I have several servers to choose from that BSOD'd, but I'm going with a newer
server that doesn't have much on it--"SERVERBSOD" has some minimal IIS and WAP
for roles (also had some dcs & a SQL server drop but they have much more
installed). I would also mention that we had both physical and Virtual
machines (on Hyper-V) have the problems. Comparing this to the one server that
didn't drop, which is a non-domain joined server currently running DHCP
(wireless guest testing) and we'll call that "SERVERWORKS".
Both servers show their FNTCACHE.DAT files with a timestamp update of when the
server was rebooted. For SERVERBSOD that was yesterday, and for SERVERWORKS,
that was today (when I applied the rollup update successfully this am). On
SERVERBSOD the file is 328kb and on SERVERWORKS the file is 337kb. Other than
that, I haven't played much with this file, and as opening in notepad only
shows some data, so I'm not sure if there's something else I'm looking
for--please let me know.
For software differences, because SERVERWORKS is still in a test-phase mode
(semi-production, probably will not end up in production, but migrated to
another system), there are a few things it doesn't have that our others do.
These include:
Liebert Multilink (Shutdown software that works with our datacenter
room UPS)
MS SC DPM 2012 R2 Protection agent
MS Visual C++ Redistributables (usually installed with/after the DPM
agent). I'm seeing 2010 both x86 and x64, as well as a 2005 x64 version.
And it also doesn't have our full SCCM 2012 R2 client, although it does
have the standalone SCEP installation from that.
Then, I also loaded the "automatic memory dump" file from SERVERBSOD in windbg
and ran an !analyze -v with symbols loaded. Looks like the code may actually
be the same or similar to the other reports for win7, even though I didn't see
that on the simple screen that appeared. Here's the results and hopefully
something to help:
BugCheck 50, {fffff9014069d000, 1, fffff960000b0fe8, 0}
Probably caused by : win32k.sys ( win32k!cjComputeGLYPHSET_MSFT_UNICODE+2df )
!analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff9014069d000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff960000b0fe8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
WRITE_ADDRESS: fffff802f3b3ace0: Unable to get special pool info
fffff802f3b3ace0: Unable to get special pool info
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffff9014069d000
FAULTING_IP:
win32k!cjComputeGLYPHSET_MSFT_UNICODE+2df
fffff960`000b0fe8 8907 mov dword ptr [rdi],eax
MM_INTERNAL_CODE: 0
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5391cddb
MODULE_NAME: win32k
FAULTING_MODULE: fffff96000023000 win32k
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
TRAP_FRAME: ffffd0018a732480 -- (.trap 0xffffd0018a732480)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000164
rdx=000000078e43b2a6 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000b0fe8 rsp=ffffd0018a732610 rbp=0000000000001347
r8=0000000000000007 r9=0000000000000064 r10=fffff90140698b30
r11=000000078e43b086 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x2df:
fffff960`000b0fe8 8907 mov dword ptr [rdi],eax
ds:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff802f3a080e7 to fffff802f39d6fa0
STACK_TEXT:
ffffd001`8a732298 fffff802`f3a080e7 : 00000000`00000050 fffff901`4069d000
00000000`00000001 ffffd001`8a732480 : nt!KeBugCheckEx
ffffd001`8a7322a0 fffff802`f38ea9c9 : 00000000`00000001 ffffe001`f431c080
ffffd001`8a732480 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x20c37
ffffd001`8a732340 fffff802`f39e122f : 00000000`00000001 00000000`00001134
00000000`00000000 ffffd001`8a732480 : nt!MmAccessFault+0x7a9
ffffd001`8a732480 fffff960`000b0fe8 : 00000000`00000000 ffffe001`f39c51b0
00000000`00000001 00000007`8e43b078 : nt!KiPageFault+0x12f
ffffd001`8a732610 fffff960`000b1bf5 : fffff901`400ada68 fffff901`4068c380
fffff901`40698020 ffffd001`8a732780 :
win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x2df
ffffd001`8a732700 fffff960`000b2803 : fffff901`400ada10 00000000`00000001
00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0x91
ffffd001`8a732730 fffff960`000b2a32 : 00000000`00000001 00000000`00000001
00000000`00000000 fffff960`0007c91c : win32k!bReloadGlyphSet+0x18b
ffffd001`8a7328c0 fffff960`000b298f : fffff901`400add10 fffff901`400ada10
00000000`00000001 00000000`00000000 : win32k!ttfdQueryFontTree+0x66
ffffd001`8a732910 fffff960`000b1fbc : fffff960`000b2940 fffff901`400add10
00000000`00000000 fffff901`4067f620 : win32k!ttfdSemQueryFontTree+0x4f
ffffd001`8a732950 fffff960`0002746b : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x6c
ffffd001`8a732a00 fffff960`00025f3a : fffff901`4008a010 fffff901`40679544
00000000`00000000 00000001`00000001 : win32k!PFEOBJ::pfdg+0xcb
ffffd001`8a732a70 fffff960`0002a13d : ffffe001`f35d4280 ffffd001`8a732cc0
ffffd001`8a732dd0 ffffd001`8a732c78 : win32k!RFONTOBJ::bRealizeFont+0x46
ffffd001`8a732bc0 fffff960`00036f4e : 0000005d`7a02d690 ffffd001`8a732ec0
0000005d`7a02d690 00000000`01010158 : win32k!RFONTOBJ::bInit+0xa0d
ffffd001`8a732d80 fffff960`0002a53a : 0000005d`7a02d690 fffff960`0002a51c
00000000`00000000 ffffd001`8a732ec0 : win32k!GreGetTextMetricsW+0x3e
ffffd001`8a732dc0 fffff802`f39e27b3 : 00000000`00000044 fffff960`0002a51c
0000005d`78637501 ffffd001`8a732e40 : win32k!NtGdiGetTextMetricsW+0x1f
ffffd001`8a732e40 00007fff`bd6a42da : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000005d`7a02d658 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : GDI32!NtGdiGetTextMetricsW+0xa
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!cjComputeGLYPHSET_MSFT_UNICODE+2df
fffff960`000b0fe8 8907 mov dword ptr [rdi],eax
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: win32k!cjComputeGLYPHSET_MSFT_UNICODE+2df
FOLLOWUP_NAME: MachineOwner
BUCKET_ID_FUNC_OFFSET: 2df
FAILURE_BUCKET_ID: AV_win32k!cjComputeGLYPHSET_MSFT_UNICODE
BUCKET_ID: AV_win32k!cjComputeGLYPHSET_MSFT_UNICODE
Followup: MachineOwner
-------------------
-----Original Message-----
From: [email protected] [mailto:[email protected]] On
Behalf Of Miller Bonnie L.
Sent: Thursday, August 14, 2014 3:59 PM
To: [email protected]
Subject: RE: [NTSysADM] August Update issues
Hi Susan--just got home--I'll check a couple of things and post back. There
could be a difference in software, but not very likely--the one big thing that
I mentioned was that one server that didn't BSOD also didn't get the KB2975719
installed at the same time with the rest of the updates because our network
admin didn't select it for installation, and because that one points straight
to MS for updates, it wasn't automatically selected/checked (due to approval on
WSUS for the others). Before attempting to separate the updates, I did test
going the route of clearing updates cache and pointing straight to MS on
another server to install all at once, but that didn't fix anything (that one
BSOD'd also).
BTW, I should mention that except for a few servers where some updates have
failed on the first round (but installed on try 2), all of our WS08R2, WS08,
and WS03R2 servers have not had update issues this month (knocking on wood as I
type this)--another reason I was looking at the rollup for 12&12R2.
-----Original Message-----
From: [email protected] [mailto:[email protected]] On
Behalf Of Susan Bradley
Sent: Thursday, August 14, 2014 2:03 PM
To: [email protected]
Subject: Re: [NTSysADM] August Update issues
If you wouldn't mind some sleuthing... open up fntcache.dat on each
machine/compare the one that didn't bsod to the ones that did. Is there a
difference?
Susan Bradley
Still migrating the msmvps.com blogs but we're getting closer.
blogs.msmvps.com/bradley is the new url and redirects are in place Have I
mentioned how much migrations are REALLY painful?
On 8/14/2014 1:57 PM, Susan Bradley wrote:
> What software do you have installed on everything - but- one - server?
>
> I'm trying to figure out a commonality and just can't figure out a
> trigger.
>
> Susan Bradley
> Still migrating the msmvps.com blogs but we're getting closer.
> blogs.msmvps.com/bradley is the new url and redirects are in place
> Have I mentioned how much migrations are REALLY painful?
>
> On 8/14/2014 1:47 PM, Miller Bonnie L. wrote:
>> Thanks for the update Susan (and thanks for helping everyone on the
>> forums too--you seem to be fielding everything!). That is good to
>> know if we run into the win7 issue at all, but we'll probably hold
>> back now until MS can sort the issue a bit better--I'm sure it won't
>> take too long.
>>
>> I haven't had any servers that didn't recover, and it's slightly
>> different than what I see being posted about win7 workstations, but
>> still points to win32k.sys. I've not had issues by installing
>> updates in separate sets/rounds, so thought that might help others
>> and was posting here as it's server related (I'm on wsus, but not
>> patch mgmt.--may have to add that one).
>>
>> In particular, the issue with the 2012 non-R2 servers not really
>> updating is key--we at least needed to get the security updates to
>> load, and I might not have noticed it right away if not digging into
>> the other issue.
>>
>> -B
>>
>> -----Original Message-----
>> From: [email protected]
>> [mailto:[email protected]] On Behalf Of Susan Bradley
>> Sent: Thursday, August 14, 2014 1:36 PM
>> To: [email protected]
>> Subject: Re: [NTSysADM] August Update issues
>>
>> Patchmanagement.org is the update news list :-)
>>
>>
>> I could solve it by booting from a DVD and removing the following file:
>>
>> c:\Windows\System32\FNTCACHE.DAT
>>
>>
>> So that reportedly is working for some.
>>
>>
>>
>>
>> On 8/14/2014 1:30 PM, Miller Bonnie L. wrote:
>>> Surprisingly, I hadn't seen anything posted on here about updates
>>> yesterday, and I was too in the thick of it to add anything just yet.
>>> I realize most are not bleeding edge, so just a heads-up that you
>>> may have some issues-hopefully this helps someone else and MS can sort it.
>>>
>>> Of the servers updated yesterday:
>>>
>>> all but one of our WS12R2 servers halted with a BSOD on restart:
>>>
>>> Page_fault_in_nonpaged_area Win32k.sys
>>>
>>> Had to hard shut-down, and they all recovered (thankfully). They all
>>> think the updates installed fine.
>>>
>>> All of the WS12 (non-R2) servers appeared to take an extremely long
>>> time, and after they came back, I found they wanted the same updates
>>> installed again. Turns out they are rolling back and not installing
>>> any of them.
>>>
>>> After things calmed down and stabalized, I scoured around online a
>>> bit and didn't see anything, but it was early. Then I looked at the
>>> one
>>> WS12R2 server that hadn't crashed with a BSOD, and realized it's a
>>> non-domain machine that went straight out to MS for updates. Our
>>> network admin had patched that one, and had not chosen to install
>>> the optional (not security) update KB2975719, which is a decent
>>> sized rollup for 2012R2.
>>>
>>> Based on that, I also looked at the 2012 non-R2 servers and noticed
>>> KB2975331, a similar non-security update rollup for 2012.
>>>
>>> I went forward testing on a few more systems, and found that I can
>>> install successfully if I first install all of the other updates
>>> except for either KB2975719 or KB2975331, restart, and then install
>>> the that rollup and restart again. That seems to avoid the BSOD and
>>> the rollback, and has worked today for all but one of my 2012 non-R2
>>> servers (I'm still trying to figure out why just the rollup won't
>>> install on this last one-could be something else).
>>>
>>> Seems like they may have a logic issue in that these rollup updates
>>> should not be installed along with other updates (like when updating
>>> to a new version of IE), but they don't force it to do so.
>>>
>>> There are also some postings coming out now about issues with Win7,
>>> so buyer beware:
>>>
>>> http://tech.slashdot.org/story/14/08/14/1713227/microsoft-black-tues
>>> da y-patches-bring-blue-screens-of-death
>>>
>>> -Bonnie
>>>
>>
>>
>>
>>
>>
>
>
>
>
