cluberti

In looking at your xperf trace, it appears that something running in kernel (the system process) is staying "alive" while you are shutting down - in fact, in the trace, system is the only process running for about 40 seconds before xperf kills it and restarts the machine, meaning there's a non-usermode driver here at fault. In looking at your BAD_POOL_CALLER bugcheck, I can see that there is a bad pool address indeed called from kernel: // Pool block being freed is param 4, contents is param 3: 0: kd> .bugcheck Bugcheck code 000000C2 Arguments 00000007 00001097 8af0bb64 852dd730 // Indeed, a double-free: 0: kd> kb ChildEBP RetAddr Args to Child 8af43c20 82e5be4a 852dd730 00000000 84ef4208 nt!ExFreePoolWithTag+0x1b1 8af43c6c 82e3b6f4 8512f1d8 8512f1d8 8512f1c0 nt!IopDeleteFile+0x18f 8af43c84 82c83040 00000000 88252070 00000000 nt!ObpRemoveObjectRoutine+0x59 8af43c98 82c82fb0 8512f1d8 82e4b9f5 8521bf10 nt!ObfDereferenceObjectWithTag+0x88 8af43ca0 82e4b9f5 8521bf10 8521bf38 82d84680 nt!ObfDereferenceObject+0xd 8af43ccc 82c45f29 8521bf10 00000000 00000000 nt!MiSegmentDelete+0x191 8af43d28 82c45e41 84eee638 00000000 00000000 nt!MiProcessDereferenceList+0xdb 8af43d50 82e2866d 00000000 aa33dc0e 00000000 nt!MiDereferenceSegmentThread+0xc5 8af43d90 82cda1d9 82c45d7a 00000000 00000000 nt!PspSystemThreadStartup+0x9e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19 0: kd> !pool 852dd730 Pool page 852dd730 region is Nonpaged pool 852dd000 size: 230 previous size: 0 (Allocated) NDCM 852dd230 size: 48 previous size: 230 (Free) NDwi 852dd278 size: 80 previous size: 48 (Allocated) DkSt 852dd2f8 size: 80 previous size: 80 (Allocated) SASC 852dd378 size: 80 previous size: 80 (Allocated) DkSt 852dd3f8 size: 10 previous size: 80 (Free) WfpH 852dd408 size: 68 previous size: 10 (Allocated) FMsl 852dd470 size: 68 previous size: 68 (Allocated) FMsl 852dd4d8 size: 80 previous size: 68 (Allocated) DkSt 852dd558 size: b0 previous size: 80 (Free) File 852dd608 size: 68 previous size: b0 (Free ) FMsl 852dd670 size: 98 previous size: 68 (Allocated) SaSc 852dd708 size: 20 previous size: 98 (Allocated) ReTa 852dd728 is not a valid large pool allocation, checking large session pool... 852dd728 is not a valid small pool allocation, checking large pool... unable to get pool big page table - either wrong symbols or pool tagging is disabled 852dd728 is freed (or corrupt) pool Bad previous allocation size @852dd728, last size was 4 0: kd> !poolval 852dd000 Pool page 852dd000 region is Nonpaged pool Validating Pool headers for pool page: 852dd000 Pool page [ 852dd000 ] is __inVALID. Analyzing linked list... [ 852dd708 --> 852dd758 (size = 0x50 bytes)]: Corrupt region Scanning for single bit errors... None found // Looking at the contents of the double-free'd block, it contains a pool tag I recognize: 0: kd> dc 852dd728 852dd728 8af0bb64 58434f46 00000001 00000000 d...FOCX........ 852dd738 00000000 00040001 00000000 852dd744 ............D.-. 852dd748 852dd744 00000000 852dd750 852dd750 D.-.....P.-.P.-. 852dd758 00010006 e56c6946 04060001 6e786454 ....Fil.....Tdxn 852dd768 856b3998 8322f330 00000010 852dd780 .9k.0.".......-. 852dd778 8715f320 85163620 0f000000 00060000 ... 6.......... 852dd788 0138a8c0 00000000 04100006 43534153 ..8.........SASC 852dd798 00000000 85bf25b8 851b3400 8f6f30a4 .....%...4...0o. // Searching to make sure that driver is loaded: 0: kd> !for_each_module s -a @#Base @#End "Tdxn" 8322653d 54 64 78 6e 56 89 03 ff-15 7c e1 22 83 8b c7 5f TdxnV....|."..._ 832271a4 54 64 78 6e 56 ff 15 7c-e1 22 83 8b 35 30 f3 22 TdxnV..|."..50." 8322779f 54 64 78 6e 50 52 ff 15-60 e1 22 83 8b d8 33 ff TdxnPR..`."...3. 83227a49 54 64 78 6e 53 ff 15 7c-e1 22 83 eb 60 be 38 f3 TdxnS..|."..`.8. // That range comes back to tdx.sys: 0: kd> lmvm tdx start end module name 8321e000 83235000 tdx (deferred) Image path: \SystemRoot\system32\DRIVERS\tdx.sys Image name: tdx.sys Timestamp: Mon Jul 13 19:12:10 2009 (4A5BBF4A) CheckSum: 0001DB35 ImageSize: 00017000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 Which is a broadcom driver, and a version that I've seen cause other such issues (like random BSODs and sleep/hibernate issues) in Windows 7 on some Dell machines that I've run across. This is a similar chassis/motherboard setup to those Intel boards: Chassis Type Desktop Version Serial Number Asset Tag Number Bootup State Safe Power Supply State Safe Thermal State Other Security Status Other OEM Defined 0 [Onboard Devices Information (Type 10) - Length 6 - Handle 0012h] Number of Devices 1 01: Type Video [enabled] 01: Description Unknown Video Device [Onboard Devices Information (Type 10) - Length 6 - Handle 0013h] Number of Devices 1 01: Type Ethernet [enabled] 01: Description Intel(R) 82566DC Gigabit Ethernet Device [Onboard Devices Information (Type 10) - Length 6 - Handle 0014h] Number of Devices 1 01: Type Sound [enabled] 01: Description Intel(R) High Definition Audio Device [Physical Memory Array (Type 16) - Length 15 - Handle 0017h] Location 03h - SystemBoard/Motherboard Use 03h - System Memory Memory Error Correction 03h - None Maximum Capacity 8388608KB Memory Error Inf Handle [Not Provided] Number of Memory Devices 4 [Memory Device (Type 17) - Length 27 - Handle 0018h] Physical Memory Array Handle 0017h Memory Error Info Handle [Not Provided] Total Width 64 bits Data Width 64 bits Size 1024MB Form Factor 09h - DIMM Device Set [None] Device Locator J1MY Bank Locator CHAN A DIMM 0 Memory Type 13h - Specification Reserved Type Detail 0080h - Synchronous Speed 800MHz Manufacturer 0x7F4F000000000000 Serial Number Asset Tag Number Part Number 0x4A4D383030514C4A2D314720202020202020 [Memory Device Mapped Address (Type 20) - Length 19 - Handle 0019h] Starting Address 00000000h Ending Address 000fffffh Memory Device Handle 0018h Mem Array Mapped Adr Handle 001eh Partition Row Position 01 Interleave Position 01 Interleave Data Depth 01 [Memory Device (Type 17) - Length 27 - Handle 001ah] Physical Memory Array Handle 0017h Memory Error Info Handle [Not Provided] Total Width 0 bits Data Width 0 bits Size [Not Populated] Form Factor 09h - DIMM Device Set [None] Device Locator J2MY Bank Locator CHAN A DIMM 1 Memory Type 13h - Specification Reserved Type Detail 0000h - Speed 0MHz Manufacturer NO DIMM Serial Number Asset Tag Number Part Number NO DIMM [Memory Device (Type 17) - Length 27 - Handle 001bh] Physical Memory Array Handle 0017h Memory Error Info Handle [Not Provided] Total Width 64 bits Data Width 64 bits Size 1024MB Form Factor 09h - DIMM Device Set [None] Device Locator J3MY Bank Locator CHAN B DIMM 0 Memory Type 13h - Specification Reserved Type Detail 0080h - Synchronous Speed 800MHz Manufacturer 0x7F4F000000000000 Serial Number Asset Tag Number Part Number 0x4A4D383030514C4A2D314720202020202020 [Memory Device Mapped Address (Type 20) - Length 19 - Handle 001ch] Starting Address 00100000h Ending Address 001fffffh Memory Device Handle 001bh Mem Array Mapped Adr Handle 001eh Partition Row Position 02 Interleave Position 02 Interleave Data Depth 01 [Memory Device (Type 17) - Length 27 - Handle 001dh] Physical Memory Array Handle 0017h Memory Error Info Handle [Not Provided] Total Width 0 bits Data Width 0 bits Size [Not Populated] Form Factor 09h - DIMM Device Set [None] Device Locator J4MY Bank Locator CHAN B DIMM 1 Memory Type 13h - Specification Reserved Type Detail 0000h - Speed 0MHz Manufacturer NO DIMM Serial Number Asset Tag Number Part Number NO DIMM [Memory Array Mapped Address (Type 19) - Length 15 - Handle 001eh] Starting Address 00000000h Ending Address 001fffffh Memory Array Handle 0017h Partition Width 04

A little more info about the system might be useful, like was this an upgraded XPSP2 to XPSP3 install, or a clean install of XPSP3? Was this installation modified in any way by tools like nLite? If you install the latest Windows Installer update, does it also fail?

Sorry, been dealing with a personal issue. I'll take a look tomorrow (March 23).

PM sent.

Bad Pool Caller would be a driver issue, so more fuel on the fire. If you want to compress and post the .dmp file it created, that'd be good too.

Yes, please post it somewhere we can download it.

UAC is a security in depth measure, not meant to be an annoyance. Consider su on a Unix system, when running as a non-admin user. UAC is basically the Windows amalgamation of that - integrity levels on processes, sandboxing in the browser, and the like. It's not really meant for those of us who would run a system as an administrator, but none of us do that in this day and age, right?

If security is your only reason to evaluate Win7, and you already have secure computing practices, then you don't "need" to use Windows 7. The things Win7 brings (it is more secure) would be proper CPU scaling support, better memory management, integrated OS search, etc - it's a more "complete" integration of the OS. XP is fine if it works for someone, although it no longer gets bug fixes and it won't get new applications (like IE9). You'll ultimately have to be the one making the choice of which OS to use for you, though.

Not really.

OK, so it is a failure to sleep, although the immediate shutdown is the wildcard. Assuming you have the latest motherboard BIOS for your system, and it implements the S1 and S3 states properly, it might be best to test to get a trace of this and see what's happening, as it seems something (driver, perhaps) is causing the failure to sleep.

After it shuts down, if you power it back on does it give you the "recovery" menu (start windows normally, safe mode, etc. options), or does Windows boot normally? If it's the latter, it sounds more like the system is failing to go into a power-saving state properly (probably hibernation failure, as is common with BIOS power-saving issues). Running "powercfg -h off" might change things, and is worth a try if this is the case.

The car analogy doesn't wash. A Service Pack is an amalgamation of fixes (mostly LDR fixes that require a support case otherwise to get) and potentially feature additions. While I don't agree with the latter (it's a Service Pack, not a Feature Pack!!!), it still stands to reason that at 24 months after the release of the current SP, the previous SP will stop getting any updates, at all, period. Windows is the most attacked vector out there, and running an unpatched system would seem to me to be a bad idea (even behind a router). The OP (and everyone else) is free to their opinions, of course, but ultimately if you want to stay patched, you're going to need to install the latest SP sooner or later. XPSP2 support and patch availability runs out in July of this year, for instance.

These features don't exist in the inbox DNS server for Windows. You'd have to use something 3rd party that had these features if you want or need them, although this sounds more like a job for a proxy server than a DNS server.

There are a whole host of fixes to an SP1 system that are rolled up into the SP2 package. I would say that no service pack is *necessary* unless it's required for support (and right now, for Vista, you get patches only for SP1 or newer, making at least SP1 *necessary*). However, unless you have a reason NOT to install a service pack (and this one is already 10 months old), I would suggest testing it - unless something specifically breaks on your system with the latest service pack, I'd suggest upgrading. Whereas with a whole OS upgrade the reverse is true (upgrade only if you want or need to), a service pack upgrade is generally the reverse - unless you absolutely cannot, you probably should.

The problem is, those *are* the locations that would change the %userprofile% variable for a user. If you set the proper locations and things are not changing, are we sure the shortcut is still using the %userprofile%\My Documents variable, or did it change the variable to the correct path on creation?

Usually it means the installation of the device or the registration of the driver is faulty, and must be reinstalled. If you look in Device Manager, under either System Devices or USB controllers, does the device show as having a problem? If so, you might be able to reinstall the driver by right-clicking on it and select the Update Driver button > Browse my computer... > Let me pick from a list... > and select the device from the list to reinstall it. In general, though, you would see this driver only if your motherboard doesn't have specific Vista chipset drivers that you need to install.

Done.

Give the deployment guys blog post on this a read.

Correct - to do so they'd have to replace the kernel with their own custom version (it is possible and Compaq used to do it with a lot of their older PCs, but I've not ever seen VMWare do this in the past).

Is the audio driver doing any monitoring of the front headphone jacks to detect when the outlet contains a plug or not (some do, some don't). Given the behavior, I'd have to say it is (this isn't a native Windows function, btw, at least not for actual audio jacks) - if this is a USB headset/headphones, then that would be more a USB bus thing, but if we're talking about an actual headset and RCA jack, this is going to come back to your audio drivers or motherboard chipset drivers (depending on who's responsible for the insert notification event along that bus).

Favorites, desktop shortcuts/icons, etc are considered "user" items. Hence, they're stored and read from the user's profile only, by default. It might be a pain, but you're going to have to endure it . If this is something that's going to be ongoing, you could put things into a default user profile, but that won't help you for users who already have an existing profile on that machine, for instance.

The location has been moved to C:\Users\Public\Favorites (you'll find the favorites folder to only be a junction point to this location now), however favorites in this folder will not show up in the UI of any existing user profile. The easiest way to add a favorite is to copy the URL from a central location to the user's profile, either in group policy or via a logon script (%userprofile%\Favorites).

I think with IE8 you can set the site as a favorite and the cookies aren't deleted by default unless you use the delete UI and uncheck Preserve Favorites Website Data.

Unless you've got Technet or MSDN access, no. Any particular reason you want the non-R2 version, specifically?

You'll have to pardon me, but I don't understand what's happening here. Was there a reason for that post, Max? I'm not really sure what prompted the reporting, but I don't necessarily see a need for post #725, either. I guess we'll have to bring up rule 7.b again - everyone grow up, or bans will happen. I don't care if you're a sponsor, a dev, or even a mod - the rules are the rules. Be respectful, or you'll be posting somewhere else. This is the one and only warning, to everyone.