BSOD Server 2019

Question

I am getting a BSOD pointing back to the ntsokrnl on multiple Server 2019 Standard VMs I have running on Hyper V. I started getting these a few months randomly without any major software changes, etc. Since this we have multiple servers on 2 different machines all getting the same type BSOD errors. I have ran Windows Updates and fully updated, fixed via SFC, DISM, etc and still having the issue. I am not a debugger by any means but unsure on where else to go. I recently updated the server drivers and software and still having same issue. Any ideas on what could be causing this? With it being a VM, I would think most drivers would be standard. Would anyone be willing to take a look at the dump files and let me know if you can see something I don't. I have ran them through windbg without much help.

Answer 1

I'd check here and with manufacturer that the host supports Server 2019
https://www.windowsservercatalog.com/

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Looks Ok
https://support.hpe.com/connect/s/product?language=en_US&tab=driversAndSoftware&kmpmoid=1010093150&environmentType=2200014&environmentSubtype=2000152

the server manufacturer (HP) will be your best resource for troubleshooting problems with the hardware.
https://community.hpe.com/t5/proliant-servers-ml-dl-sl/bd-p/itrc-264#.Y30gSsvMK3A

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Hello Jordan,

Are your crash dumps "minidumps" or one of the larger types of dump?

One can create a minidump from a larger dump with the debugger ".dump /m <FileName>" command.

My suggestion would be to make some minidumps available and just see what happens. As an example, I sometimes look at crash dumps that have been posted but only respond in the forum if I have something useful/helpful to say; in other words, a lack of response does not necessarily mean that no-one has tried to help.

Sometimes a minidump provides a strong hint for a helpful next step, sometimes it suggests that the true cause of the problem happened sometime in the past (corruption of some data structure) and that the crash occurred when the problem was discovered (even detailed crash dump analysis is unlikely to reveal the true cause) and sometimes it is clear that a larger dump is needed (to examine relevant data structures that are not included in the minidump) in order to make progress.

Gary

Answer 4

Hello Jordan,

The cause of the crash was a kernel stack overflow:

The Windows kernel had to switch to a special stack to handle the stack overflow (that explains the change in Child-SP between the yellow and green highlighting).

Visible on the stack is WRkrn.sys, which seems to be part of Webroot SecureAnywhere; since no debug symbols for WRkrn.sys are available, the Child-SP/RetAddr values below the blue highlighting are meaningless.

Third party security products are often the cause of crashes and WRkrn.sys is certainly a suspect in this case.

However, a large part of the stack is seemingly taken up with recursive calls to win32kfull!xxxDestroyWindow (the current process is NextGenEMR.exe).

I would suggest checking other dumps (if you have them) to see whether they are similar to this crash (especially presence of WRkrn.sys on the stack at time of crash and, to a lesser extent, NextGenEMR.exe as the current process).

Gary

Answer 5

There was one collected mini dump file.

The debugging displayed two misbehaving Webroot drivers.

wrkrn.sys
c:\windows\system32\drivers\wrkrn.sys

wrcore.x64.sys
c:\program files\webroot\core\wrcore.x64.sys

Please uninstall the antivirus software:

https://answers.webroot.com/Webroot/ukp.aspx?pid=1&app=vw&vw=1&solutionid=3925

https://community.webroot.com/webroot-secureanywhere-antivirus-12/pc-uninstallation-option-missing-from-control-panel-34688

There was only one mini dump file but this is likely to fix the BSOD.

After uninstalling Webroot you can wait one day and then reinstall the AV software.

If there are any new BSOD they can be troubleshooted (run the V2 log collector).

.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post there is /\ with a number: click = a helpful post
.
.
.
.
.