Hotfix 815021 Blue Screen SESSION5_INITIALIZATION_FAILURE

[Ryan Belcher]

I'm posting this as a dual purpose post. 1) Documenting my problems and
requesting feedback from anyone who knows what is going on. And 2)
Documenting what I did to roll myself back.

I've got a Win2k Sp2 Server with Exchange 2000 Sp3 installed with all the
latest hotfixes installed. Upon installing 815021
http://support.microsoft.com/default.aspx?scid=kb;en-us;815021, I rebooted
and promptly blue screened with STOP ERROR: SESSION5_INITIALIZATION_FAILURE
0x00000071 (0x0, 0x0, 0x0) I've trimmed the useless "0"'s. No GUI mode
would work (safe mode, AD Restore Mode, etc). If any Microsoft People want
to take a stab at this let me know and I'll be happy to give you as much
info as possible.

What I did to fix it:

1) Using the Win2k server installation disk, I booted to the Recovery
Console Repair mode. I copied the new %windir%\system32\ntdll.dll (which
was installed by the hotfix) to c:\.
2) I copied the %windir%\$NtUninstallQ815021$\ntdll.dll to
%windir%\system32\
3) Reboot

I do not know what else the patch did, but this appeared to allow me to
return to normal operation.

I hope this helps some other poor souls that ran into this. I was sweating
bullets.

Ryan

[T.]

On Tue, 18 Mar 2003 09:18:03 -0500, "Ryan Belcher"
<ry...@sealevel.com> wrote:

<snip>

I ran into this yesterday. Patched a test machine a got the BSOD you
talk about. I also performed the same fix you did and all was back to
normal. Afterward I posted a message in the MS private groups.
Hopefully they'll get on it before my users (or anyones users) start
using WU blindly.

-T.

[Michael Calanan]

Ryan, others...

I can confirm this also happened on a Win2K Server sP2 (+ most other
patches). Upon installing MS03-007 (Q815021_W2K_sp4_x86_EN.EXE) my DC
halts at boot with the same stop code.

Interestingly, I applied this patch to a Win2K Pro SP2 (+ most other
patches) machine running IIS and it rebooted just fine.

I am in the process of recovering NTDLL.DLL and will reply only if the
recovery fails.

Thanks,

- mike

[Michael Calanan]

OK...so I lied, I want to reply regardless. Ryan, the steps you
outlined worked like a champ...thanks for publishing them, you saved
us a lot of time!

Now let's see what MS has to say...unfortunately the patch is still
available...reminds me of the MS01-052 debacle, which at the time
whacked our Exchange server:

http://zdnet.com.com/2100-11-268382.html

> "Yesterday, we discovered that the updated version contained
> outdated files which, as a result, did not fix the issues for
> which it was designed," a Microsoft representative said
> Wednesday. "We are incredibly sorry and apologize for any
> convenience."
>
> ...edit...
>
> "If you look through the mailing lists and the bug lists,
> you'll see that one time out of five, a new patch is
> replacing an older one that didn't work right," [Gartner's Pescatore] said.
>
> On Wednesay, nearly a week after the release of the first
> patch, Microsoft rushed to update its Web site and mailing
> lists with the newest fix.
>
> "This will not happen again," said the Microsoft
> spokesperson. "Period."

"Period." Hrm. :)

- mike

[Vassilis Contogeorgos]

What i can see common from all of you is that you have win 2k SP2...i think
this is suppose to be a patch after sp3 installations...i don't know....

Microsoft should deffently find a solution for this...

"Ryan Belcher" <ry...@sealevel.com> wrote in message
news:v7eaitq...@corp.supernews.com...

[André]

Everyone,

I also ran into the same problems, but now with Win2k SP2 Professional
workstations and laptops all still on SP2, and Ryan's fix did the job
! Thanks !

André

"Ryan Belcher" <ry...@sealevel.com> wrote in message news:<v7eaitq...@corp.supernews.com>...

[Hans]

Hallo,
we encountered a similar phenomenon after having installed W2K SP3 on
the machine:

Starting on wednesday, 26 January our W2K-Domain Controller (PDC)
crashes now every wednesday exactly at noon with bluescreen!
Eventlog shows: (The computer has
rebooted from a bugcheck. The bugcheck was: 0x00000077
(0xc000000d, 0xc000000d, 0x00000000, 0x00131000).
Microsoft Windows 2000 [v15.2195].)

We are searching in every direction without any result up to now.
Do you think the reason for that could also be SP3, although the stop
code is 77 (not 71)?

Hans

[Ryan Belcher]

This thread documents a problem with the newest hotfix that Microsoft put
out, since you're experiencing a problem waaaay previous this fix I don't
believe it's related. Since you're crashing exactly at the same times, I'd
check to see what application may be scheduled to run on Wednesdays at Noon.

"Hans" <hans....@sonax.de> wrote in message
news:ce8c7e93.03031...@posting.google.com...

[Vassilis Contogeorgos]

As per microsoft :

"If you are running Windows 2000 Service Pack 2 (SP2), before you install
this update you must check the version of Ntoskrnl.exe on your system:
1.. Browse to the %windir%\System32 folder.
2.. Right-click the Ntoskrnl.exe file, click Properties, and then click
the Version tab.
Versions of Ntoskrnl.exe between 5.0.2195.4797 and 5.0.2195.4928 (inclusive)
are not compatible with this update. These versions were only distributed
with Product Support Services (PSS) hotfixes. If the update for this issue
is installed on a system with one of these versions of Ntoskrnl.exe, the
computer stops responding on the first restart with a Stop 0x00000071
message and must be recovered using the Windows 2000 Recovery Console and
the backup copy of Ntdll.dll stored in the "\winnt\$NTUninstallQ815021$"
folder.
To update a system with a version of Ntoskrnl.exe distributed from Product
Support Services, you must first contact PSS before you apply this update.
Alternatively, you can upgrade to Windows 2000 Service Pack 3 (SP3) prior to
installing this update. "

"Ryan Belcher" <ry...@sealevel.com> wrote in message
news:v7eaitq...@corp.supernews.com...