BSOD from win32k.sys when computer locks for workstation being idle

[k0d3ck]

All:

I know this has been discussed before and I stumbled across this issue and fix but cannot find it this time. My Windows 7 Pro laptop is on a Win2k3 Domain with Group Policy enforced. One specific GPO will lock a workstation if it is idle for 15 minutes. I recall there being a NetBIOS registry key that had to be changed to fix this issue of BSOD but cannot find it. If you know of it, please share!
vDebugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!MulConvertChildRedirectionDfbSurfaceToDib+38
97c8c2e8 f6404c01 test byte ptr [eax+4Ch],1

TRAP_FRAME: 996178fc -- (.trap 0xffffffff996178fc)
ErrCode = 00000000
eax=fffffff0 ebx=00000000 ecx=99617940 edx=00000001 esi=fe8df380 edi=fdc33c90
eip=97c8c2e8 esp=99617970 ebp=99617980 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
win32k!MulConvertChildRedirectionDfbSurfaceToDib+0x38:
97c8c2e8 f6404c01 test byte ptr [eax+4Ch],1 ds:0023:0000003c=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: MTri1+.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 97bd1114 to 97c8c2e8

STACK_TEXT:
99617980 97bd1114 00000001 04050293 8676aba0 win32k!MulConvertChildRedirectionDfbSurfaceToDib+0x38
99617994 97bd0930 fe4707c8 00000000 ffa6a008 win32k!pConvertDfbSurfaceToDib+0x36
996179c0 97bd3b3d ffa6a008 fe4aa5b0 00000000 win32k!bDynamicRemoveAllDriverRealizations+0x49
99617a24 97afa4bc ffa6a008 fdc32008 00000001 win32k!bDynamicModeChange+0x97
99617b10 97af9152 00000000 894730a8 00000000 win32k!DrvInternalChangeDisplaySettings+0xb04
99617c2c 97bd9997 0012f80c ffb80008 002cf8a0 win32k!DrvChangeDisplaySettings+0x3ae
99617c88 97bda293 0012f80c 002cf8a0 894970e0 win32k!xxxInternalUserChangeDisplaySettings+0x247
99617cf8 97bd9def 0012f80c 002cf8a0 00000000 win32k!xxxUserChangeDisplaySettings+0x67
99617d1c 8285a44a 0012f80c 002cf8a0 00000000 win32k!NtUserChangeDisplaySettings+0x60
99617d1c 778864f4 0012f80c 002cf8a0 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f814 00000000 00000000 00000000 00000000 0x778864f4
STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!MulConvertChildRedirectionDfbSurfaceToDib+38
97c8c2e8 f6404c01 test byte ptr [eax+4Ch],1

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!MulConvertChildRedirectionDfbSurfaceToDib+38

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4bdc3f5e

FAILURE_BUCKET_ID: 0x8E_win32k!MulConvertChildRedirectionDfbSurfaceToDib+38

BUCKET_ID: 0x8E_win32k!MulConvertChildRedirectionDfbSurfaceToDib+38

Followup: MachineOwner

 

[zigzag3143]

All:

I know this has been discussed before and I stumbled across this issue and fix but cannot find it this time. My Windows 7 Pro laptop is on a Win2k3 Domain with Group Policy enforced. One specific GPO will lock a workstation if it is idle for 15 minutes. I recall there being a NetBIOS registry key that had to be changed to fix this issue of BSOD but cannot find it. If you know of it, please share!
vDebugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!MulConvertChildRedirectionDfbSurfaceToDib+38
97c8c2e8 f6404c01 test byte ptr [eax+4Ch],1

TRAP_FRAME: 996178fc -- (.trap 0xffffffff996178fc)
ErrCode = 00000000
eax=fffffff0 ebx=00000000 ecx=99617940 edx=00000001 esi=fe8df380 edi=fdc33c90
eip=97c8c2e8 esp=99617970 ebp=99617980 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
win32k!MulConvertChildRedirectionDfbSurfaceToDib+0x38:
97c8c2e8 f6404c01 test byte ptr [eax+4Ch],1 ds:0023:0000003c=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: MTri1+.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 97bd1114 to 97c8c2e8

STACK_TEXT:
99617980 97bd1114 00000001 04050293 8676aba0 win32k!MulConvertChildRedirectionDfbSurfaceToDib+0x38
99617994 97bd0930 fe4707c8 00000000 ffa6a008 win32k!pConvertDfbSurfaceToDib+0x36
996179c0 97bd3b3d ffa6a008 fe4aa5b0 00000000 win32k!bDynamicRemoveAllDriverRealizations+0x49
99617a24 97afa4bc ffa6a008 fdc32008 00000001 win32k!bDynamicModeChange+0x97
99617b10 97af9152 00000000 894730a8 00000000 win32k!DrvInternalChangeDisplaySettings+0xb04
99617c2c 97bd9997 0012f80c ffb80008 002cf8a0 win32k!DrvChangeDisplaySettings+0x3ae
99617c88 97bda293 0012f80c 002cf8a0 894970e0 win32k!xxxInternalUserChangeDisplaySettings+0x247
99617cf8 97bd9def 0012f80c 002cf8a0 00000000 win32k!xxxUserChangeDisplaySettings+0x67
99617d1c 8285a44a 0012f80c 002cf8a0 00000000 win32k!NtUserChangeDisplaySettings+0x60
99617d1c 778864f4 0012f80c 002cf8a0 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f814 00000000 00000000 00000000 00000000 0x778864f4
STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!MulConvertChildRedirectionDfbSurfaceToDib+38
97c8c2e8 f6404c01 test byte ptr [eax+4Ch],1

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!MulConvertChildRedirectionDfbSurfaceToDib+38

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4bdc3f5e

FAILURE_BUCKET_ID: 0x8E_win32k!MulConvertChildRedirectionDfbSurfaceToDib+38

BUCKET_ID: 0x8E_win32k!MulConvertChildRedirectionDfbSurfaceToDib+38

Followup: MachineOwner

We still need the actual DMP file. Please zip it and upload it for analysis. The first parameter references a memory exception but I cant tell you much more until I get the DMP file.

Ken

 

[k0d3ck]

Oops, sorry about that! The file is attached. Thanks for the reply!

 

[zigzag3143]

Oops, sorry about that! The file is attached. Thanks for the reply!

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory



While the DMP point to win32k.sys (a win 7 file) that is nearly impossible. There are 2 much more likely causes and two fixes.

1- The first parameter below (c0000005) is a memory exception not handled. To test for this you should download a 3rd party app called memtestx86, burn it to cd, and run it for at least 6 passes.

2- A corrupt system file. To check for this you should run a system file check
(type cmd in search>right ,click and run as admin>sfc /scannow)

Let us know the results

Ken

Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Wed Jun 30 12:01:07.182 2010 (GMT-4)
System Uptime: 0 days 0:00:30.070
BugCheck 1000008E, {c0000005, 97c8c2e8, 996178fc, 0}
Probably caused by : win32k.sys ( win32k!MulConvertChildRedirectionDfbSurfaceToDib+38 )
BUGCHECK_STR:  0x8E
PROCESS_NAME:  MTri1+.exe

 

[k0d3ck]

I found the fix, thanks for the help!

What solved the problem for me is setting the following registry key and values to make Windows 7 behave like Windows Server2003 regarding to Kerberos Encryption Type (KERB_ETYPE_RC4_HMAC_NT)
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
(Add the this value to the "parameters" key)
Type: REG_DWORD
Name: DefaultEncryptionType
Data: 23 (decimal) or 0x17 (hexadecimal)