cluberti

Depends on what you need, honestly. I doubt you'll see any real increase in performance just switching from P35 to P45, unless you also make sure you get a faster CPU (and perhaps faster memory). Since that sounds a lot like a system upgrade to me, it would probably be better to consider something that can run i7 instead if you're going that far. If you are just interested in going from a P35 to P45 with all else staying the same, I can't really see a great reason to do so.

Sorry - even though you have a key, as you say, downloading an image of any Windows OS is technically illegal in most countries. I have to close this down - if you do find media you can use legally, please feel free to post back with any issues you may have with getting things working. Sorry, the rules are the rules. [Closed].

Vista SP1 has been out for over a year, so upgrading is always a good idea. If you plan on ever reinstalling again, assuming you aren't going to buy Windows 7 when it RTMs later this year or early next, consider picking up a Vista OEM copy online to do your reinstalls.

Technically, the shell can be modified even in Vista (see Stardock's products for example), but you won't necessarily get that from Microsoft.

If you did get that as part of the TAP, I'd suggest forwarding that question to your TAP contact at Microsoft as a bug. The behavior does sound errant, so perhaps it should be investigated before it goes RC.

Note that a day after working on this, there was another system with the exact same problem.

Zip up the entire C:\adplus folder, and PM me for FTP instructions if you don't have an upload site you normally use.

No worries, glad to hear it works.

Updating to SQL 2005 SP3 is important, yes - I would set all SQL services to disabled in services (services.msc), reboot, let Windows Update install the update, then set all SQL services back to their previous settings and reboot. That should fix it.

You have the same problem as this guy - sqlcmd.exe is probably causing it. See the above post, then look at this - again, it's only kernel mode, but I'd guess a user-mode dump would also look the same as the one in the post linked above. Take a look: // csrss.exe crashing, as we're already aware: 1: kd> !thread THREAD 89ff66e8 Cid 037c.0404 Teb: 7ffd6000 Win32Thread: e2b619e8 RUNNING on processor 1 Impersonation token: e2cb9988 (Level Impersonation) Owning Process 0 Image: <Unknown> Attached Process 8a6ccb48 Image: csrss.exe Wait Start TickCount 9749 Ticks: 0 Context Switch Count 907 LargeStack UserTime 00:00:00.093 KernelTime 00:00:00.046 Win32 Start Address 0x000085c6 LPC Server thread working on message Id 85c6 Start Address 0x75b44616 Stack Init b620e000 Current b620d744 Base b620e000 Limit b620b000 Call 0 Priority 13 BasePriority 13 PriorityDecrement 0 DecrementCount 16 ChildEBP RetAddr Args to Child b620dcd0 805d03ab 000000f4 00000003 8a6ccb48 nt!KeBugCheckEx+0x1b (FPO: [5,0,0]) b620dcf4 805d12af 805d1204 8a6ccb48 8a6cccbc nt!PspCatchCriticalBreak+0x75 (FPO: [3,0,0]) b620dd24 b5f77451 8a6ccd90 c0000005 b620dd64 nt!NtTerminateProcess+0x7d (FPO: [2,4,4]) WARNING: Stack unwind information not available. Following frames may be wrong. b620dd54 8054088c 00000000 c0000005 033febcc avipbb+0x5451 b620dd54 7c90eb94 00000000 c0000005 033febcc nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b620dd64) 033febcc 00000000 00000000 00000000 00000000 0x7c90eb94 // Since there's no user-mode portion to a kernel-only dump, we can't see the whole stack, // but we can see that we're trying to run code at 7c90eb94: 1: kd> .trap b620dd64 ErrCode = 00000000 eax=00000000 ebx=00000001 ecx=033feb40 edx=7c90eb94 esi=00000000 edi=033febf4 eip=7c90eb94 esp=033feb8c ebp=033febcc iopl=3 nv up ei pl nz na pe cy cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00003207 001b:7c90eb94 ?? ??? // Checking the lpc message from the csrss.exe thread, we can see that the client to the // csrss.exe server thread above is 8920ea28: 1: kd> !lpc message 85c6 Searching message 85c6 in threads ... Server thread 89ff66e8 is working on message 85c6 Client thread 8920ea28 waiting a reply from 85c6 Searching thread 8920ea28 in port rundown queues ... Server communication port 0xe2313830 Handles: 1 References: 1 The LpcDataInfoChainHead queue is empty Connected port: 0xe1a8bf68 Server connection port: 0xe1522ec0 Client communication port 0xe1a8bf68 Handles: 1 References: 3 The LpcDataInfoChainHead queue is empty Server connection port e1522ec0 Name: ApiPort Handles: 1 References: 140 Server process : 8a6ccb48 (csrss.exe) Queue semaphore : 8a6d47e8 Semaphore state 0 (0x0) The message queue is empty The LpcDataInfoChainHead queue is empty Done. // Looking at thread 8920ea28, we can see it's sqlcmd.exe, just like the post I linked above: 1: kd> !thread 8920ea28 THREAD 8920ea28 Cid 0bd8.0bdc Teb: 7ffdf000 Win32Thread: e10e1008 WAIT: (WrLpcReply) UserMode Non-Alertable 8920ec1c Semaphore Limit 0x1 Waiting for reply to LPC MessageId 000085c6: Current LPC port e1a8bf68 Not impersonating DeviceMap e1009228 Owning Process 0 Image: <Unknown> Attached Process 89264730 Image: sqlcmd.exe Wait Start TickCount 9747 Ticks: 2 (0:00:00:00.031) Context Switch Count 61 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x01019521 Start Address 0x7c810867 Stack Init b9d30000 Current b9d2fc50 Base b9d30000 Limit b9d2c000 Call 0 Priority 8 BasePriority 8 PriorityDecrement 0 DecrementCount 0 ChildEBP RetAddr Args to Child b9d2fc68 80502d46 8920ea98 8920ea28 804faf40 nt!KiSwapContext+0x2f (FPO: [Uses EBP] [0,0,4]) b9d2fc74 804faf40 8920ec1c 8920ebf0 8920ea28 nt!KiSwapThread+0x8a (FPO: [0,0,0]) b9d2fc9c 805a1e87 00000001 00000011 0006d401 nt!KeWaitForSingleObject+0x1c2 (FPO: [5,5,4]) b9d2fd50 8054088c 000007ec 0006d4a0 0006d4a0 nt!NtRequestWaitReplyPort+0x63d (FPO: [Non-Fpo]) b9d2fd50 7c90eb94 000007ec 0006d4a0 0006d4a0 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b9d2fd64) WARNING: Frame IP not in any known module. Following frames may be wrong. 0006d46c 00000000 00000000 00000000 00000000 0x7c90eb94 // Again the trap frame showing us trying to run code from 7c90eb94: 1: kd> .trap b9d2fd64 ErrCode = 00000000 eax=339a6000 ebx=00000000 ecx=0000ffff edx=00000002 esi=0006d4a0 edi=001a0688 eip=7c90eb94 esp=0006d44c ebp=0006d46c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 001b:7c90eb94 ?? ??? // I can see you attempting to run a SQL update, again, just like the previous post I linked: PROCESS 89231938 SessionId: 0 Cid: 0a74 Peb: 7ffd8000 ParentCid: 0924 DirBase: 0af901c0 ObjectTable: e12052e8 HandleCount: 42. Image: SQLServer2005ExpressSP3-KB955706-x86-ENU.exe What worked for the other person was to stop all SQL services (entirely), make sure sqlcmd.exe wasn't running, and *then* install all SQL updates. After a reboot, everything was fine - considering you have the *exact* same crash, and I can see a SQL update running, I'm guessing this is also the same problem.

There's a C in there you mistyped ^^^ Try "cscript adplus.vbs -hang -pn explorer.exe -quiet -o c:\adplus", that should work.

If you can zip the dmp file, PM me for an FTP upload location.

To fix the symbols after you've opened the .dmp file in windbg, run: .sympath SRV*C:\symbols*http://msdl.microsoft.com/download/symbols; .reload Then, run !analyze -v to see the bugcheck analysis (which you already know), then run !thread. You'll see a note in the output "LPC Server thread working on message Id <message #>" - run: !lpc message <message #> This will tell you what the *client thread* number is (a 6 number ID). run: .thread <thread #>; .reload; !thread <thread #> This will give you the client thread of the server csrss.exe lpc thread that crashed. If you want to see what I did recently, see the end of this post.

It may skip from 50 to 100 percent, depending. And yes, it will be csrss.exe, but we would need the data in the full dump. Otherwise, there's not a good way to answer your question -csrss.exe was *told* to close because some other problem on the system (not with csrss) caused it to need to terminate. Without a full dump, the answer is only a guess (your antivirus).

Looks better - still the same crash, obviously, but it makes more sense now - you can see sqlcmd.exe is somehow corrupt here: 1: kd> da 88efe4cc 88efe4cc "csrss.exe" 1: kd> da 805d1204 805d1204 "Terminating critical process 0x%" 805d1224 "p (%s)." 1: kd> !thread THREAD 89114420 Cid 0404.048c Teb: 7ffd5000 Win32Thread: e2bd43c8 RUNNING on processor 1 Impersonation token: e2e039e0 (Level Impersonation) Owning Process 0 Image: <Unknown> Attached Process 88efe358 Image: csrss.exe Wait Start TickCount 8079 Ticks: 0 Context Switch Count 401 LargeStack UserTime 00:00:00.078 KernelTime 00:00:00.031 Win32 Start Address 0x00001cf7 LPC Server thread working on message Id 1cf7 Start Address CSRSRV!CsrApiRequestThread (0x75b44616) Stack Init a509e000 Current a509d744 Base a509e000 Limit a509b000 Call 0 Priority 13 BasePriority 13 PriorityDecrement 0 DecrementCount 16 ChildEBP RetAddr Args to Child a509dd00 805d03ab 000000f4 00000003 88efe358 nt!KeBugCheckEx+0x1b (FPO: [5,0,0]) a509dd24 805d12af 805d1204 88efe358 88efe4cc nt!PspCatchCriticalBreak+0x75 (FPO: [3,0,0]) a509dd54 8054088c 88efe5a0 c0000005 00c7ebcc nt!NtTerminateProcess+0x7d (FPO: [2,4,4]) a509dd54 7c90eb94 88efe5a0 c0000005 00c7ebcc nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ a509dd64) 00c7eb88 7c90e89a 75b432c4 ffffffff c0000005 ntdll!KiFastSystemCallRet (FPO: [0,0,0]) 00c7eb8c 75b432c4 ffffffff c0000005 00000000 ntdll!ZwTerminateProcess+0xc (FPO: [2,0,0]) 00c7ebcc 75b44aea 00c7ebf4 75b468b1 00c7ebfc CSRSRV!CsrUnhandledExceptionFilter+0xc0 (FPO: [1,10,0]) 00c7ebd4 75b468b1 00c7ebfc 00000001 00c7ebfc CSRSRV!CsrApiRequestThread+0x4d4 (FPO: [Non-Fpo]) 00c7ebfc 7c9037bf 00c7ece8 00c7ffe4 00c7ed04 CSRSRV!_except_handler3+0x61 (FPO: [Uses EBP] [3,0,7]) 00c7ec20 7c90378b 00c7ece8 00c7ffe4 00c7ed04 ntdll!ExecuteHandler2+0x26 00c7ecd0 7c90eafa 00000000 00c7ed04 00c7ece8 ntdll!ExecuteHandler+0x24 00c7ecd0 7c9106c3 00000000 00c7ed04 00c7ece8 ntdll!KiUserExceptionDispatcher+0xe (FPO: [2,0,0]) (CONTEXT @ 00c7ed04) 00c7f1f0 75ea2137 00160000 00000000 0000009c ntdll!RtlAllocateHeap+0x1da (FPO: [Non-Fpo]) 00c7f238 75e92f21 75e92f38 0000005b 75e9c578 sxs!CSxsPointerBase<CXMLNamespaceManager::CNamespacePrefix,CSxsPointer<CXMLNamespaceManager::CNamespacePrefix,CXMLNamespaceManager::CNamespacePrefix::ms_szTypeName> >::HrAllocateBase+0x59 (FPO: [3,11,0]) 00c7f4bc 75e938d2 00179c38 00000000 00000005 sxs!CXMLNamespaceManager::OnCreateNode+0x12e (FPO: [4,153,4]) 00c7f520 75e9435f 0017ac28 00179c38 00000000 sxs!CNodeFactory::CreateNode+0xa3 (FPO: [5,16,4]) 00c7f5a8 75e98baa 00179c38 00000005 00177580 sxs!XMLParser::Run+0x2fc (FPO: [2,24,4]) 00c7f914 75e99a0f 00177580 00173e68 00177580 sxs!SxspIncorporateAssembly+0x8b8 (FPO: [2,212,4]) 00c7f960 75e998cd 00177580 00000000 00c7ff14 sxs!SxspCloseManifestGraph+0x98 (FPO: [1,12,4]) 00c7fdfc 75b5a5ed 00c7fe5c 00000004 00c7ff14 sxs!SxsGenerateActivationContext+0x54c (FPO: [1,289,4]) 00c7fe9c 75b5a760 00000054 000006f4 01c7ff14 basesrv!BaseSrvSxsCreateActivationContextFromStruct+0x194 (FPO: [4,34,4]) 00c7fed0 75b44a47 00c7feec 00c7ffd8 00000005 basesrv!BaseSrvSxsCreateActivationContextFromMessage+0x79 (FPO: [2,4,4]) 00c7fff4 00000000 00000000 000000c8 000001e6 CSRSRV!CsrApiRequestThread+0x431 (FPO: [Non-Fpo]) 1: kd> !lpc message 1cf7 Searching message 1cf7 in threads ... Server thread 89114420 is working on message 1cf7 Client thread 8876e6e0 waiting a reply from 1cf7 Searching thread 8876e6e0 in port rundown queues ... Server communication port 0xe118b870 Handles: 1 References: 1 The LpcDataInfoChainHead queue is empty Connected port: 0xe2ecabf0 Server connection port: 0xe1742b28 Client communication port 0xe2ecabf0 Handles: 1 References: 3 The LpcDataInfoChainHead queue is empty Server connection port e1742b28 Name: ApiPort Handles: 1 References: 99 Server process : 88efe358 (csrss.exe) Queue semaphore : 891ce628 Semaphore state 0 (0x0) The message queue is empty The LpcDataInfoChainHead queue is empty Done. 1: kd> !thread 8876e6e0 THREAD 8876e6e0 Cid 0bd0.0bd4 Teb: 7ffdf000 Win32Thread: e13262d0 WAIT: (WrLpcReply) UserMode Non-Alertable 8876e8d4 Semaphore Limit 0x1 Waiting for reply to LPC MessageId 00001cf7: Current LPC port e2ecabf0 Not impersonating DeviceMap e1001130 Owning Process 0 Image: <Unknown> Attached Process 89160020 Image: sqlcmd.exe Wait Start TickCount 8078 Ticks: 1 (0:00:00:00.015) Context Switch Count 62 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address 0x01019521 Start Address KERNEL32!BaseProcessStartThunk (0x7c810867) Stack Init ba198000 Current ba197c50 Base ba198000 Limit ba194000 Call 0 Priority 8 BasePriority 8 PriorityDecrement 0 DecrementCount 0 ChildEBP RetAddr Args to Child ba197c68 80502d46 8876e750 8876e6e0 804faf40 nt!KiSwapContext+0x2f (FPO: [Uses EBP] [0,0,4]) ba197c74 804faf40 8876e8d4 8876e8a8 8876e6e0 nt!KiSwapThread+0x8a (FPO: [0,0,0]) ba197c9c 805a1e87 00000001 00000011 0006d401 nt!KeWaitForSingleObject+0x1c2 (FPO: [5,5,4]) ba197d50 8054088c 000007ec 0006d4a0 0006d4a0 nt!NtRequestWaitReplyPort+0x63d (FPO: [Non-Fpo]) ba197d50 7c90eb94 000007ec 0006d4a0 0006d4a0 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ ba197d64) 0006d448 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ntdll!KiFastSystemCallRet (FPO: [0,0,0]) WARNING: Frame IP not in any known module. Following frames may be wrong. 0006d46c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d470 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d474 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d478 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d47c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d480 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d484 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d488 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d48c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d490 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d494 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d498 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d49c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4a0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4a4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4a8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4ac cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4b0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4b4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4b8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4bc cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4c0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4c4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4c8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4cc cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4d0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4d4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4d8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4dc cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4e0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4e4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4e8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4ec cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd 0006d4f0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd // Looks like a SQL update *was* actually running at the time - very interesting indeed: PROCESS 885bb020 SessionId: 0 Cid: 0b48 Peb: 7ffde000 ParentCid: 0b10 DirBase: 0a6403a0 ObjectTable: e154e5f0 HandleCount: 42. Image: SQLServer2005ExpressSP3-KB955706-x86-ENU.exe It looks like something has gone in and corrupted memory - knowing stopping SQL and updating it fixed it, I'd say sqlcmd.exe itself was probably corrupted in some way (I can't check, as the dump doesn't contain binary data about processes, so I can't !chkimg it, but the above is pretty damning). I guess the update didn't work and caused the crash.

I cannot see anything but the crashing thread - there's an LPC message there that would have given some clues, but because you got a mini dump only, the only thing it captures is the thread state at the time of the crash. You'll need a complete dump (see the sticky at the top of this section) before we can really help you. It could very well be the A/V (it's on the stack right before the call to TerminateProcess), but there's no way to say for sure without at least seeing what's at the other end of that LPC chain.

Good to hear .

Can you get a process crash dump of explorer.exe? See the sticky at the top of this section.

// The thread crashing - all you can see is the kernel-mode portion of the stack, and once you're into // nt!KiFastCallEntry with the parameters of the crash, it's too late. Note we came out of user mode // already crashing: 1: kd> !thread THREAD 88de29e0 Cid 03e8.03f8 Teb: 7ffda000 Win32Thread: e27a55a0 RUNNING on processor 1 Impersonation token: e400f420 (Level Impersonation) Owning Process 0 Image: <Unknown> Attached Process 88e3a240 Image: csrss.exe Wait Start TickCount 8518 Ticks: 0 Context Switch Count 970 LargeStack UserTime 00:00:00.234 KernelTime 00:00:00.140 Win32 Start Address 0x00004998 LPC Server thread working on message Id 4998 Start Address 0x75b44616 Stack Init b909e000 Current b909d6fc Base b909e000 Limit b909b000 Call 0 Priority 13 BasePriority 13 PriorityDecrement 0 DecrementCount 16 ChildEBP RetAddr Args to Child b909dd00 805d03ab 000000f4 00000003 88e3a240 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo]) (CONV: stdcall) b909dd24 805d12af 805d1204 88e3a240 88e3a3b4 nt!PspCatchCriticalBreak+0x75 (FPO: [Non-Fpo]) (CONV: stdcall) b909dd54 8054088c 88e3a488 c0000005 0052ebcc nt!NtTerminateProcess+0x7d (FPO: [Non-Fpo]) (CONV: stdcall) b909dd54 7c90eb94 88e3a488 c0000005 0052ebcc nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b909dd64) WARNING: Frame IP not in any known module. Following frames may be wrong. 0052ebcc 00000000 00000000 00000000 00000000 0x7c90eb94 // Walking the LPC message back, we find the client thread to this server thread: 1: kd> !lpc message 4998 Searching message 4998 in threads ... Server thread 88de29e0 is working on message 4998 Client thread 8879e228 waiting a reply from 4998 Searching thread 8879e228 in port rundown queues ... Server communication port 0xe364f780 Handles: 1 References: 1 The LpcDataInfoChainHead queue is empty Connected port: 0xe2dcaa78 Server connection port: 0xe1740cc8 Client communication port 0xe2dcaa78 Handles: 1 References: 3 The LpcDataInfoChainHead queue is empty Server connection port e1740cc8 Name: ApiPort Handles: 1 References: 155 Server process : 88e3a240 (csrss.exe) Queue semaphore : 891d3e08 Semaphore state 0 (0x0) The message queue is empty The LpcDataInfoChainHead queue is empty Done. // The thread at the other end of this LPC chain (the "client"): 1: kd> !thread 8879e228 THREAD 8879e228 Cid 0e10.0e18 Teb: 7ffdf000 Win32Thread: e400a368 WAIT: (WrLpcReply) UserMode Non-Alertable 8879e41c Semaphore Limit 0x1 Waiting for reply to LPC MessageId 00004998: Current LPC port e2dcaa78 Not impersonating DeviceMap e1001130 Owning Process 0 Image: <Unknown> Attached Process 8879e5c8 Image: sqlcmd.exe Wait Start TickCount 8517 Ticks: 1 (0:00:00:00.015) Context Switch Count 64 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address 0x01019521 Start Address 0x7c810867 Stack Init 9f973000 Current 9f972c50 Base 9f973000 Limit 9f96f000 Call 0 Priority 8 BasePriority 8 PriorityDecrement 0 DecrementCount 0 ChildEBP RetAddr Args to Child 9f972c68 80502d46 8879e298 8879e228 804faf40 nt!KiSwapContext+0x2f (FPO: [Uses EBP] [0,0,4]) 9f972c74 804faf40 8879e41c 8879e3f0 8879e228 nt!KiSwapThread+0x8a (FPO: [0,0,0]) (CONV: fastcall) 9f972c9c 805a1e87 00000001 00000011 0006d401 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo]) (CONV: stdcall) 9f972d50 8054088c 000007ec 0006d4a0 0006d4a0 nt!NtRequestWaitReplyPort+0x63d (FPO: [Non-Fpo]) (CONV: stdcall) 9f972d50 7c90eb94 000007ec 0006d4a0 0006d4a0 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ 9f972d64) WARNING: Frame IP not in any known module. Following frames may be wrong. 0006d46c 00000000 00000000 00000000 00000000 0x7c90eb94 I can't see the user-mode section of this, but something is interfering with the RPC on this box (in user-mode) enough to cause CSRSS to crash. Since I can't see what's happening in user-mode, I'm not sure what for sure would be interfering with LRPC on the machine. It's definitely a driver, but because you didn't configure for a complete memory dump (this is only a kernel dump) I can't see anything outside the kernel-mode stack, and whatever happened in this thread happened in user-mode first. You'll need a *complete* memory dump (see the sticky at the top of this section) before I can help you further, really. And, honestly, making sure all of the drivers on the system (including the filter drivers, not just hardware drivers - filter drivers like any antivirus, antispyware, etc) will probably stabilize the box. If you get a complete dump, upload it and we'll take a look.

PM me for an upload location.

It usually falls down to not using the correct res (either you or the machine picking it up wrong during boot). If you rename the default logon wallpaper (rather than use a specific res), it should work.

ERD Commander is still called such, but it's part of the MS DaRT (Diagnostics and Recovery Toolkit) available to premier SA customers only. I don't know how anyone got the idea it would be free. WinPE is free, but not ERD.

No offense, but if she works in support at Microsoft, her responsibility is to handle Microsoft cases, not post to forums. If you want to talk to MS, you'll need a case.

If using "Synchronize" allows things to work again, it sounds like the clients are going "offline". What happens if you press CTRL+ALT+DEL and lock the workstations, then unlock them? Does that also make things work again?

Incredibad - Like a boss!