BSOD Windows Server 2012 R2

Question

BSOD Windows Server 2012 R2

James Walton 1

Hi there

I have a Windows Server 2012 R2 VM running on ESXi 6.7. It has started to restart itself about 1 minute after booting Windows.

The log in box does not appear when I press Ctrl+Alt+Del. I just see the Windows logo at the bottom of the screen in front of a dark blue screen.

It will then show a blue screen of death with the following code: 0xC000021A

Same issue occurs if I select Last Known Good Configuration.

I can boot into Safe Mode, so I checked the System Logs and can see the following two events:

the plug and play service terminated unexpectedly. it has done this 1 time(s). the following corrective action will be taken in 60000 milliseconds: reboot the machine. server 2012 r2

the power service terminated unexpectedly. it has done this 1 time(s). the following corrective action will be taken in 60000 milliseconds: reboot the machine. server 2012 r2

I have tried:
sfc /scannow - no issues detected
dism /restorehealth - found and repaired some corruption to the store
Booting with all non-Microsoft services disabled - same BSOD

I'm out of ideas except for building a new server to replace this one.

Any ideas please?

Thanks

2 answers

Your answer

Answer 1

Hi,
For BSOD, I suggest that you could boot into Safe Mode. Then check if any mini dump or memory dump could be found.
C:\Windows\memory.dmp or Mini dump
Use WinDbg previewer tool to analyze dump files.
https://www.windowscentral.com/how-open-and-analyze-dump-error-files-windows-10
Also I suggest that you could perform a clean boot to avoid the influence of non-Microsoft services or software.
https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd
Hope this helps and please help to accept as Answer if the response is useful.
Best Regards,
Carl

Answer 2

Hi Carl

Here's the results from the memory.dmp:

Loading Dump File [C:\Users\james.walton\Desktop\MEMORYpr-ap02.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

************* Path validation summary **************
Response Time (ms) Location
Deferred SRVC:\Windows\symbol_cachehttp://msdl.microsoft.com/download/symbols
Symbol search path is: SRVC:\Windows\symbol_cachehttp://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (2 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Built by: 9600.19724.amd64fre.winblue_ltsb_escrow.200519-1914
Machine Name:
Kernel base = 0xfffff802af00c000 PsLoadedModuleList = 0xfffff802af2d15f0
Debug session time: Thu Mar 4 22:29:23.906 2021 (UTC + 1:00)
System Uptime: 0 days 0:01:42.592
Loading Kernel Symbols
...............................................................
.........................................................Page 11c659 not present in the dump file. Type ".hh dbgerr004" for details
.......
.................
Loading User Symbols
.......................
Loading unloaded module list
........
For analysis of this file, run !analyze -v
1: kd> !analyze -v

*
Bugcheck Analysis *
*

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffffc001a89415e0, String that identifies the problem.
Arg2: 0000000000000000, Error Code.
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:

Page 11c659 not present in the dump file. Type ".hh dbgerr004" for details
Page 11c659 not present in the dump file. Type ".hh dbgerr004" for details
Page 11c659 not present in the dump file. Type ".hh dbgerr004" for details

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.Sec
Value: 6

Key  : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on LAPTOP

Key  : Analysis.DebugData
Value: CreateObject

Key  : Analysis.DebugModel
Value: CreateObject

Key  : Analysis.Elapsed.Sec
Value: 6

Key  : Analysis.Memory.CommitPeak.Mb
Value: 61

Key  : Analysis.System
Value: CreateObject

VIRTUAL_MACHINE: VMware

ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x

EXCEPTION_CODE_STR: c000021a

EXCEPTION_PARAMETER1: ffffc001a89415e0

EXCEPTION_PARAMETER2: 0000000000000000

EXCEPTION_PARAMETER3: 0000000000000000

EXCEPTION_PARAMETER4: 0

BUGCHECK_CODE: c000021a

BUGCHECK_P1: ffffc001a89415e0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: services.exe

ADDITIONAL_DEBUG_TEXT: Windows must now restart because the Power service terminated unexpectedly

TAG_NOT_DEFINED_1004c:
This is a STATUS_SYSTEM_PROCESS_TERMINATED bugcheck.
It signals that the system is rebooting due to a critical service termination.
The bugcheck is not very useful for debugging. To investigate the root cause
find the related svchost.exe crashes that happened on the same machine
around the time of this dump.

IMAGE_NAME: ntkrnlmp.exe

MODULE_NAME: nt

STACK_TEXT:
ffffd0017013f6b8 fffff802af3848a9 : 000000000000004c 00000000c000021a ffffd00170ad43f8 ffffe00141dc6130 : nt!KeBugCheckEx
ffffd0017013f6c0 fffff802af37c194 : 0000000000000000 ffffd0017013f7d9 0000000000000000 0000000000000002 : nt!PopGracefulShutdown+0x2c9
ffffd0017013f700 fffff802af15c3e3 : ffffe0013e10b880 0000000000000000 ffffe001c0000004 0000000000000000 : nt! ?? ::OKHAJAOM::string'+0x1d64 ffffd0017013f840 fffff802af1504a0 : fffff802af583acd 0000000000000001 ffffd0017013fa58 00000000c0000004 : nt!KiSystemServiceCopyEnd+0x13 ffffd0017013f9d8 fffff802af583acd : 0000000000000001 ffffd0017013fa58 00000000c0000004 fffff802af173c32 : nt!KiServiceLinkage ffffd0017013f9e0 fffff802af4c6ec3 : 0000000000000000 0000000000000000 ffffd00173f4e180 ffffe0013e10b9c0 : nt! ?? ::NNGAKEGL::string'+0x6361d
ffffd0017013faa0 fffff802af0b5722 : fffff802af0b5668 0000000000000000 0000000000000002 0000000000000000 : nt!PopPolicyWorkerAction+0x63
ffffd0017013fb10 fffff802af0795bf : fffff80200000002 ffffe0013e10b880 fffff802af2b80e0 0000000000000000 : nt!PopPolicyWorkerThread+0xba
ffffd0017013fb50 fffff802af0cfab2 : 0000000000000000 ffffd00173f4e180 0000000000000080 ffffe0013daca900 : nt!ExpWorkerThread+0x69f
ffffd0017013fc00 fffff802af153f66 : ffffd00173f4e180 ffffe0013e10b880 ffffe0013db38880 ffffe0013db38800 : nt!PspSystemThreadStartup+0x18a
ffffd0017013fc60 0000000000000000 : ffffd00170140000 ffffd0017013a000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x16

SYMBOL_NAME: nt! ?? ::OKHAJAOM::`string'+1d64

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1d64

FAILURE_BUCKET_ID: 0xc000021a_umpo.dll_Critical_Service_Terminated_nt!??::OKHAJAOM::string

OS_VERSION: 8.1.9600.19724

BUILDLAB_STR: winblue_ltsb_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

FAILURE_ID_HASH: {7859d7e0-9a15-f445-e1fe-5513f0669aa6}

Followup: MachineOwner

This is a STATUS_SYSTEM_PROCESS_TERMINATED bugcheck.
It signals that the system is rebooting due to a critical service termination.
The bugcheck is not very useful for debugging. To investigate the root cause
find the related svchost.exe crashes that happened on the same machine
around the time of this dump.

Does this help indicate the source of the issue at all? I note that the power service is mentioned again, so to me that seems to be the root of the problem. The VM boots fine in safe mode with the power service enabled though.

I'll try the clean boot option and go through each service to see if that helps too.

Thanks
James

Share via

BSOD Windows Server 2012 R2

2 answers

Your answer