Service Schedule unstable (Web Server 2008 R2)(x86-64)
After a clean install, I changed the registry HKLM\SYSTEM\CurrentControlSet\services\Rpc\Linkage\Bind to
REG_MULTI_SZ "1"
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Rpc\Linkage" /v "Bind" /t REG_MULTI_SZ /d "1" /f
Reboot Windows, and gain SYSTEM privilege with psexec
Change service Schedule's type to own (Schedule share process with other important service default, Schedule's failure may cause system crash)
sc config Schedule type= own
Stop and start Schedule 100 times (error will not occur every time)
sc stop Schedule
sc start Schedule
View system events with eventvwr.msc, and you will see many Error caused by Schedule, RPCRT4.dll and ntdll.dll
Delete HKLM\SYSTEM\CurrentControlSet\services\Rpc, reboot system, and Schedule will not generate error
July 27th, 2010 4:09am
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: RPCRT4.dll, version: 6.1.7600.16385, time stamp: 0x4a5be035
Exception code: 0xc0000005
Fault offset: 0x000000000000ca61
Faulting process id: 0xa60
Faulting application start time: 0x01cb2ccd2aa476b4
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\RPCRT4.dll
Report Id: 698d9899-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x660
Faulting application start time: 0x01cb2ccd2fb101e9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 6d944c70-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x730
Faulting application start time: 0x01cb2ccd311f95d3
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 6efe1d99-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0xaa8
Faulting application start time: 0x01cb2ccd34af44dc
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 728dcca2-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x3dc
Faulting application start time: 0x01cb2ccd380a959f
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 75eb7ec6-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x910
Faulting application start time: 0x01cb2ccd39afe930
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 778c0f95-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x654
Faulting application start time: 0x01cb2ccd3ac1a76f
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 78a29096-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: RPCRT4.dll, version: 6.1.7600.16385, time stamp: 0x4a5be035
Exception code: 0xc0000005
Fault offset: 0x000000000000ca61
Faulting process id: 0xbe0
Faulting application start time: 0x01cb2ccd3bbdf94c
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\RPCRT4.dll
Report Id: 799ee273-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x694
Faulting application start time: 0x01cb2ccd548a6f47
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 926695ad-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: RPCRT4.dll, version: 6.1.7600.16385, time stamp: 0x4a5be035
Exception code: 0xc0000005
Fault offset: 0x000000000000ca61
Faulting process id: 0xaf0
Faulting application start time: 0x01cb2ccd555986ff
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\RPCRT4.dll
Report Id: 9335ad65-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0x464
Faulting application start time: 0x01cb2ccd7a602e82
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: b83eb648-98c0-11df-97f7-00225f1439a7
Faulting application name: svchost.exe_Schedule, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x0000000000051da0
Faulting process id: 0xb38
Faulting application start time: 0x01cb2ccd7d9c8d61
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: bb78b3c7-98c0-11df-97f7-00225f1439a7
Free Windows Admin Tool Kit Click here and download it now
July 27th, 2010 4:10am
Based on the information, it would seem that there is an access violation,
# for hex 0xc0000005 / decimal -1073741819 :
STATUS_ACCESS_VIOLATION ntstatus.h
You may want to verify the drive and the protected OS files. From an
administrative command prompt run
chkdsk /R
and schedule the chkdsk for the next reboot. Then after the drive has
been verified, you may want to verify the protected OS files. From an
administrative command prompt, run
sfc /scannow
I would also recommend ensuring that the BIOS/firmware and device
drivers are up to date for the system. You can get more information
about the components of the system from the Components node of the
msinfo32 utility to determine which vendor websites you want to visit to
find the drivers. You will likely want to get the BIOS, firmware, and
chipset drivers from the computer manufacturer's site as they are likely
to have been tested and are known to be working by the vendor.
-- Mike Burr
July 27th, 2010 5:25pm
I have tested on three different computers.
After changing registry HKLM\SYSTEM\CurrentControlSet\services\Rpc\Linkage\Bind to REG_MULTI_SZ "1"
Schedule,
RPCRT4.dll and ntdll.dll become unstable
After deleting registry
HKLM\SYSTEM\CurrentControlSet\services\Rpc\
Schedule,
RPCRT4.dll and ntdll.dll come back stable
Free Windows Admin Tool Kit Click here and download it now
July 28th, 2010 3:57am
STATUS_ACCESS_VIOLATION usually means a NULL pointer untested.
July 28th, 2010 3:59am
are you trying to bind your NIC ? , if so then there should be an entry for your device under \device\<name>, if not RPC bind will bind to all NIC's
Free Windows Admin Tool Kit Click here and download it now
August 25th, 2010 9:34am