5 Computers Started Randomly Crashing in the Office

[Antairus]

This is The Memory dump from one of them.
I hope someone can tell me what is going on. this is Frustrating.




Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23455.x86fre.win7sp1_ldr.160516-0600
Machine Name:
Kernel base = 0x82c54000 PsLoadedModuleList = 0x82da0e30
Debug session time: Wed Jul 6 10:27:15.364 2016 (UTC - 5:00)
System Uptime: 0 days 1:01:21.994
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.......
2: kd> !analyze
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck DF, {82e6ceb8, 85fcabf0, 85fcabf0, 0}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IMPERSONATING_WORKER_THREAD (df)
A workitem forgot to disable impersonation before it completed.
Arguments:
Arg1: 82e6ceb8, Worker Routine that caused this bugcheck.
Arg2: 85fcabf0, Parameter passed to this worker routine.
Arg3: 85fcabf0, Pointer to the Workitem.
Arg4: 00000000
Debugging Details:
------------------

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xDF
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82cd2476 to 82d33c24
STACK_TEXT:
8e58bbf0 82cd2476 000000df 82e6ceb8 85fcabf0 nt!KeBugCheckEx+0x1e
8e58bc50 82e6145b 00000001 a597dc91 00000000 nt!ExpWorkerThread+0x278
8e58bc90 82d059c9 82cd21fe 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: 0xDF_ANALYSIS_INCONCLUSIVE
BUCKET_ID: 0xDF_ANALYSIS_INCONCLUSIVE
Followup: MachineOwner
---------

 

[axe0]

Please read BSOD Posting Instructions & How to upload files

 

[RolandJS]

BSOD dump - I have no idea what I'm reading, so I'm approaching from another vantage-point:
What if anything was recently installed or removed on these computers? On the server?
Any recent PC-fixer/driver updater, software updater, etc. utility installed on these computers?
Hardware changes without corresponding software/driver changes? Or, the reverse possible?

 

[axe0]

The content posted from the dump is not enough to say anything of possible causes, it is quite a very minimum that is posted.

 

[RolandJS]

Axe, are my questions ok for this thread?

 

[axe0]

What if anything was recently installed or removed on these computers

This one is a good one, often recent changes causes issues.

Any recent PC-fixer/driver updater, software updater, etc. utility installed on these computers?

Also a good one, but we'll need the logs to see it ourselfs because many are not aware of the presence.

Hardware changes without corresponding software/driver changes? Or, the reverse possible?

For this one counts the answer for recent changes.