Vista Tutorial - Vista crashes on Administrator Login

I have Vista Business (x86) on a P4 with 1Gb RAM.
It is a member of a domain with a Windows Server 2003 R2 controller (and a
Server 2003 R1 co-controller).
When I log in as an ordinary user, it is quite stable (using
Access/SQLServer/Visual Studio/Office 2k7 etc etc) although it may crash
occasionally (more than XP Pro).
When I log in as Administrator, either local or domain, it crashes everytime
with a blue screen just after startup. I feel fairly sure it was OK when
first installed.
Anyone else suffering from this affliction?
Kenneth Spencer

"KA Spencer" <KASpencer@xxxxxx> wrote in message
news:F2027515-C377-4C54-B54D-70144D8DDA27@xxxxxx
What are the details of the BSOD?

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca

"Kerry Brown" wrote:Thanks Kerry, my reply is:
The crash is followed by a completely blank blue screen (unlike XP/2003 etc
which give the error details) BUT after the restart, the following are the
error details:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6000.2.0.0.256.6
Locale ID: 2057

Additional information about the problem:
BCCode: 7f
BCP1: 00000000
BCP2: 00000000
BCP3: 00000000
BCP4: 00000000
OS Version: 6_0_6000
Service Pack: 0_0
Product: 256_1

There is also a minidump and an XML file if you want them - I have sent them
to Microsoft anyway, but no solution response has appeared.

I olook forward to any help you might give.

Regards

Ken.

"KA Spencer" <KASpencer@xxxxxx> wrote in message
news:8F1DA5E5-18A7-48E1-A09B-D9F60FD1F92C@xxxxxx
That error is usually hardware related, often bad RAM. In this case though
it seems more likely that some software that is running when and
administrator logs in is the culprit. You can use the Process Monitor tool
with boot logging enabled to see what is different when an admin logs in.

http://www.microsoft.com/technet/sys...ssmonitor.mspx

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca

"KA Spencer" <KASpencer@xxxxxx> wrote...Hi Ken,

STOP 0x7F means "UNEXPECTED_KERNEL_MODE_TRAP". Something running in kernel
mode (eg a device driver) has hit an unrecoverable exception, and needs to
shut down. A crash is bad, but it is better than leaving the system running,
and letting the problem possibly corrupt data during a "graceful" shutdown.
It's better to pull the plug immediately.

The first parameter to the 0x7F STOP is 00000000 - this means the particular
type of unrecoverable exception was a "divide by zero" error. This is a
fatal error on all computers.

A divide by zero can be caused by memory corruption, or other hardware
problems; or software failures.

So far it seems to only affect specifi user accounts (administrtors). That's
a bit unusual - we'd need to conclude that an Administrator logon is
exercising the machine so it hits this error, while other user accounts do
not. So it could be things like: administrator is loading additional device
drivers; launching some application automatically at logon; or admin account
has a corrupt user profile. Exact cause would require some further problem
determination. Here are some things, I'd try:

- first, boot into safe mode (press F8 during bootup) then log in as
Administrator. Does system still crash?
- if not, create a *new* local account, as member of Administrators group
- now reboot normally, and log in as the new administrative user. Does this
new admin account also experience the problem?
- use a tool like "msconfig" (builtin) or autoruns
(http://www.microsoft.com/technet/sys.../Autoruns.mspx) to
check what is being run automatically, when th administrator account logs
in. Disable everything which look suspicious.
-use Vista's memory test utility to run a memory test. Either boot from
Vista DVD and choose Repair opitions, or run "Mmeory Diagnostics Tool" (go
to Start, Search, start typing memor... , it will appear in the menu). If
memory test finds bad memory, replace your RAM.
- final step is pretty drastic so, wait until you've heard back from
Microsoft, and/or exhausted other avenues. The problem could be a corrupt
user profile. This is the file NTUSER.DAT in the user's home directory
(normally it is a hidden file). Log in as the new admin user, then delete
the "real" Administrator's NTUSER.DAT (actually, just move it to a safe
location, don't delete it altogether!!). Now log out and log in as teh
Administrator. The system will create a new blank Profile for the
Administrator. If the cause is something in the profile, it should no longer
occur with the fresh, clean profile. Noe that you will loose all customised
user settings (everything that was in HKEY_Current_User).

If Microsoft PSS are examining the dump they may be able to isolate the
specific cause - but, you'd need to have a Service Request open with PSS. If
you sent in the dump using the Windows Error Reporting tool, that still gets
analysed (automatically, by machine), but you won't get an individualised
reply. If they isolate a common bug they will produc a hotfix via Windows
Update.

Hope it helps,

--
Andrew McLaren
amclar (at) optusnet dot com dot au

Andrew and Kerry

Firstly many thanks for your replies, especially Andrew for the information.
Comments are as follows:

1. RAM
Although I haven't tested the RAM recently, it was tested just before Vista
was installed. Although that doesn't exclude RAM failure, it makes it
unlikely.

2. Safe Mode
I failed to state in my original post, that I had tried both the
"[domain]\Administrator" and the "[local]\Administrator" in safe mode and
they both logged in satisfactorily. But this mode is not suitable for full
administration of the machine. I have also switched off the Themes service,
but to no avail in this case.
Although some of my hardware (ATI graphics and DVD RAM/Multi-writer
Lightscribe drive in particular) have provoked Vista to blue screens, at
present, the main user accounts are definitley not suffering from the problem

3. New Administrator accounts
I have created two new accounts:
"[domain]\Administrator2" and "[local]\Administrator2"
and made them members of the groups
"[domain]\Administrators" and "[local]\Administrators"
respectively, and both accounts log in satisfactorily.

4. Deleting the two ([local] and [domain]) Administrator accounts
I think I shall try the suggestion of renaming the NTUSER.DAT files and
seeing what happens. Certainly the two new Administrator accounts have been
creaed properly so far as I can tell, so something untoward has happened to
the two "proper" Administrator profiles. I think that this is serious enough
for Microsoft to do something about, surely as it leaves a machine out of
management.

5. Files with Microsoft
I have only submitted the files via OCR rather than a paid or free issue
support call as yet. So I am not optimistic about a Micorosft solution unless
I raise a support issue.

So, I shall be interested to have further comments, and will let you know
what transpires.

Regards

Ken.

"KA Spencer" <KASpencer@xxxxxx> wrote..Absolutely! Safe mode is a diagnostic measure, to get some kind of logon.
But I wouldn't regard it as any kind of permanent solution.

--
Andrew McLaren
amclar (at) optusnet dot com dot au