with error code ERROR_FILE_NOT_FOUND.
WARNING: Failed to process registry database in location 3 with error code ERROR_INVALID_HANDLE.
Failed to process registry database in location 4 with error code ERROR_INVALID_HANDLE.
Failed to process registry database in location 4 with error code ERROR_FILE_NOT_FOUND.
Failed to process registry database in location 4 with error code ERROR_FILE_NOT_FOUND.
Failed to process registry database in location 4 with error code ERROR_FILE_NOT_FOUND.


SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2021-06-07 16:11:54.467
----------------------EOF-----------------------

Last bsod

Code:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [\\192.168.0.99\riso\bsod\dolny kubin knazia\060721-5906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17763 MP (12 procs) Free x64
Product: Server, suite: TerminalServer
Machine Name:
Kernel base = 0xfffff801`03813000 PsLoadedModuleList = 0xfffff801`03c2a3d0
Debug session time: Mon Jun 7 09:56:34.688 2021 (UTC + 2:00)
System Uptime: 0 days 0:01:28.792
Loading Kernel Symbols

Loading User Symbols
Loading unloaded module list

For analysis of this file, run !analyze -v
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80103884638, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.17763.1935 (WinBuild.160101.0800)

SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.

SYSTEM_PRODUCT_NAME: B450 AORUS ELITE

SYSTEM_SKU: Default string

SYSTEM_VERSION: Default string

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: F51

BIOS_DATE: 12/18/2019

BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.

BASEBOARD_PRODUCT: B450 AORUS ELITE

BASEBOARD_VERSION: x.x

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

DUMP_TYPE: 2

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80103884638

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffffffffffff

READ_ADDRESS: GetUlongFromAddress: unable to read from fffff80103cd6240
fffff80103d51390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

FAULTING_IP:
nt!KiTimerWaitTest+338
fffff801`03884638 4d8b3f mov r15,qword ptr [r15]

EXCEPTION_PARAMETER2: ffffffffffffffff

BUGCHECK_STR: 0x1E_c0000005_R

CPU_COUNT: c

CPU_MHZ: e09

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 8

CPU_STEPPING: 2

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: SINO_OFFICE

ANALYSIS_SESSION_TIME: 06-07-2021 10:25:29.0323

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

EXCEPTION_RECORD: ffff81011ca8c000 -- (.exr 0xffff81011ca8c000)
Cannot read Exception record @ ffff81011ca8c000

LAST_CONTROL_TRANSFER: from fffff80103a9d73e to fffff801039ca610

STACK_TEXT:
fffffa85`9d4366d8 fffff801`03a9d73e : 00000000`0000001e ffffffff`c0000005 fffff801`03884638 00000000`00000000 : nt!KeBugCheckEx
fffffa85`9d4366e0 fffff801`039d311f : fffff801`03cf2000 fffff801`03813000 0005b6b0`00a6c000 00000000`0010001f : nt!KiFatalExceptionHandler+0x22
fffffa85`9d436720 fffff801`038741d0 : fffffa85`9d436d70 00000000`00000000 fffffa85`9d436c90 00000000`00000000 : nt!RtlpExecuteHandlerForException+0xf
fffffa85`9d436750 fffff801`039138b4 : fffffa85`9d437688 fffffa85`9d4373d0 fffffa85`9d437688 ffff8101`200b7080 : nt!RtlDispatchException+0x430
fffffa85`9d436ea0 fffff801`039dbec2 : ffff8101`1ca8c000 ffff8101`1c64a830 00000000`00000001 00000000`00000000 : nt!KiDispatchException+0x144
fffffa85`9d437550 fffff801`039d7d4b : 00000000`000019e0 fffff801`0384c413 00000000`000019da fffff801`145438b0 : nt!KiExceptionDispatch+0xc2
fffffa85`9d437730 fffff801`03884638 : 00000000`00000000 fffff801`0384ccfd ffffa580`f28e4180 fffff801`14544dd6 : nt!KiGeneralProtectionFault+0x30b
fffffa85`9d4378c0 fffff801`03884065 : ffffa580`f28f4800 00000000`000000ff fffffa85`9d437b18 00000000`00000008 : nt!KiTimerWaitTest+0x338
fffffa85`9d437960 fffff801`03884fd7 : 00000000`0000001c 00000000`00989680 ffffa580`f28f4800 00000000`00000019 : nt!KiProcessExpiredTimerList+0xb5
fffffa85`9d437a50 fffff801`039ce03a : ffffffff`00000000 ffffa580`f28e4180 00000000`00000000 ffffa580`f28f4800 : nt!KiRetireDpcList+0x4a7
fffffa85`9d437c60 00000000`00000000 : fffffa85`9d438000 fffffa85`9d432000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a


THREAD_SHA1_HASH_MOD_FUNC: fb0c6f85f4c78de1bdfcfc45b2e86ed9be95905d

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d00c9c3fb7097eeddd4eb5ad3204bda1bcfd6670

THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c

FOLLOWUP_IP:
nt!KiTimerWaitTest+338
fffff801`03884638 4d8b3f mov r15,qword ptr [r15]

FAULT_INSTR_CODE: 413f8b4d

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: nt!KiTimerWaitTest+338

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

IMAGE_VERSION: 10.0.17763.1935

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 338

FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!KiTimerWaitTest

BUCKET_ID: 0x1E_c0000005_R_nt!KiTimerWaitTest

PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_nt!KiTimerWaitTest

TARGET_TIME: 2021-06-07T07:56:34.000Z

OSBUILD: 17763

OSSERVICEPACK: 1935

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 131088

PRODUCT_TYPE: 3

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 Server TerminalServer

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: unknown_date

BUILDDATESTAMP_STR: 160101.0800

BUILDLAB_STR: WinBuild

BUILDOSVER_STR: 10.0.17763.1935

ANALYSIS_SESSION_ELAPSED_TIME: 881

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_nt!kitimerwaittest

FAILURE_ID_HASH: {60392e1e-177d-1e45-9fd7-b743dcff84fd}

Followup: MachineOwner
---------

Richard01 · Jun 7, 2021

adding file collection

x BlueRobot · Jun 7, 2021

Since you also appear to have CloudPoint on this server as well, then I would recommend either updating it or removing it.

Rich (BB code):

===============================================================================
Section 2     : x86/x64 MCA
-------------------------------------------------------------------------------
Descriptor    @ ffffa10eaa1539d8
Section       @ ffffa10eaa153b60
Offset        : 664
Length        : 264
Flags         : 0x00000000
Severity      : Fatal
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock

fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
Error         : DTLBL1_ERR (Proc 0 Bank 0)
  Status      : 0xb6a0000000030015
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
  Address     : 0x0c00f8016dfff000
fffff80530cabf08: Unable to get Flags value from nt!KdVersionBlock
  Misc.       : 0x0000000000000000

Looks like an error occurred with the TLB cache and since the loading of the CR3 register usually invalidates the entire cache, I'm going to assume that CloudPoint may have been responsible for this.

Richard01 · Jun 8, 2021

Hm weird we have over 200 server with the same software/hardware and have no issues can it be fixed?

x BlueRobot · Jun 8, 2021

Every system is an individual, even if they appear to have the same configuration. If the issue is the same as your other thread, then I would suggest opening a support ticket.

Search

Search

Windows Server 2019 KMODE_EXCEPTION_NOT_HANDLED

Richard01

Well-known member

Attachments

Richard01

Well-known member

Attachments

x BlueRobot

Administrator

Richard01

Well-known member

x BlueRobot

Administrator