STOP Erros Overview

Stop Errors Overview

Stop errors only occur when a problem cannot be handled by using the higher-level error-handling mechanisms in the Microsoft Windows Server 2003 operating system. Normally, when an error occurs in an application, the application interprets the error message and provides detailed information to the system administrator. However, Stop errors are handled by the kernel, and Windows Server 2003 is only able to display basic information about the error, write the contents of memory to the disk (if memory dumps are enabled), and halt the system.

As a result of the minimal information provided in a Stop message, and the fact that the operating system stops all processing, Stop errors can be difficult to troubleshoot. Fortunately, they tend to occur very rarely. When they do occur, they are almost always caused by driver problems, hardware problems, or file inconsistencies.

Identifying the Stop Error

There are many different types of Stop errors. Each has its own possible causes and requires a unique troubleshooting process. Therefore, the first step in troubleshooting a Stop error is to identify the Stop error. You need the following information about the Stop error to begin troubleshooting:
• Stop error number. This number uniquely identifies the Stop error.
• Stop error parameters. These parameters provide additional information about the Stop error. Their meaning is specific to the Stop error number.
• Driver information. When available, the driver information identifies the most likely source of the problem.

This information is often displayed as part of the Stop message. If possible, write it down to use as a reference during the troubleshooting process. If the operating system restarts before you can write down the information, you can often retrieve the information from the System log in Event Viewer. For more information, see “Stop Errors Recorded in the System Log” later in this chapter.
If you are unable to gather the Stop error number from the Stop message and the System log, you can retrieve it from a memory dump file. By default, Windows Server 2003 is configured to create a memory dump whenever a Stop error occurs. If no memory dump file was created, configure the system to create a memory dump file. Then, if the Stop error reoccurs, you will be able to extract the necessary information from the memory dump file. For information about using dump files, see “Memory Dump Files” in this forum.

Finding Troubleshooting Information

Each Stop error requires a different troubleshooting technique. Therefore, after you identify the Stop error and gather the associated information, search the following sources for troubleshooting information specific to that Stop error:

• “Common Stop Messages” later in this chapter
• Microsoft Debugging Tools for Windows Help
• Microsoft Knowledge Base

Stop Messages

Stop messages report information about Stop errors. The intention of the Stop message is to assist the system administrator in isolating, and eventually resolving, the problem that caused the Stop error. Stop messages provide a great deal of useful information to administrators who understand how to interpret the information in the Stop message. In addition to other information, the Stop message includes the Stop error number, or bug check code, which you can use to find or reference troubleshooting information about the specific Stop error in “Common Stop Messages” later in this chapter.

Stop Message Screen Sections

When examining a Stop message, you need to have a basic understanding of the problem so that you can plan a course of action. Always review the Stop message and record as much information about the problem as possible before searching through technical sources. Stop messages use a full-screen character mode format. Each message is uniquely associated with alphanumeric characters.




A Stop message screen has four major sections, which display the following information:
• Recommended user action
• Technical information
• Driver information
• Debug port and dump status information

Note: If the video display drivers have stopped functioning, the kernel might not be able to fully display all the Stop message contents; in such a case, only the first line will be visible.

Recommended user action

The Recommended user action section informs the user that a problem has occurred and that Windows was shut down. It also provides the symbolic name of the Stop error. In Figure 10.3, the symbolic name is DRIVER_IRQL_NOT_LESS_OR_EQUAL. It also attempts to describe the problem and lists suggestions for recovery. In some cases, restarting the computer might be sufficient because the problem is not likely to recur. But if the Stop error persists after you restart the operating system, you must determine the root cause to return the operating system to an operable state. This process might involve undoing recent changes, replacing hardware, or updating drivers to eliminate the source of the problem. If you have enabled Emergency Management Services, you can restart and troubleshoot your computer remotely.

Technical information

The Technical information section lists the Stop error number as the first parameter, followed by up to four Stop error-specific codes (displayed as hexadecimal numbers enclosed in parentheses), which identify related parameters. Stop message codes contain a “0x” prefix, which indicates that the number is in hexadecimal format. For example, in Figure 10.3, the Stop error hexadecimal code is 0x000000D1 (often written as 0xD1).

Driver information

The Driver information section identifies the driver associated with the Stop error. If a file is specified by name, you can use Recovery Console or Safe Mode to verify that the driver is signed or has a date stamp that coincides with other drivers. If necessary, you can replace the file manually (in Recovery Console or in Safe Mode), or use Roll Back Driver to revert to a previous version.

Debug port and dump status information

The Debug port and dump status information section lists COM port parameters that a kernel debugger uses, if enabled. If you have enabled memory dump file saves, this section also indicates whether one was successfully written. As a dump file is being written to the disk, the percentage shown after Dumping physical memory to disk is incremented to 100. A value of 100 indicates that the memory dump was successfully saved.