we are experiencing random BSODs inside a customers VMware-hosted RemoteDesktop-server. The BSODs happen nearly weekly. Curious thing is, the virtual machine does not write any dumps we could analyze, no minidumps in %systemroot%\minidump and no full dumps whatsoever. The only hint the server gives us is an entry inside its event log, saying it had to reboot because of an critical error. The details to this log entry show an BugCheckCode 252 / 0xFC, which is ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY.
MSDN issues to analyze the dumps and look for the faulting driver stored in KiBugCheckDriver. Since there are no dumps written, we obviously dont have this option available.
The faulting server is a Windows 2008 R2 hosted on VMware ESXi 5.5.0. Installed and configured roles are RemoteDesktopServer, FileServer, Print- and Webserver. Other virtual machines running on the same host dont seem affected by this problem.
Here is the Output we get on the events details:
BugcheckCode 252 BugcheckParameter1 0xfffff88001e64fb8 BugcheckParameter2 0x800000000293e963 BugcheckParameter3 0xfffff88015c55eb0 BugcheckParameter4 0x2 SleepInProgress false PowerButtonTimestamp 0
What we have tried so far:
- Disabled automatic reboot in system settings. We can do this only after our customers finishing time because it is one of the most productive servers they are working with. We disabled automatic reboot for all following testing scenarios:
- We crashed the virtual machine on purpose, using NotMyFault from Sysinternals: BSODs happened and seemed pretty "normal" to us. BSOD said it was finished dumping information to disk, but as in the random BSODs our customer experiences, there were absolutely no dumps written
- We tried to set the size of pagefile.sys manually to different sizes (up to 2 times RAM), same results
Some of the EventLog entries dont seem to have valuable information at all:
BugCheckCode 0 BugcheckParameter1 0x0 BugcheckParameter2 0x0 BugcheckParameter3 0x0 BugcheckParameter4 0x0 SleepInProgress false PowerButtonTimestamp 0
Long story short, the main question would be why there are absolutely no dumps written to the disk. Analyzing the BSOD / dump itself should be the most target-aimed approach to this error.
If I can supply more information or forgot something, just ask :)