Questions

blacK Screen of Death (KSOD) for Windows Server 2008

Tags:
+
0 Votes
Locked

blacK Screen of Death (KSOD) for Windows Server 2008

llee
On Sunday, Jan 20, 2013, I installed a number of updates for my office's Windows Server 2008 SP2 machine, and after the reboot, the system had some major difficulties starting up again. I couldn't get in normally or with Last Known Good configuration, and even trying to go in via Safe Mode would simply cause the machine to hang. After using the installation CD to boot up & performing a really long chkdsk, the system found a bunch of errors but finally came online again. Unfortunately, however, it now has the blacK Screen of Death.

I've been looking at tons of threads on Google dealing with KSOD and none of them seem to be very useful; most have to do with systems that are totally unresponsive. From what I can tell, even though I've got a black screen w/ nothing more than a cursor, the OS has booted up & all workstations can access the server fine. That is, Active Directory is ok, the file server is accessible, printer server is fine, etc. I simply can't login or do anything when sitting in front of the server itself. The screen says the usual "press CTRL-ALT-DEL to logon", but doing so simply gives a spinning hourglass symbol for a couple of seconds, and then it goes to that blank black screen w/ cursor. Pressing CTRL-ALT-DEL again gives me the original blue screen (with "Windows Server 2008 Standard" written at the bottom) & a spinning hourglass for a couple of seconds, and then black screen again (i.e., it doesn't ever give me the option to choose Task Manager, or shut down, or logon, or anything else).

I'm guessing something maybe got screwed up w/ the video card drivers, but not 100% sure. And unsure what to try, since I can't safely shut down the server as I can't get to any prompts.

It's Monday, Jan 21, 2013 now & I did attempt one hard shutdown after everyone was off work (i.e. killed the power, waited 15 sec, then rebooted from disc) to attempt some RegEdit suggestions I'd found dealing w/ KSOD (http://thebackroomtech.com/2008/12/30/fix-for-windows-vista-black-screen-of-death-aka-ksod/), but that did not resolve it; and I'm weary of performing too many hard shutdowns as rebooting this server takes forever on the machine.

Anyway, I'm open to suggestions as to what to try next... Has anyone ever had this sort of issue & successfully resolved it?

Thanks in advance.
  • +
    0 Votes
    llee

    I had Teamviewer installed on the server & originally was able to connect to the server with that--however, it was still a black screen w/ cursor and no way to login to the machine itself, and I was not able to shutdown the server from within the Teamviewer interface either.

    Also, since the hard shutdown of the server that I attempted yesterday, I can no longer connect remotely in that fashion via Teamviewer either; I'm guessing that Teamviewer is no longer being loaded properly after the latest reboot...? Unsure.

    +
    0 Votes

    RDP

    dNig

    I've seen this on one of our servers before (2003) and when I connected via remote desktop I could get in fine. Once I logged off the RDP session the log in screen would appear on the servers terminal.

    Try logging in via RDP.

    +
    0 Votes
    llee

    Thanks for the reply. Hmm.. I'd never actually properly installed anything to allow Remote Desktop Connections to work with our Windows 2008 Server, but figured it can't hurt to try.

    When I click on Connect, it does take me to the server window--& unlike being seated at the terminal itself, I can now see the icons for logging on as "Administrator" or "Other User"! However, when I click on either of them, I get the small hourglass symbol as it processes something for a couple of seconds, and then I am kicked out and the Remote Desktop session closes.

    I noticed while connecting via RDP that the screen briefly flashes a message for a split second, but it goes by too quickly to be able to read.
    I'm now thinking that this maybe isn't a video card driver issue, but some service or something else in the startup process isn't loading properly.

    Any other suggestions?

    +
    0 Votes
    llee

    Edit: I used my smart phone to video the Remote Desktop Connection so that I could go back & pause the video to see what's flashing by; the screen is saying "Please wait for the Local Session Manager..." and then it's gone. So my guess is that Windows Server 2008 is somehow skipping the process of loading the Local Session Manager, & that's preventing me from logging on at all...? & if so, any ideas on how can this be resolved?

    +
    0 Votes
    llee

    Just fyi, although I was eventually able to login via RDP from a workstation (see my comment to jnorris below), the server terminal itself remains inaccessible regardless of whether I log off from the RDP connection or otherwise.

    +
    0 Votes
    jnorris

    Try rebooting the server first by hitting the power button - this may shut it down gracefully. If not then hard reboot it. Wait until you can access the servers C: drive from a workstation. Once you can, locate the administrator's profile folder (C:\Documents and Settings\Administrator(.*) or c:\Users\Administrator(.*). Rename the folders then try to log into the server.

    +
    0 Votes
    llee

    Follow-up to yesterday's reply: I actually tried different settings with the
    Remote Desktop Connection on Wed, Jan 23, and was eventually able to successfully log on remotely by "saving" the login credentials directly within the RDP file (as opposed to the default of being prompted for them after connecting). However, once I was in, there was very little I could do:

    When I tried to go to Administrative Tools > Event Viewer, I got a pop-up error message window stating "Microsoft Management Console has stopped working".

    Same thing when I tried to go to Administrative Tools > Services, or
    Administrative Tools > Active Directory Users and Computers, or Administrative Tools > Windows Server Backup, or pretty much anything else; they all resulted in MMC.exe crashing.

    If I go to Start > Run, I get a pop-up error message stating "Windows Explorer has stopped working". Same thing when I double-click on the Control Panel icon on the desktop.

    Programs don't even seem to run; going to Start > Accessories > Notepad crashes and returns the message "Notepad has stopped working". Trying to open IE gives "Internet Explorer has stopped working". Google Chrome crashes but gives a slightly different error message first: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application
    \24.0.1312.52\icudt.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support." Afterwards, it too says "Google Chrome has stopped working."

    Only things I've managed to open are VLC media player and Disk Defragmenter. Aside from those two items, only one other item seemed to work: I accidentally ran the "Memory Diagnostics Tool", which kicked everyone off the server and shut it down. Unfortunately, it hung on shut down & I ended up having to kill the power & hard rebooting it.

    After reboot--which incidentally the memory checker detected no errors--had the same problems as before. I tried logging on w/ two different user accounts, the second one also at admin level, the third being just a regular domain user. Same results--once in, can't do anything.

    I now strongly suspect that it's not a corrupt profile, since all three profiles exhibited the same issues, but rather, some sort of permissions setting on the server itself has some how been corrupted. Unsure how to reset the permission settings back to their default, though, when I can't really get into any parts of the system to do anything... Suggestions?

    +
    0 Votes
    raj_dev12

    You may have installed windows as "Server Code Install" which only gives you command prompt. may be verify the server install mode.

    +
    0 Votes
    llee

    I originally set this server up back in 2008 as an Active Directory, File Server, & Print Server, and for the past five years or so I've always been able to login to the GUI as opposed to just a command prompt.

    That being said, the very first time I tried booting from disk after I had those update errors on Jan 20, I did accidentally use the "Windows Server 2008 OEM Pre-installation Kit for Microsoft Builders Only" DVD as opposed to the "Windows Server 2008 Standard" DVD. However, when I wasn't given the "Repair" option I was looking for, I immediately switched to the correct DVD & rebooted, so I doubt that effected anything, & I don't believe it's currently in any "Server Code Install" mode.

    +
    0 Votes
    slam5

    are you sure it isn't a hardware problem? maybe the hard drive as a bad sector? I know it probably will cause more pain for you but can you run something like spinrite and see the health of the hard drive. installing patches may use regions of the drive that hasn't been used before.

    +
    0 Votes
    llee

    Thanks for the reply.

    The company's server is installed on two 1-TB harddrives that are in a RAID-1 array; I imagine if one of the hard drives had a bad sector that was causing problems, I'd be getting errors about the RAID needing to be re-built as opposed to a KSOD issue, no?

    +
    0 Votes
    markavo

    I've seen a version of this and the Session Manager was acting up as well. The way I got into the system was by pressing the shift key rapidly (more than 5 times) so that the "Sticky Keys" prompt appears. From there you can click on the "ease of access" center link. Explorer.exe didn't load properly after the Session Manager crapped out so I would, after having the ease of access center link loaded, go to the address bar of the Windows Explorer window and type c:\Windows\explorer.exe to launch Explorer. That would get me in but never resolved the KSOD. This has happened to me twice. Once I was able to disable all IPV6 and "large send offload ipv6" on the NIC. The second time I had to track down some windows updates that made changes to IPV6 but were done out of order. I had installed some HotFixes AFTER a service pack and the service pack reset the IPV6 Binary release to an earlier version. I had to uninstall the hot fixes and then download the newer released hotfix that had the proper Binary installed.

    I've also had this issue on a few Windows 7 machines but that was caused by folder redirection in Active Directory being done with a logon script instead of through group policy.

    None of these may be the issue you ran into but hopefully you get something from these ideas.

    +
    0 Votes
    llee

    Thanks for the reply.

    I actually attempted the "Sticky Keys" method you described to try & get into my company's Windows 2008 Server before posting here in the Tech Republic forums, but was unsuccessful; could not get into the "Ease of Access" link or explorer at all...

    +
    0 Votes
    rbardua

    I had the same problem a while ago. Unable to log in at the console or remotely. Black screen with cursor only. It turned out to be a failed hard drive in the array. So, on the same server, I had the same thing happen today. Looked at the hard drives and sure enough there is a failed hard drive in the array again. I have replaced the drive and its currently rebuilding. Ill keep you posted on how it goes. Server is an HP ML370 with Win 2k8 (not R2).

    +
    0 Votes

    RDP

    dNig

    I've seen this on one of our servers before (2003) and when I connected via remote desktop I could get in fine. Once I logged off the RDP session the log in screen would appear on the servers terminal.

    Try logging in via RDP.

    +
    0 Votes
    jnorris

    Try rebooting the server first by hitting the power button - this may shut it down gracefully. If not then hard reboot it. Wait until you can access the servers C: drive from a workstation. Once you can, locate the administrator's profile folder (C:\Documents and Settings\Administrator(.*) or c:\Users\Administrator(.*). Rename the folders then try to log into the server.

    +
    0 Votes
    raj_dev12

    You may have installed windows as "Server Code Install" which only gives you command prompt. may be verify the server install mode.

    +
    0 Votes
    slam5

    are you sure it isn't a hardware problem? maybe the hard drive as a bad sector? I know it probably will cause more pain for you but can you run something like spinrite and see the health of the hard drive. installing patches may use regions of the drive that hasn't been used before.

    +
    0 Votes
    markavo

    I've seen a version of this and the Session Manager was acting up as well. The way I got into the system was by pressing the shift key rapidly (more than 5 times) so that the "Sticky Keys" prompt appears. From there you can click on the "ease of access" center link. Explorer.exe didn't load properly after the Session Manager crapped out so I would, after having the ease of access center link loaded, go to the address bar of the Windows Explorer window and type c:\Windows\explorer.exe to launch Explorer. That would get me in but never resolved the KSOD. This has happened to me twice. Once I was able to disable all IPV6 and "large send offload ipv6" on the NIC. The second time I had to track down some windows updates that made changes to IPV6 but were done out of order. I had installed some HotFixes AFTER a service pack and the service pack reset the IPV6 Binary release to an earlier version. I had to uninstall the hot fixes and then download the newer released hotfix that had the proper Binary installed.

    I've also had this issue on a few Windows 7 machines but that was caused by folder redirection in Active Directory being done with a logon script instead of through group policy.

    None of these may be the issue you ran into but hopefully you get something from these ideas.

    +
    0 Votes
    rbardua

    I had the same problem a while ago. Unable to log in at the console or remotely. Black screen with cursor only. It turned out to be a failed hard drive in the array. So, on the same server, I had the same thing happen today. Looked at the hard drives and sure enough there is a failed hard drive in the array again. I have replaced the drive and its currently rebuilding. Ill keep you posted on how it goes. Server is an HP ML370 with Win 2k8 (not R2).

  • +
    0 Votes
    llee

    I had Teamviewer installed on the server & originally was able to connect to the server with that--however, it was still a black screen w/ cursor and no way to login to the machine itself, and I was not able to shutdown the server from within the Teamviewer interface either.

    Also, since the hard shutdown of the server that I attempted yesterday, I can no longer connect remotely in that fashion via Teamviewer either; I'm guessing that Teamviewer is no longer being loaded properly after the latest reboot...? Unsure.

    +
    0 Votes

    RDP

    dNig

    I've seen this on one of our servers before (2003) and when I connected via remote desktop I could get in fine. Once I logged off the RDP session the log in screen would appear on the servers terminal.

    Try logging in via RDP.

    +
    0 Votes
    llee

    Thanks for the reply. Hmm.. I'd never actually properly installed anything to allow Remote Desktop Connections to work with our Windows 2008 Server, but figured it can't hurt to try.

    When I click on Connect, it does take me to the server window--& unlike being seated at the terminal itself, I can now see the icons for logging on as "Administrator" or "Other User"! However, when I click on either of them, I get the small hourglass symbol as it processes something for a couple of seconds, and then I am kicked out and the Remote Desktop session closes.

    I noticed while connecting via RDP that the screen briefly flashes a message for a split second, but it goes by too quickly to be able to read.
    I'm now thinking that this maybe isn't a video card driver issue, but some service or something else in the startup process isn't loading properly.

    Any other suggestions?

    +
    0 Votes
    llee

    Edit: I used my smart phone to video the Remote Desktop Connection so that I could go back & pause the video to see what's flashing by; the screen is saying "Please wait for the Local Session Manager..." and then it's gone. So my guess is that Windows Server 2008 is somehow skipping the process of loading the Local Session Manager, & that's preventing me from logging on at all...? & if so, any ideas on how can this be resolved?

    +
    0 Votes
    llee

    Just fyi, although I was eventually able to login via RDP from a workstation (see my comment to jnorris below), the server terminal itself remains inaccessible regardless of whether I log off from the RDP connection or otherwise.

    +
    0 Votes
    jnorris

    Try rebooting the server first by hitting the power button - this may shut it down gracefully. If not then hard reboot it. Wait until you can access the servers C: drive from a workstation. Once you can, locate the administrator's profile folder (C:\Documents and Settings\Administrator(.*) or c:\Users\Administrator(.*). Rename the folders then try to log into the server.

    +
    0 Votes
    llee

    Follow-up to yesterday's reply: I actually tried different settings with the
    Remote Desktop Connection on Wed, Jan 23, and was eventually able to successfully log on remotely by "saving" the login credentials directly within the RDP file (as opposed to the default of being prompted for them after connecting). However, once I was in, there was very little I could do:

    When I tried to go to Administrative Tools > Event Viewer, I got a pop-up error message window stating "Microsoft Management Console has stopped working".

    Same thing when I tried to go to Administrative Tools > Services, or
    Administrative Tools > Active Directory Users and Computers, or Administrative Tools > Windows Server Backup, or pretty much anything else; they all resulted in MMC.exe crashing.

    If I go to Start > Run, I get a pop-up error message stating "Windows Explorer has stopped working". Same thing when I double-click on the Control Panel icon on the desktop.

    Programs don't even seem to run; going to Start > Accessories > Notepad crashes and returns the message "Notepad has stopped working". Trying to open IE gives "Internet Explorer has stopped working". Google Chrome crashes but gives a slightly different error message first: "C:\Users\Administrator\AppData\Local\Google\Chrome\Application
    \24.0.1312.52\icudt.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support." Afterwards, it too says "Google Chrome has stopped working."

    Only things I've managed to open are VLC media player and Disk Defragmenter. Aside from those two items, only one other item seemed to work: I accidentally ran the "Memory Diagnostics Tool", which kicked everyone off the server and shut it down. Unfortunately, it hung on shut down & I ended up having to kill the power & hard rebooting it.

    After reboot--which incidentally the memory checker detected no errors--had the same problems as before. I tried logging on w/ two different user accounts, the second one also at admin level, the third being just a regular domain user. Same results--once in, can't do anything.

    I now strongly suspect that it's not a corrupt profile, since all three profiles exhibited the same issues, but rather, some sort of permissions setting on the server itself has some how been corrupted. Unsure how to reset the permission settings back to their default, though, when I can't really get into any parts of the system to do anything... Suggestions?

    +
    0 Votes
    raj_dev12

    You may have installed windows as "Server Code Install" which only gives you command prompt. may be verify the server install mode.

    +
    0 Votes
    llee

    I originally set this server up back in 2008 as an Active Directory, File Server, & Print Server, and for the past five years or so I've always been able to login to the GUI as opposed to just a command prompt.

    That being said, the very first time I tried booting from disk after I had those update errors on Jan 20, I did accidentally use the "Windows Server 2008 OEM Pre-installation Kit for Microsoft Builders Only" DVD as opposed to the "Windows Server 2008 Standard" DVD. However, when I wasn't given the "Repair" option I was looking for, I immediately switched to the correct DVD & rebooted, so I doubt that effected anything, & I don't believe it's currently in any "Server Code Install" mode.

    +
    0 Votes
    slam5

    are you sure it isn't a hardware problem? maybe the hard drive as a bad sector? I know it probably will cause more pain for you but can you run something like spinrite and see the health of the hard drive. installing patches may use regions of the drive that hasn't been used before.

    +
    0 Votes
    llee

    Thanks for the reply.

    The company's server is installed on two 1-TB harddrives that are in a RAID-1 array; I imagine if one of the hard drives had a bad sector that was causing problems, I'd be getting errors about the RAID needing to be re-built as opposed to a KSOD issue, no?

    +
    0 Votes
    markavo

    I've seen a version of this and the Session Manager was acting up as well. The way I got into the system was by pressing the shift key rapidly (more than 5 times) so that the "Sticky Keys" prompt appears. From there you can click on the "ease of access" center link. Explorer.exe didn't load properly after the Session Manager crapped out so I would, after having the ease of access center link loaded, go to the address bar of the Windows Explorer window and type c:\Windows\explorer.exe to launch Explorer. That would get me in but never resolved the KSOD. This has happened to me twice. Once I was able to disable all IPV6 and "large send offload ipv6" on the NIC. The second time I had to track down some windows updates that made changes to IPV6 but were done out of order. I had installed some HotFixes AFTER a service pack and the service pack reset the IPV6 Binary release to an earlier version. I had to uninstall the hot fixes and then download the newer released hotfix that had the proper Binary installed.

    I've also had this issue on a few Windows 7 machines but that was caused by folder redirection in Active Directory being done with a logon script instead of through group policy.

    None of these may be the issue you ran into but hopefully you get something from these ideas.

    +
    0 Votes
    llee

    Thanks for the reply.

    I actually attempted the "Sticky Keys" method you described to try & get into my company's Windows 2008 Server before posting here in the Tech Republic forums, but was unsuccessful; could not get into the "Ease of Access" link or explorer at all...

    +
    0 Votes
    rbardua

    I had the same problem a while ago. Unable to log in at the console or remotely. Black screen with cursor only. It turned out to be a failed hard drive in the array. So, on the same server, I had the same thing happen today. Looked at the hard drives and sure enough there is a failed hard drive in the array again. I have replaced the drive and its currently rebuilding. Ill keep you posted on how it goes. Server is an HP ML370 with Win 2k8 (not R2).

    +
    0 Votes

    RDP

    dNig

    I've seen this on one of our servers before (2003) and when I connected via remote desktop I could get in fine. Once I logged off the RDP session the log in screen would appear on the servers terminal.

    Try logging in via RDP.

    +
    0 Votes
    jnorris

    Try rebooting the server first by hitting the power button - this may shut it down gracefully. If not then hard reboot it. Wait until you can access the servers C: drive from a workstation. Once you can, locate the administrator's profile folder (C:\Documents and Settings\Administrator(.*) or c:\Users\Administrator(.*). Rename the folders then try to log into the server.

    +
    0 Votes
    raj_dev12

    You may have installed windows as "Server Code Install" which only gives you command prompt. may be verify the server install mode.

    +
    0 Votes
    slam5

    are you sure it isn't a hardware problem? maybe the hard drive as a bad sector? I know it probably will cause more pain for you but can you run something like spinrite and see the health of the hard drive. installing patches may use regions of the drive that hasn't been used before.

    +
    0 Votes
    markavo

    I've seen a version of this and the Session Manager was acting up as well. The way I got into the system was by pressing the shift key rapidly (more than 5 times) so that the "Sticky Keys" prompt appears. From there you can click on the "ease of access" center link. Explorer.exe didn't load properly after the Session Manager crapped out so I would, after having the ease of access center link loaded, go to the address bar of the Windows Explorer window and type c:\Windows\explorer.exe to launch Explorer. That would get me in but never resolved the KSOD. This has happened to me twice. Once I was able to disable all IPV6 and "large send offload ipv6" on the NIC. The second time I had to track down some windows updates that made changes to IPV6 but were done out of order. I had installed some HotFixes AFTER a service pack and the service pack reset the IPV6 Binary release to an earlier version. I had to uninstall the hot fixes and then download the newer released hotfix that had the proper Binary installed.

    I've also had this issue on a few Windows 7 machines but that was caused by folder redirection in Active Directory being done with a logon script instead of through group policy.

    None of these may be the issue you ran into but hopefully you get something from these ideas.

    +
    0 Votes
    rbardua

    I had the same problem a while ago. Unable to log in at the console or remotely. Black screen with cursor only. It turned out to be a failed hard drive in the array. So, on the same server, I had the same thing happen today. Looked at the hard drives and sure enough there is a failed hard drive in the array again. I have replaced the drive and its currently rebuilding. Ill keep you posted on how it goes. Server is an HP ML370 with Win 2k8 (not R2).