The system cannot find the file specified (ntknlmp, ntdll)

Question

Dear MSFT:

BSOD, and use windbg analyze the memory.dmp. get ntkrnkmp, ntdll Loading Error

OS:
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 19041.1.amd64fre.vb_release.191206-1406
************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmp The system cannot find the file specified
ntdll The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
For analysis of this file, run !analyze -v

Is this OS's symbols file not on http://msdl.microsoft.com/download/symbols ?

Answer 1

> Is this OS's symbols file not on http://msdl.microsoft.com/download/symbols ? <<

This depends.
E.g. symbols for most recent Windows versions may not be immediately available.
Can you post relevant output from !sym noisy and .reload command for ntknlmp, ntdll:

0: kd> !sym noisy
noisy mode - symbol prompts on
0: kd> .reload
SYMSRV:  BYINDEX: 0x3
         c:\mssymbols*https://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EF9A5375F61FE84B7EAEF54BF025C0E1
....

Answer 2

Hi Sir:

7: kd> !sym noisy
noisy mode - symbol prompts on
7: kd> .reload
SYMSRV: BYINDEX: 0x4
c:\symcache*http://msdl.microsoft.com/download/symbols
ntkrnlmp.pdb
096F9745ECB8036F251818D3753F37E21
SYMSRV: UNC: c:\symcache\ntkrnlmp.pdb\096F9745ECB8036F251818D3753F37E21\ntkrnlmp.pdb - path not found
SYMSRV: UNC: c:\symcache\ntkrnlmp.pdb\096F9745ECB8036F251818D3753F37E21\ntkrnlmp.pd_ - path not found
SYMSRV: UNC: c:\symcache\ntkrnlmp.pdb\096F9745ECB8036F251818D3753F37E21\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/ntkrnlmp.pdb/096F9745ECB8036F251818D3753F37E21/ntkrnlmp.pdb
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/ntkrnlmp.pdb/096F9745ECB8036F251818D3753F37E21/ntkrnlmp.pd_
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/ntkrnlmp.pdb/096F9745ECB8036F251818D3753F37E21/file.ptr
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: RESULT: 0x80190194
DBGHELP: ntkrnlmp.pdb - file not found
DBGHELP: nt - export symbols
Loading Kernel Symbols
...............................................................
..Page 1e1a1a not present in the dump file. Type ".hh dbgerr004" for details
..............................................................
................................................................
.....................................
Loading User Symbols
................................................................
................................................................
................................................................
................................................................
........
Loading unloaded module list
.................................................................................................................

************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmp The system cannot find the file specified
The SYMSRV client failed to find a file in the UNC store, or there
is an invalid UNC store (an invalid path or the pingme.txt file is
not present in the root directory), or the file is present in the
symbol server exclusion list.

Answer 3

****Use https have same error.****

7: kd> !sym noisy
noisy mode - symbol prompts on
7: kd> .reload
SYMSRV: BYINDEX: 0x4
c:\symcache*https://msdl.microsoft.com/download/symbols
ntkrnlmp.pdb
096F9745ECB8036F251818D3753F37E21
SYMSRV: UNC: c:\symcache\ntkrnlmp.pdb\096F9745ECB8036F251818D3753F37E21\ntkrnlmp.pdb - path not found
SYMSRV: UNC: c:\symcache\ntkrnlmp.pdb\096F9745ECB8036F251818D3753F37E21\ntkrnlmp.pd_ - path not found
SYMSRV: UNC: c:\symcache\ntkrnlmp.pdb\096F9745ECB8036F251818D3753F37E21\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/ntkrnlmp.pdb/096F9745ECB8036F251818D3753F37E21/ntkrnlmp.pdb
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/ntkrnlmp.pdb/096F9745ECB8036F251818D3753F37E21/ntkrnlmp.pd_
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/ntkrnlmp.pdb/096F9745ECB8036F251818D3753F37E21/file.ptr
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: RESULT: 0x80190194
DBGHELP: ntkrnlmp.pdb - file not found
DBGHELP: nt - export symbols
Loading Kernel Symbols
...............................................................
..Page 1e1a1a not present in the dump file. Type ".hh dbgerr004" for details
..............................................................
................................................................
.....................................
Loading User Symbols
................................................................
................................................................
................................................................
................................................................
........
Loading unloaded module list
.................................................................................................................

************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmp The system cannot find the file specified
The SYMSRV client failed to find a file in the UNC store, or there
is an invalid UNC store (an invalid path or the pingme.txt file is
not present in the root directory), or the file is present in the
symbol server exclusion list.

Answer 4

Also no luck on my side.
If it's a new kernel, possibly it's work in progress.
Though it may be an option to send an email to windbgfb at microsoft dot com - with
Windows version,
symbol file name,
and unique identifier - series of numbers in pdb-path reveals exact version (GUID and Age of pdb).
In your case:
096F9745ECB8036F251818D3753F37E21

Answer 5

Yes， it is a new kernel. may be it's work in progress.

Thanks.