[SOLVED] Windows Server 2022 BSOD Critical Process Died

Status
Not open for further replies.
L

lifewithloki

Member
Joined
Jun 16, 2023
Posts
8
Please make sure that you .zip all large memory dump files before uploading them especially as they can approach 1-2GB quite easily.

It looks like one of your Kerberos services is possibly crashing and then terminating afterwards due to some unrecoverable error.

Rich (BB code): 
7: kd> .exr ffff9e8cd1cbca00
ExceptionAddress: 00007ffe3c87d497 (coremessaging!Microsoft::CoreUI::Registrar::AlpcServerAdapter::GetPortSecurityDescriptor+0x000000000001c7e3)
   ExceptionCode: e0464645
  ExceptionFlags: 00000001
NumberParameters: 2
   Parameter[0]: ffffffffd0000034
   Parameter[1]: 0000000000000000

Rich (BB code): 
7: kd> !error d0000034
Error code: (NTSTATUS) 0xd0000034 (3489660980) - Object Name not found.

I assume that GetPortSecurityDescriptor returns a security descriptor object for the given ALPC port. However, either a bad name is being passed or the name was completely null. This issue appears to be completely unrelated to your Windows Update issue.

Rich (BB code): 
[...]
0xffff9e8cd1cbcc18 : 0xfffff80575033185 : nt!KiSystemServiceCopyEnd+0x25
0xffff9e8cd1cbcc20 : 0xffffb40538bb1080 :  Trap @ ffff9e8cd1cbcc20
0xffff9e8cd1cbccf0 : 0x00007ffe43ba2204 : ntdll!NtRaiseException+0x14
0xffff9e8cd1cbcd80 : 0x00007ffe41336130 : KERNELBASE!RaiseFailFastException
0xffff9e8cd1cbcd88 : 0x00007ffe41336282 : KERNELBASE!RaiseFailFastException+0x152
0xffff9e8cd1cbcdb8 : 0xffff9e8cd1cb7000 :  !du "Kerberos"
0xffff9e8cd1cbceb8 : 0x00007ff60bbb5320 : svchost!wmainCRTStartup

Just some additional background information:

Rich (BB code): 
7: kd> !alpc /lpp ffffb40538a42300

Ports created by the process ffffb40538a42300:

    <none>

Ports the process ffffb40538a42300 is connected to:

    ffffb40538a35d20 0 -> ffffb40536ac5090 ('ApiPort') 0 ffffb40536a0e080 ('csrss.exe')
    ffffb40538a61a80 0 -> ffffb40536d61aa0 ('epmapper') 2 ffffb40537ec2300 ('svchost.exe')
    ffffb40538a51d90 0 -> ffffb40536c15d20 ('lsapolicylookup') 0 ffffb4053745f080 ('lsass.exe')
    ffffb40538af8ce0 0 -> ffffb40536c16db0 ('ntsvcs') 64 ffffb405374630c0 ('services.exe')

In your other thread, by recovery environment, I assume you're referring to Safe Mode? If so, then this issue probably isn't hardware-related. Have you got any security programs which run at boot?
 
Not safe mode. I can't boot into safe mode either. I have to go into advance startup settings, repair computer, then command prompt

No, no security programs I believe.

Having missing/corrupt packages wouldn't cause this? If a bad name or null is being return maybe it is one of those packages?
 
lifewithloki said:
Having missing/corrupt packages wouldn't cause this? If a bad name or null is being return maybe it is one of those packages?
Click to expand...
No it wouldn't, those packages are just .mum and .cat files, both of which are used by the servicing stack which is the part of Windows Update. They're both part of %systemroot%\servicing\Packages which is then hardlinked to a couple of directories.

I would see if you can clone server and then see if you're able to disable Kerberos, at least we'll be able to see if you're able to boot the system normally.
 
Okay.

How would I disable Kerberos? I've read a few links and haven't found a way to disable Kerberos and Kerberos can't be disabled
 
You should be able to change the authentication method used by Active Directory. I assume that this server is a domain controller? It might not be possible to disable it outside of Windows itself unfortunately, you could try opening RegEdit from Command Prompt by entering regedit.exe and then going to:

Code: 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos

And then check for any values which allow you to configure it to be disabled. Otherwise, you might want to consider running MemTest86 for at least 8 passes to reduce the likelihood of any RAM issues as this can cause Stop 0xEF bugchecks: Test RAM with PassMark MemTest86 (version 7.4 was used)

Is there any other dump files apart from the one you uploaded? Have you checked under %systemroot%\Minidump?
 
All your crashes appear to be consistent with each other so I doubt that this is a hardware issue. Every crash is because of the GetPortSecurityDescriptor function. You may want to run the following command to get an ideal of which driver-related services are starting and which ones aren't essential.

Code: 
sc query type=driver | find /i "DISPLAY_NAME:"

Do you have any recent backups which you can restore from?
 
No, no backups. Luckily they had an old DC which was decommissioned not too long ago so I was able to configure a new DC with minimal issues.
 
Status
Not open for further replies.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top