In “Understanding the Windows 2000 Blue Screen of Death, part 1,” I explained that the Blue Screen of Death (BSOD) is alive and well within Windows 2000. Because of this, I explained the anatomy of a Blue Screen and discussed several basic troubleshooting methods that you can use when the Blue Screen rears its ugly head. In this Daily Drill Down, I’ll go a step further and explore specific error messages that may manifest themselves on the BSOD.
Before I get started, it’s important to point out that there is a countless number of potential Blue Screen errors. There’s a unique error code for just about everything that can go wrong with Windows 2000. Therefore, it’s impossible for me to discuss all of these codes—or even most of them. In this Daily Drill Down, I’ll focus on the most common errors. If you need explanation of an error that I don’t cover, refer to the Microsoft Knowledge Base. Search on the exact error code; for example, you might search on 0x0000000A.
IRQL_NOT_LESS_OR_EQUAL
In Windows 2000, a kernel mode process can only access an interrupt request level less than or equal to its own. This error indicates that a process tried to access too high of an interrupt request level.

A problem like this is almost always caused by an incompatible device driver, system service, virus scanner, or backup tool. If you receive this error during the process of upgrading to Windows 2000, it could be that Windows NT is using a device driver that’s incompatible with Windows 2000.

Whenever you receive an IRQL error, the best thing that you can do is to boot Windows 2000 into safe mode by pressing [F8] during the early stages of the boot process and selecting Safe Mode from the boot menu. When Windows 2000 loads, disable your antivirus software and any drivers that aren’t absolutely necessary, and then restart the system. When the system restarts, begin reenabling things one at a time until you determine what’s causing the problem.

KMODE_EXCEPTION_NOT_HANDLED
This error message indicates that a kernel mode process tried to execute an illegal or an invalid instruction. Normally, when this error occurs, Windows 2000 will list a memory address along with the name of the program or device driver that’s responsible for the error. You can then restart Windows and begin examining that file for the problem.

NTFS_FILE_SYSTEM
The NTFS_FILE_SYSTEM error indicates that the NTFS.sys file is having difficulty working with your file system. Bad blocks on the hard disk or corrupted SCSI or EIDE drivers may cause this error.

When this error occurs, disable any antivirus software, backup programs, disk defragmenters, and so forth. Next, check the event logs for errors pertaining to SCSI, FASTFAT, or AUTOCHK. These errors may help you find the source of the problem. Finally, run the CHKDSK /F /R command to attempt to repair any hard disk problems.

It’s also possible to receive this error if you’re using Services For Macintosh on a 7-GB or larger partition with over 100,000 files. The indexing routine can consume large amounts of non-paged pool memory. If this memory is completely depleted, the NTFS_FILE_SYSTEM error can occur. Microsoft knows about this problem and intends to address it in a future Service Pack.

DATA_BUS_ERROR
This message almost always indicates a memory parity error. Bad memory, incompatible hardware, or a hardware configuration issue can cause it. This issue may be related to your system’s RAM, level 2 RAM (L2) cache, or video RAM.

If this error occurs after installing new hardware, try removing the new hardware to see if the error goes away. It’s possible that you added a bad or incompatible component. If you haven’t added anything new, try removing your existing hardware and reseating all cards and memory modules. It’s possible that something could have vibrated loose. If that doesn’t solve your problem, try experimenting with various combinations of the memory modules in your system to see if one of them might have gone bad. If this error occurs on a new system, try contacting the manufacturer to see if a BIOS upgrade is available.

It’s possible (although unlikely) to get this error after installing a new device driver. If this happens, boot the system into safe mode by using the method that I described earlier. Once the system is up and running, try removing the driver and rebooting the system to see if the error goes away. If a bad driver is the problem, check the Web for an updated driver that’s specifically designed for Windows 2000.

Finally, it’s possible to get this error from hard disk corruption or a cracked motherboard. Try running CHKDSK /F to test for and repair any hard disk errors. If you still can’t fix the problem, try taking the motherboard to a repair center for testing.

PAGE_FAULT_IN_NONPAGED_AREA
This type of Stop message occurs when Windows 2000 tries to read data from memory, but the requested data doesn’t exist in memory. The most common causes of such an error are corrupt NTFS volumes, incompatible antivirus software, buggy services, and malfunctioning hardware.

When diagnosing this type of error, the first thing to consider is whether you’ve recently added any new hardware—especially RAM—to the system. If you have added hardware, try removing it to see if the error goes away. If you haven’t recently added hardware, try running a diagnostic program to test your existing hardware.

If all of the hardware checks out, the problem may be related to a buggy system service or another type of configuration error. If you suspect this to be the case, boot Windows 2000 into safe mode. Once in safe mode, disable any service that you suspect may be causing the problem. If this still doesn’t fix the error, select the Last Known Good Configuration option during boot up.

Finally, check your hard disk for corruption by running the CHKDSK /F /R command. If this still doesn’t cure the problem, try booting to safe mode and reviewing your event logs for information that may be related to the problem.

KERNEL_STACK_INPAGE_ERROR
The KERNEL_STACK_INPAGE_ERROR message indicates that Windows 2000 requested a page of kernel data to be read from the page file, but the requested data couldn’t be found.

Like most other errors that I’ve discussed, malfunctioning RAM and hard disk corruption can cause this error. You should check your error logs, run CHKDSK /F /R, and make sure that all of your cards are seated properly.

Fortunately, this error is slightly easier to troubleshoot than other Stop errors because this Stop message often gives you a second error code. Below, I’ve listed some of the other codes that you might see and what they mean:

  • STATUS_INSUFFICIENT_RESOURCES: This message is caused by a lack of non-paged pool resources.
  • STATUS_DEVICE_DATA_ERROR: This message is usually caused by bad blocks on the hard disk. Running CHKDSK /F /R may correct the problem.
  • STATUS_DEVICE_NOT_CONNECTED: This message indicates that your computer’s disk controller can’t communicate with the hard disk. The cause of this problem may be as simple as a loose cable or a bad SCSI terminator.
  • STATUS_DISK_OPERATION_FAILED: This message is usually caused by bad blocks on the hard disk. Running CHKDSK /F /R may correct the problem.
  • STATUS_IO_DEVICE_ERROR: This error occurs primarily with SCSI drives. It may be caused by a defective terminator or cable. It may also occur if two drives are trying to use the same resources.

MISMATCHED_HAL
This message is displayed when the HAL (Hardware Abstraction Layer) and the kernel don’t match. This error is primarily caused by having a single-processor HAL and a multiprocessor kernel or vice versa. It’s caused by manually updating the Ntoskrnl.exe or the Hal.dll files.

The error can also occur if there’s a mismatch. For example, you’ll see this error if you try to use a Windows NT 4 HAL with a Windows 2000 kernel.

The easiest way to resolve the error is to boot from the four Windows 2000 Setup disks. When the setup disks load, press [Enter] at the Setup notification window. When you do, you’ll see the Welcome To Setup dialog box. Press R to enter Repair Mode. Next, press C to use the Recovery Console. The Recovery Console functions similarly to MS-DOS. Once inside the Recovery Console, use the copy command to copy the correct HAL and kernel to the hard disk from the original installation media.

KERNEL_DATA_INPAGE_ERROR
This error indicates that a page of kernel data couldn’t be read from the page file. This error is usually associated with bad blocks on the hard disk or with viral infections, but it can also be caused by hardware failures.

When encountering this type of error, the first thing that you should do is to run the CHKDSK /F /R command on your system. Next, scan for viruses. If you still have the error, start testing the integrity of your hardware. If all else fails, try to delete and recreate your page file in case it has become corrupt.

INACCESSIBLE_BOOT_DEVICE
This error means that Windows 2000 can’t access the system partition. This error always occurs during boot up. Unfortunately, this means you can’t use the kernel debugger to diagnose this error, because the operating system has not yet loaded.

The most common cause of this error is installing Windows 2000 on an unsupported storage medium. If you’re upgrading from Windows NT 4, think back to when you initially installed Windows NT. Did you have to provide a custom disk controller driver? If so, you’ll probably also have to do so for Windows 2000. You may have to get an updated version from the hardware manufacturer.

Another common cause of this error is adding a new hard disk. In many cases, you’ll have to manually edit the Boot.ini file and point it toward the correct partition. If you have trouble doing so, remember that Boot.ini is a hidden, read-only system file that’s located in the root directory of your C drive.

UNEXPECTED_KERNEL_MODE_TRAP
This error means that one of two things has happened: Either a piece of software has generated a fatal error, or a piece of hardware has caused a fatal error. This error is almost always hardware-related.

When troubleshooting, all of the standard procedures apply. Remove any recently added hardware. Run diagnostic software to test for bad hardware and to test for hard disk corruption. Although faulty RAM is the most common cause of this error, overclocking your processor can also be a culprit.

STATUS_SYSTEM_PROCESS_TERMINATED
All of the Stop messages that I’ve discussed so far have involved some sort of kernel mode failure. There are two cases in which an action performed in user mode can cause a Stop message. The STATUS_SYSTEM_PROCESS_TERMINATED message is the result of such an action.

This error occurs when Windows logon, the Client/Server Runtime Subsystem, or some other user-mode subsystem is shut down. When this occurs, security can no longer be guaranteed, so Windows generates a Stop message. Because such a problem occurs in user mode, the most common cause is third-party applications. The best way to resolve such an error is to determine what you were doing when the error occurred. Once you’ve identified a problem application, you can contact its manufacturer for a patch.

STATUS_IMAGE_CHECKSUM_MISMATCH
This message usually means that a driver or a .dll file has become corrupt. This is an easy error to correct since the name of the affected file is usually displayed within the Stop message. To correct the error, boot Windows 2000 into safe mode and replace the file. You can also run CHKDSK /F /R if you suspect further hard disk corruption.

Conclusion
In this Daily Drill Down, I’ve discussed some of the more common error codes found on the Windows 2000 Blue Screen of Death and how to resolve the various problems that trigger the Blue Screen errors.

Brien M. Posey is an MCSE who works as a freelance technical writer and as a network engineer for the Department of Defense. If you’d like to contact Brien, send him an e-mail. (Because of the large volume of e-mail he receives, it’s impossible for him to respond to every message. However, he does read them all.)

The authors and editors have taken care in preparation of the content contained herein, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.