Blue Screen RDR_FILE_SYSTEM failed ksecdd.sys driver at migrate to Windows 11 when the user do login

Question

Hi, I have a computer, that do years is possible that was migrated of Windows 8 to Windows 10. And now is migrated of Windows 10 to Windows 11. The migration was be with setup in remote executing:

setup.exe /auto upgrade /copylogs 'C:\\upgrade_log' /priority normal /noreboot /quiet /eula accept;  

The migration was successful. The user profile uses the Documents and Desktop folders linked to one network drive (by GPO), this entries in the desktop sucessfully, but passed a time, the show the blue screen

detection code: RDR_FILE_SYSTEM
failed: ksecdd.sys

I entried with my user and did:

> DISM.exe /Online /Cleanup-Image /Checkhealth  

> DISM.exe /Online /Cleanup-Image /Scanhealth  

> DISM.exe /Online /Cleanup-Image /Restorehealth  

Also I entried in recovery partititon and opened the cmd and ran:

fsc /scannow

This found error and repared it. Also ran:

bootrec /Rebuildbcd

This ask me if I would want repare, I tell her that yes.

Finally entry in the system, log me and reboot it.

I entry with the user that uses the network drive and this is not resolved. Do same it. Blue screen with error of driver ksecdd.sys.

I looked the DPM file downloading the debugger windows: https://learn.microsoft.com/es-es/troubleshoot/windows-client/performance/read-small-memory-dump-file

I ran the windbg command line with a batch script and the output is this:

PS C:\Users\iheredia\Documents> .\dumpcheck.bat C:\Users\iheredia\Downloads\111722-6296-02.dmp  

C:\Users\iheredia\Documents>cd "C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64"  

C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64>kd -y srv*c:\symbols*http://msdl.microsoft.com/download/symbols -i c:\windows\i386 -z C:\Users\iheredia\Downloads\111722-6296-02.dmp  

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64  
Copyright (c) Microsoft Corporation. All rights reserved.  


Loading Dump File [C:\Users\iheredia\Downloads\111722-6296-02.dmp]  
Mini Kernel Dump File: Only registers and stack trace are available  

Error: Attempts to access 'c:\windows\i386' failed: 0x2 - The system cannot find the file specified.  

************* Symbol Path validation summary **************  
Response                         Time (ms)     Location  
Error                                          c:\windows\i386  

************* Symbol Path validation summary **************  
Response                         Time (ms)     Location  
Deferred                                       srv*c:\symbols*http://msdl.microsoft.com/download/symbols  
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols  
Executable search path is: c:\windows\i386  
Unable to load image ntoskrnl.exe, Win32 error 0n2  
*** WARNING: Unable to verify timestamp for ntoskrnl.exe  
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe  
Windows 8 Kernel Version 22621 MP (12 procs) Free x64  
Product: WinNt, suite: TerminalServer SingleUserTS  
Machine Name:  
Kernel base = 0xfffff803`6e400000 PsLoadedModuleList = 0xfffff803`6f0133f0  
Debug session time: Thu Nov 17 13:44:28.874 2022 (UTC + 1:00)  
System Uptime: 0 days 0:54:10.138  
Unable to load image ntoskrnl.exe, Win32 error 0n2  
*** WARNING: Unable to verify timestamp for ntoskrnl.exe  
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe  
Loading Kernel Symbols  
...............................................................  
................................................................  
................................................................  
..............  
Loading User Symbols  
Loading unloaded module list  
............  

************* Symbol Loading Error Summary **************  
Module name            Error  
ntoskrnl               The system cannot find the file specified  

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.  
You should also verify that your symbol search path (.sympath) is correct.  
*** WARNING: Unable to verify timestamp for rdbss.sys  
*** ERROR: Module load completed but symbols could not be loaded for rdbss.sys  
*******************************************************************************  
*                                                                             *  
*                        Bugcheck Analysis                                    *  
*                                                                             *  
*******************************************************************************  

Use !analyze -v to get detailed debugging information.  

BugCheck 27, {baad0073, fffffb05c783eb38, fffffb05c783e350, fffff8036e189025}  

*** WARNING: Unable to verify timestamp for ksecdd.sys  
*** ERROR: Module load completed but symbols could not be loaded for ksecdd.sys  
***** Kernel symbols are WRONG. Please fix symbols to do analysis.  

*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!KPRCB                                      ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!KPRCB                                      ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
Probably caused by : ksecdd.sys ( ksecdd+9025 )  

Followup: MachineOwner  
---------  

8: kd> !analyze -v  
*******************************************************************************  
*                                                                             *  
*                        Bugcheck Analysis                                    *  
*                                                                             *  
*******************************************************************************  

RDR_FILE_SYSTEM (27)  
    If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the  
    exception record and context record. Do a .cxr on the 3rd parameter and then kb to  
    obtain a more informative stack trace.  
    The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined  
    as follows:  
     RDBSS_BUG_CHECK_CACHESUP  = 0xca550000,  
     RDBSS_BUG_CHECK_CLEANUP   = 0xc1ee0000,  
     RDBSS_BUG_CHECK_CLOSE     = 0xc10e0000,  
     RDBSS_BUG_CHECK_NTEXCEPT  = 0xbaad0000,  
Arguments:  
Arg1: 00000000baad0073  
Arg2: fffffb05c783eb38  
Arg3: fffffb05c783e350  
Arg4: fffff8036e189025  

Debugging Details:  
------------------  

***** Kernel symbols are WRONG. Please fix symbols to do analysis.  

*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!KPRCB                                      ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!KPRCB                                      ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type information.      ***  
***                                                                   ***  
***    Certain .pdb files (such as the public OS symbols) do not      ***  
***    contain the required information.  Contact the group that      ***  
***    provided you with these symbols if you need this command to    ***  
***    work.                                                          ***  
***                                                                   ***  
***    Type referenced: nt!_KPRCB                                     ***  
***                                                                   ***  
*************************************************************************  
*************************************************************************  
***                                                                   ***  
***                                                                   ***  
***    Either you specified an unqualified symbol, or your debugger   ***  
***    doesn't have full symbol information.  Unqualified symbol      ***  
***    resolution is turned off by default. Please either specify a   ***  
***    fully qualified symbol module!symbolname, or enable resolution ***  
***    of unqualified symbols by typing ".symopt- 100". Note that   ***  
***    enabling unqualified symbol resolution with network symbol     ***  
***    server shares in the symbol path may cause the debugger to     ***  
***    appear to hang for long periods of time when an incorrect      ***  
***    symbol name is typed or the network symbol server is down.     ***  
***                                                                   ***  
***    For some commands to work properly, your symbol path           ***  
***    must point to .pdb files that have full type

Answer 1

Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

https://www.elevenforum.com/t/bsod-posting-instructions.103/

.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post there is /\ with a number: click = a helpful post
.
.
.
.
.

Answer 2

I encountered this problem as well and found this to be a solution. I had to remove the local path in the home folder section of the user profile in Active Directory. Also, remove the logon script from the logon script section.

I also tested using only one of the options, and it worked, but when I used both options, my system crashed with the same error.

Answer 3

https://social.technet.microsoft.com/Forums/en-US/5aa69f15-d93b-4b47-9fc3-a181450395c9/rdrfilesystem-ksecddsys-error-bsod?forum=w8itprogeneral

This is a link used to the solution.

Answer 4

I had the same issue when a user would RDP to a 2022 server. They had an error in their login script. The NET USE statement ended with "SP" instead of "$P".