Roughly 50% of our machines suffering Blue Screen after 24H2 update. (Build 10.0.26100.2033)

Question

Roughly 20% 30% 50% of our machines suffering Blue Screen after 24H2 update. (Build 10.0.26100.2033)

Issues with Blue screens after upgrading to Win11 24H2 from 23H2.

Hardware: Dell Latitude 5330

Troubleshooting tried:DISMSCANSFC

Rebuild OS from scratch (24H2)

Implemented registry fix to change memory caching size to 64mb for SSD

Upgraded forcepoint agent to latest version

.dmp files: https://we.tl/t-kmEDVNTmy9

Blue Screen Error when Running Forcepoint Endpoint Screening Agent | Dell US

This seems to be the closest article I've gotten to the error in the .dmp files but even upgrading to the latest forcepoint agent does not resolve the issue.Any fix would be welcome. Thanks, Stephen

*** Moved from Windows / Windows 11 / Performance and system failures ***

Answer 1

Hello Stephen McGrath (C) and welcome to the Microsoft Community!

Based on your feedback, you are experiencing a blue screen on your computer after the 24H2 update.

I did check the blue screen logs you uploaded and it states that

MEMORY_MANAGEMENT (1a)

Any other values for parameter 1 must be individually examined.

The program that reported the error is: WsNetFlt.sys

WsNetFlt.sys blue screen errors are usually associated with web filtering drivers

In particular, they are related to conflicts with security software such as Sophos and Forcepoint.

Here are some possible solutions:

Update the relevant software:

Ensure that all security software (e.g. Sophos and Forcepoint) versions are up-to-date

Visit the respective official websites to download and install the latest updates.

Check for driver updates:

Make sure your network adapter drivers are up to date.

You can update the driver through Device Manager

Click on windows key > search and open device manager, then right click to update the network card driver

Or visit the manufacturer's website to download the latest version.

Reset network settings:

Open Command Prompt (run as administrator), type the following command and press enter:

netsh winsock reset

netsh int ip reset

ipconfig /release

ipconfig /renew

ipconfig /flushdns

These commands will reset the network settings and may help resolve the problem.

The last thing to do is to try a clean boot to see if it's caused by other software interference

This can be done as follows

1. Tap Windows+R and type msconfig
2. Open System Configuration and select the General tab - Selective Startup.
3. Remove the checkbox of Load Startup Items.
4. Go to the Services tab - click Hide all microsoft services in the lower left corner, and then click Disable all.
5. Click OK and restart your computer. (Be sure to select Hide all microsoft services first and then click Disable all, otherwise it may lead to unforeseen problems such as not being able to access the system.)
6. Check if the problem will reappear.

DISCLAIMER: Clean Boot is a way to start Windows with a minimal set of drivers and startup programs so that you can determine if background programs are interfering with your games or programs and help you figure out the cause of the problem. It will help you get back on track.

I hope you find the above information helpful

Kirito|Microsoft Community Support Specialist

Answer 2

Hi Kirito,

Thanks for the response. I have tried nearly all the above steps you mentioned. We are a forcepoint house and all of the issues I am seeing seem to be because of that WsNetFlt.sys

This is where it gets a bit more interesting. One of our users who reported multiple blue screens we decided to move off forcepoint and now the .dmp file is saying the cause of the crash or the program reporting an error is pktmon.sys

This user is having multiple bluescreens within in an hour sometimes and he is the only one continuing to have issues after removing the forcepoint agent but now his error message has changed to pktmon.sys on the .dmp file.

https://we.tl/t-nWyEuODaKo

The commonality between both (pktmon.sys & WsNetFlt.sys) is they both use network drivers so, would I be right in thinking a faulty network driver update/install might be at play since updating machines to 24H2?

I did notice today 24H2 installed on the15th of October and I can see on this same date, changes were made to the driver files maybe as part of the update?

All of our machines on 24H2 and 23H2 are on the latest network driver from dell which they say is critical.
Whats strange though is that its only happening to about 25% of our users on 24H2 and not all but maybe the updates corrupted drivers for some users and not others due to installation order/interuptions etc,

Support for Latitude 5330 | Drivers & Downloads | Dell US

I'm going to test rolling back the network driver on one of the heavily affected machines to see if that helps.

Answer 3

Thank you for your reply.

Yes, you can try to replace the fallback network driver

In addition, you can also try clicking on the windows key>windows update>update history.

Uninstall this system update and see if that solves the problem.

Kirito|Microsoft Community Support Specialist

Answer 4

Thanks Kirito,

Can I ask that you have a look at this https://we.tl/t-nWyEuODaKo
We are now getting this error message alot. pktmon.sys

A google doesn't give me any results when searching "pktmon.sys BSOD" or "pktmon.sys bluescreen"

Thanks,
S