We have an 11 node Hyper-V cluster running Server 2012 R2 with all latest updates.

We have had an ongoing issue with nodes BSODing or hanging. 

Specs:

Hyper-V Nodes-

128-256GB of RAM per node, depending on generation. 12-32 cores. None of the machines are starving for resources. We have a cluster setup through SC VMM 2012 R2 that optimizes the VMs every 30 minutes. The vhd's for VM's sit in a SMB 3.0 share hosted by a SOFS cluster w/ Storage Spaces on a JBOD. Each Hyper-V host utilizes 2 x10Gb Intel NIC cards (either X520-T2 or X540-T2 depending on node) in a NIC team that is currently set to active-standy

We have tried:

adjusting VMQ settings so each NIC uses different cores

Switching NIC team from Active-Active to Active-Standby.

William R Schenk

Hello everybody...

I am on the way of installing the Visual SVN server and JIRA on our company server and I have few questions to you guys. I have read an article about Windows Server 2012 Essentials R2 running Hyper-V on this webpage:

http://blogs.technet.com/b/sbs/archive/2013/09/03/understanding-licensing-for-windows-server-2012-r2-essentials-and-the-windows-server-essentials-experience-role.aspx

and I am a bit confused. From my understanding of the licensing of MS Server 2012 Essentials R2 I can run Hyper-V role with two VM instances of Windows Server 2012 Essentials at no cost but with only Hyper-V role enabled on a physical server? My question is if I will install Windows Server 2012 Standard on a separate license just fro JIRA and SVN can I run it on a VM without any problem with licensing of Windows Server 2012 Essentials R2? I know it sounds a bit complicated but I could not find the answer on my question anywhere....

Best Regard Wojciech Bogucki

I have windows 10 setup on hyper-v and i cannot find the option to use all my monitors.  It used to pop-up when connected to the VM, but i disabled it and now I cant figure out how to turn it back on.

Hi

Server 2008 R2 Datacenter Hyper-V Cluster (3 Hosts in Cluster).

One of my Server 2008 R2 Standard VM's keeps rebooting itself every 3 minutes.

Got the VM into Safe Mode with Networking, stays up no problem. In Event Logs, there are thousands of Disk Event ID 51 errors ("An error was detected on device \Device\Harddisk1\DR1 during a paging operation").

Initially I thought this was a Hardware issue, but this is not the case (running on HP Storageworks MSA2312i SAN). All disks fine, all firmware on both Disks and Controllers upgraded to latest version.

Any ideas what may be causing this? The error is not present in any other VM's. Moving the VM across different hosts does not resolve the issue. Neither does moving the vhd files to different areas on the SAN.

Thanks

I have a Windows Server 2012 R2.

I have tried to install RD Connection Broker, but the server manager says it need a restart.

At restart is says: "We couldn't complete the features, Undoing changes"

I think it may be Hiper-V not fully installed. Tried to remove this feature, but I keep ending up with server manager info: "needs restart" and then at restart "We couldn't complete the features, Undoing changes".

I've tried to use the tool "DISM /Online /Cleanup-Image /RestoreHealth" that says "the corruption was repaired", but still the problem remains.

I can't add or remove any feature on server manager.

Thansk in advance for any help.

PS: Info from WindowsUpdate.log:

OK, so we have two Win 2012 servers, running Hyperv.

One only has one host.

Simples, I will move that one into the same DC (same LAN in all DCs).

The Server starts and uses the correct WAN address, I can RDP in and do all as before. The VM ( Centos 5.6) will start and run fine.

But I have no network access from or to the VM, this is not FW related as the FW is disabled.

I have logged into the guest VM and can get no WAN access.

Any tips, or pointers to get this, once working, machine up serving again?

Thanks

Hello!

I dont know if is this right place to post it but if is not move it.

I installed windows server 2008. Need to set DHCP and DNS server  while using Hyper-v.

Can anyone tell me how to do that,please?

hi,

i want to setup small lab for testing, with hyperv and cloudstack.

i have two servers, windows 2012r2 hyperv role. i have two nic on both server. one nic is directly connected to other directly without router

now i want to setup vlan tagging option, for cloudstack hyperv networking.

for that i have setup nic teaming with one nic with default  and created external switch with teaming nic.

now upto this everything works fine.

problem is if i enable vlan id with "2" and in vm also , then  external switch and vms is not getting internet,

Please help

Thanks

Partha

Hi

Ive been lucky enough to get hold of some decent lab kit and was looking for advice on how to set it up (as close to production as poss)

I have:

2 x Dell T620 with 6 NICs
1 x HP MicroServer Gen8 with 3 NICs
16 port Layer 3 switch
8 port Layer 2 switch

I was thinking about clustering the 2 T620 Hyper V hosts and using SMB 3.0 on Windows Server 2012 R2 installed on the HP micrsoservers.

Is it a good idea to team the NICs in the Microserver for performance ?
For my labs, I like to have separate VLANs in a vyatta virtual router so I can emulate different AD sites etc.

Any advice would be appreciated on this.

As i am doing Master in computer science and i am going to submit my research proposal in next month. I need guideline.

1. What are the hyper v security issues?

2.what are the weak points of hyper v with respect to security.

Thing which got my attention is MAC spoofing in hyper v, beside this your support is requested.

It will be great if some one help me out in this.

Hi All.

I have been messing around this weekend with Hyper V Server 2012 R2 and been having a tough time connecting to the server if the server is left configured as Workgroup.

We usually use VMware ESX i etc and I really want to give Hyper V a trial run.

I am just failing to unserstand Microsofts logic to have the Host server joined to the Domain.

After all surely your domain controller for the domain would be one of the guest machines on this very server.

How would you authenticate to the Hyper V server if the domain controller has not even started up yet ?

Any comments or experience on this would be most helpful.

Many thanks.

Shaun

I have a Hyper-V Windows Web Server 2008 R2 (Core) that's only role is an FTP server. I know that the GUI is a blank desktop and task manager on a core server, but I cannot even access that.  Every time I connect to the server (either via RDP or Virtual Machine Connection) I get a BSOD after I enter my credentials and the server reboots.  The BSOD is not the same every time either, most of the time it's 0x00000050 though.

I can access remote powershell, psexec to the command line, issue remote commands, use RSATs, etc... but I cannot access the "desktop" i normal mode (I can in safe mode).

I didn't mind too much because I could do everything I needed to do remotely.  But just recently we've developed a problem where OSX devices download files from the FTP EXTREMELY slow and the server needs to be rebooted.  I'm not a fan of the "reboot fix" and need a more permanent solution.

Here's some more technical specs:

Host server: Server 2008 R2 Enterprise SP1, Dual Xeon E5645, 48GB RAM

Host server uses iSCSI connection to a Windows Storage Server Standard w/ a Xeon E5620, 12GB RAM so each VHD is using it's own iSCSI LUN and therefore independent (and redundant) spindles to increase I/O throughput.  The Storage server uses a 10Gbps connection directly to the host server (iSCSI data is not sent over our main network).

Client Server: Windows Web Server 2008 R2 SP1 (core), 1 CPU, 1 GB RAM.

Here's what I've tried so far:

1. Create a new virtual server and attach a copy of the FTP servers drive

2. Apply all windows updates from the internet and not our WSUS server

3. Remove our anti-virus from the client

4. Remove SCSI virtual devices from the virtual server

5. Remove all integration services

6. Using safe-mode, used autoruns to disable all services

Normally I'd just rebuild the server and copy all the necessary info over, but the FTP server has dozens of local users (and their passwords) that need to be migrated to the new server.  I guess this can be done with the migration kit, just not on windows web server (booo).  A 3rd party tool is an option as well if that's all there is available.

Any help will be greatly appreciated.

Hi,

I'm using this wmi query "
SELECT * FROM Win32_PerfRawData_PerfDisk_LogicalDisk WHERE Name!='_Total'" with namsepace asroot\cimv2 to get the disk related metrics but please let me know from this how to calculate the disk read latency and disk write latency metrics. I need an formula to calculate the latency.

Thanks in advance!!

Regards,
Raamesh Keerthi N J

I have been running into an interesting but an alarming issue with virtual switches. I have recently built a 4 node Server 2012 Hyper-V failover cluster. I have built numerous 2008R2 and 2012 Hyper-V clusters before, so I am pretty familiar with the process. I have rebuilt my VMM due to software problems, and on this new cluster, I have configured the virtual switches with nic teaming on 2 of the virtual switches.

I have 4 clusters being managed by this VMM.. and this newly built cluster keeps losing all of the VMM virtual switch configurations, meaning if I go to properties on the problem host and click on virtual switches, its blank. Refresh host cluster flags all virtual machines in this cluster as "Unsupported Configuration," making the vm unmanageable via VMM. 

All virtual servers on that host still has connectivity, as all virtual switch configs are normal when looking at it with Hyper-V Manager or Failover Cluster Manager..

The workaround is to evacuate the host using Failover Cluster Manager and reboot the host. Then refresh the host. Then refresh the VM's. I cannot consider this a 'workaround' as I cannot be rebooting my hyper-V hosts every week.. and migrating virtual servers constantly just for this reason. (DPM backups have a FIT with csv's if it tries to backup a vm on a same csv as another vm thats being migrated.)

I have been wrestling with this problem for a few weeks now. The cluster has been slicked and completely rebuilt.. Still same problems. Has ANYONE else out there seen this issue? Does ANYONE out there suggest a way to go about further troubleshooting this issue? 

Getting an internet connection with a wireless adapter is trivial nowadays, and for most people a connection is enough.

However, the guest thinks the connection is Ethernet, which poses a problem for a subset of Linux users.

#iwconfig eth0 no wireless extensions. So, can we bind a USB device with Add Hardware in the vm's settings? No, that seems to only be possible with a usb HDD. 

When taking VSS snapshot with Hyper-V VSS writer on Windows 2012 R2, there are frequently some warning/error logs in Windows Event log. This will make the Hyper-V VSS writer goes to a bad state and in BCD, the BACKUP_METADATA is also missing for the problematic VM.

The logs in Windows Event log are as below:

In Windows Log->Application, there will be logs as:

Hi

i have production hyper-v cluster with VMs and DR hyper-v cluster setup , between the hardware firewall hyper-v replica enabled and open port (80.443.135.139)-  replication is successfully doing

but once the planned fail over start  its not finishing (it showing failover in progress long time )

network administrator monitor the traffic saying many deny traffic is there.

my environment is very tight by firewall,

i need to know what are the traffic(ports) we have to open in firewall between the cluster.

I currently have a two node Server 2012 R2 Hyper-v Cluster (fully patched) with a Windows Server 2012 R2 Iscsi target.

The VMs run fine all day long, but when I try to do a live/quick migration the VM blue screens after about 20 minutes. The blue reports back about a “Critical_Structure_Corruption”.

I’m being to think it might be down to CPU, as one system has an E-2640v2 and the other one has an E5-2670v3. Should I be able to migrate between these two systems with these type of CPU?

Tim

Hi,

our Microsoft Windows Server 2012 R2 with Hyper-V crashed today.

According to the dumpfile it seems to be something with vhdmp.sys

Any idea what could have been causing this?

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {b500190637, ffffd001577c63b8, ffffd001577c5bc0, fffff801ccc12154}

Probably caused by : vhdmp.sys ( vhdmp!ExFreeToNPagedLookasideList+3c )

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80284dc4138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffffffffffffff

FOLLOWUP_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff

FOLLOWUP_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff

FOLLOWUP_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> lmvm vhdmp
start             end                 module name
fffff801`ccc09000 fffff801`ccc98000   vhdmp      (pdb symbols)          c:\symbols\vhdmp.pdb\264A69A11D4744DDAE6F46BEFACB46EC1\vhdmp.pdb
    Loaded symbol image file: vhdmp.sys
    Mapped memory image file: c:\symbols\vhdmp.sys\52E848DA8f000\vhdmp.sys
    Image path: \SystemRoot\System32\drivers\vhdmp.sys
    Image name: vhdmp.sys
    Timestamp:        Wed Jan 29 01:18:34 2014 (52E848DA)
    CheckSum:         00092FA0
    ImageSize:        0008F000
    File version:     6.3.9600.16521
    Product version:  6.3.9600.16521
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0000.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     vhdmp.sys
    OriginalFilename: vhdmp.sys
    ProductVersion:   6.3.9600.16521
    FileVersion:      6.3.9600.16521 (winblue_gdr.140128-1545)
    FileDescription:  VHD Miniport Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.