Updated Archive of the Debug Ninja’s Twitter Debug Tips

Every Wednesday (usually) I post a debug tip to our twitter page at https://twitter.com/#!/ntdebugging. This blog is an archive of these tips to allow our readers to find this information easily. I will update this blog periodically with the new tips; follow us on twitter if you want to see the tips as I post…

1

A Classic Case of Whodunit

Sometimes we encounter problems that just don’t make sense.  I don’t mean a high powered lawyer talking about Chewbacca, I mean sometimes computers do things that defy logic.   The below bugcheck is one example.  At first glance, some people will blame the first third party code they see and declare "It’s the anti-virus!"  That…

5

NTFS And 4K Disks

Since the 1960’s, hard disks have always used a block size of 512 bytes for the default read/write block size.  Recently drive manufacturers have been moving toward a larger block size to improve performance and reliability.  Currently there are two types of disks available with a 4KB sector size: 512 byte emulated, and 4KB block…

5

What Is In A RHS Dump File Created By Windows Error Reporting

Hello all, East here.  I wanted to give you a hint on how to use a RHS dump to find what thread was part of the Windows Server 2008 R2 cluster RHS recovery deadlock.   First let me start off with letting you know that Windows Server 2008 R2 will create two types of user-mode…

3

Understanding Storage Timeouts and Event 129 Errors

Greetings fellow debuggers, today I will be blogging about Event ID 129 messages.  These warning events are logged to the system event log with the storage adapter (HBA) driver’s name as the source.  Windows’ STORPORT.SYS driver logs this message when it detects that a request has timed out, the HBA driver’s name is used in…

11

The Mystery of Lsass.exe Memory Consumption, (When all components get involved)

Hi All, this is Karim Elsaid and I’m a Support Escalation Engineer working with the Dubai platforms support team.  Recently I was working on a very challenging and interesting case, and I wanted to share that experience with you.   One of our customers was experiencing a problem on all his Domain Controllers (Running x86…

4

Control Panel Policy and the Missing Icon

A customer recently reported a rather peculiar problem.  They were working on a roll out of Windows 7, and one of the policies they employed on their domain was the “Show only specified control panel applets” setting.  As its name implies, this policy allows an administrator to specify the names of any Control Panel icons…

1

Windows 7 XP Mode – Auto Publish ‘Not Available’

Hello All, Ron Riddle here again to share another mystery relating to the XP Mode Auto Publish feature for Windows 7 that had an unexpected root cause.  As you may know, the Auto Publish feature allows applications installed within the guest to be automagically available from the start menu of the Windows 7 host.  Of…

3

How Queue Deadlocks Happen

I recently worked on an interesting system hang issue with a deadlocked work queue and wanted to share some information about how we resolved the issue.   In this example, we will demonstrate how a cascaded work item can deadlock a work queue.  As you can see from the illustration, we have three worker threads. …

3

Interpreting a WHEA error for a MCA fault

Howdy fellow debuggers! This is Graham McIntyre, I am an Escalation Engineer in Platforms Global Escalation Services.  We get questions from time to time from customers who experience a WHEA bugcheck 0x124, or system event, for help in interpreting the error record. The information applies to Windows Server 2008 / Vista SP1 and Windows 2008…

3