Hello
We have two w2k3 Terminal Servers both with SP1, all the security hotfixes
(via autoupdate) and Citrix Metaframe XP.  They have run fine since their
installation in Dec. and Jan. respectively but today both systems blue
screened and rebooted within minutes of each other, both with the same error
code. 
Source: System Error  Category : (102)  Event ID: 1003
Description:
Error code 000000ab, parameter1 00000003, parameter2 00000088, parameter3
00000000, parameter4 00000001.

I have searched our Technet CDs, the Technet website and the Citrix support
site but to no avail.

Has anybody seen this BSOD before and if so, what was the resolution?
Thanks

Show quote Hide quote Not on W2K3.

See http://support.microsoft.com?kbid=317855 -  A Terminal Services Server Generates a "Stop 0xAB" Message on a Blue Screen

Walt & Jerold

This is an identified bug and the KB article in question wont help as it is
relevant to Windows 2000 Server only. 
There is no resolution for this and its being worked upon.

Satya wrote:
Any News from Microsoft? We have the same problem on 4 win2003 sp1 terminal servers. -- breis ------------------------------------------------------------------------ Posted via http://www.mcse.ms ------------------------------------------------------------------------ View this thread: http://www.mcse.ms/message1608440.html

Hi. I too have the (nearly) same problem. An interesting side note to
my problem: when I reboot the bios RAID swaps the bootable tag on the
arrays, so array 0 is no longer bootable and array 1 is. So yes, it is
possible that the cause is differnt. Still, I was hoping someone had
shed some light on this issue. Anyone?

Hi Guys,

I've got the same issue from the time I install the SP1. I had a call with microsoft and to let you know they are working on we just need to wait.:( -- moustik ------------------------------------------------------------------------ Posted via http://www.mcse.ms ------------------------------------------------------------------------ View this thread: http://www.mcse.ms/message1608440.html

Yes..Microsoft is working on it and there is no update on it yet...wait wait
wait..unfortunately.

Show quoteHide quote

moustik wrote:
Hundreds , possibly thousands of us have this issue.
I am on day 3 with Microsoft Support. Basically they
kill time by having you upload your memory.dmp file to them
and say 24-48 hours to get back to you.

Some tidbits:
Windows 2000 SP1, SP2 Terminal Server KB: 317855
Resolution: Update to SP3

Windows 2003 SP1 Terminal Server KB: 901150
Resolution: Uninstall SP1

So what they "fixed" in SP3 for Windows 2000 held until
SP1 for 2003 came out and they re-caused this issue in SP1, but one problem, they do not know where or what.

If you are lucky, unlike me, your SP1 was installed seperately and did not come pre-loaded by "Dell".
You can uninstall SP1 and resolve your problem.

The hotfix they send you for article 901150 will not fix your problem for 2003 SP1.

There was one instance where someone fixed it by removing Asian Language support, lucky him, was never installed on mine and probably not yours.

There is also a MSDN Bug Check article on this issue.
http://tinyurl.com/5lr9s

Which states...

Bug Check 0xAB: SESSION_HAS_VALID_POOL_ON_EXIT
The SESSION_HAS_VALID_POOL_ON_EXIT bug check has a value of 0x000000AB. This indicates that a session unload occurred while a session driver still held memory.

Cause
This error is caused by a session driver not freeing its pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver.

So it's nothing new, we as a group just have to figure this one out ourselves, I plan on building a couple of test servers and will update this page with either my results or Microsoft's final resolution. I think the guy who figured this one out at Microsoft for Windows 2000 SP2 now works for google or something and is why the problem isn't resolved in Windows 2003 SP1 yet.

So I know MS asks you for the article ID when you call in for a hotfix and alot of people ask what it is.
It is 901150

If anyone resolves their issue, please post back here. Oh and my server was 4 hours old out of the box pre-loaded with SP1 by Dell.

901150 mentions fonts three seperate times, the bugcheck on msdn mentions the atmfd.dll file, which is font related.
Take a peek at this URL
http://cgm.cs.mcgill.ca/~luc/opentypecrash.html

Mentions something about Type 1 fonts crashing atmfd.dll etc
I am not a programmer or a font person, but one of you must be and maybe something will click.

-John
CCN
netw***@engineer.com -- CCN ------------------------------------------------------------------------ Posted via http://www.mcse.ms ------------------------------------------------------------------------ View this thread: http://www.mcse.ms/message1608440.html

Note that SESSION_HAS_VALID_POOL_ON_EXIT is just a memory leak problem.
There are probably many different ways to trigger such a memory leak,
so the same solution doesn't apply to everyone.

I'm one of the people who was seeing such a crash and I diagnosed my
particular crash as related to Asian Language support (font linking).
I sent MS details of that bug but I don't know if it will be addressed
in a hotfix.

Your crash may well be a different one.

It would be useful if people who are seeing SESSION_HAS_VALID_POOL_ON_EXIT
post the numbers reported along with it.  It would be even more useful if
people could post which memory 'tags' are leaking for them, like this:

(1) Install Debugging Tools for Windows from
    http://www.microsoft.com/whdc/devtools/debugging/default.mspx
(2) File -> Open Crash Dump -> C:\WINDOWS\MEMORY.DMP
(3) Type the following in the command window:
     !analyze -v
     !poolused 8
    and report the results.

Matt


On 2005-09-15, CCN <CCN.1vd***@mail.mcse.ms> wrote:
Show quoteHide quote

Hi Matt

I've done your thing, I hope it's not to much information:
*                                                                           
*
*                        Bugcheck Analysis                                  
*
*                                                                           
* *******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000a, session ID
Arg2: 00001100, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000032, total number of paged and nonpaged allocations that are
leaking.
    nonpaged allocations are in the upper half of this word,
    paged allocations are in the lower half of this word.

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

MODULE_NAME:  nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xAB

LAST_CONTROL_TRANSFER:  from 8095df98 to 8087b6be

STACK_TEXT: 
WARNING: Stack unwind information not available. Following frames may be
wrong.
f3c5ec30 8095df98 000000ab 0000000a 00001100 nt!KeBugCheckEx+0x1b
f3c5ec68 809c4c28 891ee4a0 891ee4a0 00000000
nt!RtlAreAllAccessesGranted+0x1c559
f3c5ece8 8082117f 891ee4a0 00000000 896ef548
nt!IoUnregisterShutdownNotification+0x394
f3c5ed04 80912d6f 891ee4a0 896ef548 896ef788 nt!wcscpy+0xf40
f3c5ed8c 8092d96b 00000000 00000000 896ef548 nt!RtlRandom+0x1558
f3c5eda4 8092cd0d 896ef548 00000000 00000001 nt!NtReadFile+0x587
f3c5eddc 80841a96 bf92b850 895fda98 00000000 nt!ObAssignSecurity+0x236
00000000 00000000 00000000 00000000 00000000
nt!PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion+0xd5


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_NAME:  MachineOwner

BUCKET_ID:  WRONG_SYMBOLS


With this command I got:

Your debugger is not using the correct symbols

So, how do I get these symbols?

Greetings and Thanks,

Marco Reedijk

On 2005-09-19, Marco Reedijk <MarcoReed***@discussions.microsoft.com> wrote:
Try the following:

  .symfix
  .reload

This should make it fetch symbols from the MS symbol server.

Matt

Hi Matt,

Matthew Chapman wrote:
Done! It worked. It looks like a driver who is not working properly, but
i cannot read properly my output because of no knowledge about these things.

So, how van i recognize which driver is failing or what to do to fix the
problem? Thanks in advance.

This is my output:

    Sorting by Session Tag

   Pool Used:
             NonPaged            Paged
  Tag    Allocs     Used    Allocs     Used
  Gffv        0        0        10      720    Gdi FONTFILEVIEW
  Ggls        0        0        10      240    Gdi glyphset
  Gh:<        0        0        10      320    UNKNOWN pooltag 'Gh:<',
please update pooltag.txt
  Gpfe        0        0        10     1184    UNKNOWN pooltag 'Gpfe',
please update pooltag.txt
  Gpff        0        0        10     1888    Gdi physical font file
  TOTAL           0        0        50     4352
3: kd> !analyze -v
*******************************************************************************
*
       *
*                        Bugcheck Analysis
       *
*
       *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000a, session ID
Arg2: 00001100, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000032, total number of paged and nonpaged allocations that are
leaking.
    nonpaged allocations are in the upper half of this word,
    paged allocations are in the lower half of this word.

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xAB

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8095df98 to 8087b6be

STACK_TEXT:
f3c5ec30 8095df98 000000ab 0000000a 00001100 nt!KeBugCheckEx+0x1b
f3c5ec68 809c4c28 891ee4a0 891ee4a0 00000000
nt!MiCheckSessionPoolAllocations+0xe3
f3c5ece8 8082117f 891ee4a0 00000000 896ef548
nt!MiDereferenceSessionFinal+0x183
f3c5ed04 80912d6f 891ee4a0 896ef548 896ef788
nt!MmCleanProcessAddressSpace+0x6b
f3c5ed8c 8092d96b 00000000 00000000 896ef548 nt!PspExitThread+0x5f1
f3c5eda4 8092cd0d 896ef548 00000000 00000001
nt!PspTerminateThreadByPointer+0x4b
f3c5eddc 80841a96 bf92b850 895fda98 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+e3
8095df98 cc               int     3

SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!MiCheckSessionPoolAllocations+e3

MODULE_NAME:  nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e60

STACK_COMMAND:  kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

BUCKET_ID:  0xAB_nt!MiCheckSessionPoolAllocations+e3

Followup: MachineOwner

Greetings, Marco Reedijk

Marco,

This looks like the same issue reported by mpagan in this thread
(leaking tags Gffv, Ggls, Gh=<, Gpfe, and Gpff):

http://www.brianmadden.com/forum/tm.asp?m=15187&mpage=2&key=

He reports that he was sent a private fix for that issue; you
could try asking him or MS support for it.

(N.B. there is some speculation in his previous post that it is
related to the ATI driver, ATI2MPAD.SYS, however I think that's
unlikely - the leak is within a TS session, and TS sessions use
RDPDD and not a real display driver.)

Matt


On 2005-09-21, Marco Reedijk <mreed***@wxs.nl> wrote:
Show quoteHide quote

Matt,

Indeed, this ati driver (wich i got on our DELL PE2600) is not the
problem I also think.

I've called DELL to ask if there ara issues know already: there are not.
They passed me to the software support team in Ireland.

If there are things, I will post them here.

Thank you for replying,

Marco

I'm also seeing the same problems. Is anyone any further with a resolution?
I'd rather not remove SP1 from the servers if MS has made a fix. Thanks



Michael A. Donato MCNE, MCSE, CCEA
Site Technologies, LLC

proper method for roaming profiles
Remote 'net stop" possible?
Local Service Account Password
Re: "Cannot find the WINS server. The error was: Access is denied"
Help Files problem
Oracle 8i Client
Securing documents on file server.
general rule of thumb for memory pages/sec counter?
Migrate raid 1 internal controller to raid 5 additional controller
windows & third party authentication