Windows has recovered from an unexpected shutdown- Blue Screen

Question

OS: Windows Server 2018

My office server shuts down consistently and repeatedly (5-8 times daily) during midnight 12am - 7am, causing Event ID 6009 - 'unexpected shutdown'

After checking the logs, I do notice that [Event 7026] appears every time after the 'unexpected shutdown', however it only comes up AFTER the unexpected shutdown.

Event 7026 -
The following boot-start or system-start driver(s) failed to load:
storflt

Attached the mini dump file.

thanks

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6003.2.2.0.272.7
Locale ID: 1033

Additional information about the problem:
BCCode: d1
BCP1: 0000000000000270
BCP2: 0000000000000005
BCP3: 0000000000000001
BCP4: FFFFFA6000CCE598
OS Version: 6_0_6003
Service Pack: 2_0
Product: 272_3

Files that help describe the problem:
C:\Windows\Minidump\Mini070123-01.dmp
C:\Users\Administrator\AppData\Local\Temp\2\WER-20311298-0.sysdata.xml
C:\Users\Administrator\AppData\Local\Temp\2\WER1145.tmp.version.txt

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

](https://filestore.community.support.microsoft.com/api/images/f0046eb4-29b2-4ffc-8112-83c106a640d0?upload=true&fud_access=wJJIheezUklbAN2ppeDns8cDNpYs3nCYjgitr%2bfFBh2dqlqMuW7np3F6Utp%2fKMltnRRYFtVjOMO5tpbpW9UyRAwvLeec5emAPixgq9ta07Dgnp2aq5eJbnfd%2fU3qhn54QarSzpy6NqV%2bFqi4Xjx2OzMc%2bimGL0W%2bZ%2bE%2bsc4eoj6gGI96o6xk35eFIFMrRmORnv13UcC55MOZ5LSWxc3k4AWhYxkZsVBDe2MzMAzH9Muitn1hBETQywLwuJ14kNur0WvkMep9A6WPIUMT%2bJGqSGu4ESIkcKGOz0%2btZPg1uGZAVOD82B%2fcSZtW24hfuq8hgJ9D%2bGpjBUTR3zYcOeDGmT5lorSKcaTF8RdaZJOtdZQO%2bNqIeiKp97VvwDv18GUwRAK5Uf8kGoRujarm%2b%2fA%2bsVakac1wjZlX5HNmvwL27qo%3d)

Mini Dump File: https://we.tl/t-CwOkiFrwFR

Answer 1

Hello Tylprd,

Thank you for your question and for reaching out with your question today.

Based on the information provided, it appears that your Windows Server 2018 is experiencing unexpected shutdowns, accompanied by a Blue Screen of Death (BSOD) error with BCCode d1. The Event ID 7026 suggests a driver issue related to 'storflt' failing to load during system startup.

Here are a few steps you can take to troubleshoot this issue:

1. Analyze the minidump file: The minidump file located at C:\Windows\Minidump\Mini070123-01.dmp contains information about the crash. You can analyze it using debugging tools like WinDbg to get more detailed information about the error and identify the driver or component responsible for the crash.
2. Update drivers: Since the Event ID 7026 indicates a driver issue, it's worth updating the drivers on your server. Start by focusing on the 'storflt' driver. Visit the website of the manufacturer of the storage controller or disk driver and check for any available driver updates. Apply the updates and monitor the system for stability.
3. Check for hardware issues: Perform a thorough hardware check on your server. Ensure that all hardware components are properly seated and connected. Check for any signs of physical damage or overheating. Run diagnostic tests, such as Windows Memory Diagnostic, to check for memory issues.
4. Review system logs: Examine the Windows Event Viewer logs for any additional error messages or warnings that might provide insights into the cause of the crashes. Look for patterns or common events that occur before the unexpected shutdowns.
5. Consider system-specific factors: If the issue occurs only during specific time windows (12 am - 7 am), investigate if any scheduled tasks, automated backups, power management settings, or third-party software are triggering the shutdowns. Disable or modify these settings temporarily to see if the issue persists.

Remember to perform backups of critical data before making any significant changes to the server's configuration or performing hardware checks.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.