Explorer Application Error on restart in Server 2012 R2

[Tripredacus]

Ran into a strange problem on Server 2012 R2 in Audit Mode. I can do this every time on the first restart, but not always on successive restarts. To replicate, deploy Server 2012 R2 to a system in Audit Mode with no additional software installed. There are minimal updates integrated and some drivers. I can get this information if necessary.

Open something from the context menu on the right (the Start Button menu) such as Event Viewer. Other programs also work, such as Internet Explorer. Then close it and choose to restart using the same menu on the left. An error appears after the "restarting" background appears:

explorer.exe - Application Error

The instruction at 0x27b8310 referenced memory at 0x027b8310. The memory could not be written.

The memory location specified in the error may be different each time. However, restarting using the charms bar does not cause this to happen. Also restarting using CMD and shutdown /r /t 0 does not cause the error either. So far, using IE as the test application can cause the error every time.

So far this has been replicated on 2 server boards, 1 desktop board and a mini-PC. They all have different chipsets, CPUs and amounts of RAM, and also have tested using SSD and spindle disks.

I understand the reason the error message is displayed. Explorer is doing something when Windows is shutting down, such as writting to a memory location and that handle is closed during the normal shutdown process. And Windows is showing the error relating to that failure to read or write to the memory location. It isn't a "real" error in my mind, but it still shouldn't be happening.

Can anyone else replicate this or know how to solve it?

Update: Confirmed this issue on unmodified source. I did a manual install from DVD. For ease of time I entered Audit Mode, opened IE, then restart using the option on the left and got the error.

Edited January 10, 2014 by Tripredacus

[MagicAndre1981]

try if this generates dumps:

http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx

If you have dumps, zip and upload them.

[Tripredacus]

I did that and the folder is empty. These are my reg settings I chose:

Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]"DumpFolder"=hex(2):25,00,4c,00,4f,00,43,00,41,00,4c,00,41,00,50,00,50,00,44,\  00,41,00,54,00,41,00,25,00,5c,00,43,00,72,00,61,00,73,00,68,00,44,00,75,00,\  6d,00,70,00,73,00,00,00"DumpCount"=dword:0000000a"DumpType"=dword:00000002

I also added it into the Wow6432Node. Afterwards, something interrupted the restart process (the message of an application was still running) however the folder still is empty. I searched the drive for *.dmp and none were found. So it looks like it started to gather the dump, but Windows restarted before it could finish.

[MagicAndre1981]

ask cluberti if he can help.

[Tripredacus]

I chatted with him about it last week. He said for me to check if any hibernation rules were set, but none of them were.

I also had also reported this as a bug to Microsoft but have not heard back anything yet.

[Tripredacus]

To update, I have now encountered the error in these situations:

- Legacy installation on physical hardware (repro near 100%)

- UEFI installation on physical hardware (repro around say... 10%)

- Installation on Gen 1 Hyper-V VM (repro near 100%)

However, not able to repro on Gen 2 Hyper-V VM, but to be honest I haven't put the time into it. Nothing more boring than constantly restarting a PC. Also, testing in VMs is out of scope for my since I primarily work in the physical environment. It is enough work on it for now tho, the case has been escalated and I will relay any information (as allowed) when it becomes available.

[MagicAndre1981]

ok, I asked a bit and it seems that you need to create a full dump with the CrashOnCtrlScroll way:

http://www.msfn.org/board/topic/130005-creating-memory-dumps/

[Tripredacus]

My copy of the debugger can't open the DMP file. I'm presuming it is because I need to update it. Hopefully it isn't corrupt.

Note: the PC I generated it on only has 2GB RAM, to explain its size.

https://skydrive.live.com/redir?resid=DF9CED75545B2B97%21216

[MagicAndre1981]

I can't see any Explorer.exe process in the dump.

when have you created the dump?

[Tripredacus]

I created it while the error box was on the screen. Its likely Explorer.exe was no longer open. If I have to redo it, you think I should generate the dump after chosing restart but before the error appears? That could be quite difficult...

[MagicAndre1981]

try to create the dump as soon as possible when you see the error on the screen.

[Tripredacus]

I will try it again in a bit. The error is only there for 2-3 seconds because Windows ends up rebooting even if you don't click OK.

[t4c]

I registered on the forum to report that this is happening to me as well. No problem with virtual 2k12r2 running on 2k8r2 hyper-v physical hosts that I have seen, but installed our our first 2k12r2 physical machine and started happening from first base install. Only happens if I reboot from console when using r-click the 'new and improved' 'not a start button but is exactly where start button used to be and does everything useful the old start button did plus more' button and select reboot from there. If i shutdown /r /t 0 no error as stated earlier here. Also does not appear to error when using rdp session to manage when it is rebooted. As stated, it doesn't stop the shutdown and no apparant lasting effects, but not by design I'm sure.

[Tripredacus]

I forgot that a KB came out for this issue. It is not a fix, but maybe a patch will come in the future. NOTE: It was discovered to also be a problem with Windows 8.1.

http://support.microsoft.com/kb/2929203

[MagicAndre1981]

Have you installed the large 8.1 update? Does it fix it?