[SOLVED] Please help!! BSOD on Windows 10 v1809 -Bug Check: SYSTEM SERVICE EXCEPTION 0x0000003b ntoskrnl.exe

[MDardas]

BSOD Bug Check is: System Service Exception, Bug Check Code: 0x0000003b, associated driver ntoskrnl.exe

The place I work at has about 50+ computers as of 2 weeks ago starting to get BSOD and restarting. I noticed they tend to happen around a certain time in the morning. We recently implemented SCCM and started pushing out patches and updates. I am not sure if that is connected,but so far it seems to be effecting all PCs with version 1809.

I ran bluescreenview on some of the PCs having this problem and it seems to be associated with a file "ntoskrnl.exe" Which I thought may be linked to a video card driver update. I tried updating and re-installing the video card driver with no luck.

Next troubleshooting steps"
I was going to take was make sure Windows Updates are all updated, make sure chipset driver is update.

Any suggestions? Has anyone experienced this BSOD before?

 

[jeremyj_83]

https://docs.microsoft.com/en-us/wi...gger/bug-check-0x3b--system-service-exception
From what I see from Microsoft it is a driver somewhere. Have you looked in Event Viewer to see if a log was written before the BSOD? If so that might help you know what is going on. One other tip is only go to the spring updates (1803, 1903, etc...) as those have long term support. The fall updates don't have LTS so in enterprise environment that isn't very useful.

 

[MDardas]

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x3b--system-service-exception
From what I see from Microsoft it is a driver somewhere. Have you looked in Event Viewer to see if a log was written before the BSOD? If so that might help you know what is going on. One other tip is only go to the spring updates (1803, 1903, etc...) as those have long term support. The fall updates don't have LTS so in enterprise environment that isn't very useful.

Thanks for your quick reply, I went tot he event viewer but did not find anything useful to help me point in the right direction.

 

[jeremyj_83]

Thanks for your quick reply, I went tot he event viewer but did not find anything useful to help me point in the right direction.

You say that it appears to be happening at the same time in the morning. Are there any specific things that the computers are doing at that time? For example is that a time in which the desktops are being backed up?

 

[MDardas]

You say that it appears to be happening at the same time in the morning. Are there any specific things that the computers are doing at that time? For example is that a time in which the desktops are being backed up?

Unforuntely I don't know exactly what is going on becuase I am not the system admin, but we use Dell KACE and they push updates and Group Policy stuff. We also just implemented SCCM and have been pushing patches and updates as well.

 

[jeremyj_83]

Unforuntely I don't know exactly what is going on becuase I am not the system admin, but we use Dell KACE and they push updates and Group Policy stuff. We also just implemented SCCM and have been pushing patches and updates as well.

At this point I would bring it up with your sys admin. S/he would be able to see what is running at that time and then be able to whittle away at the root cause.

 

[MDardas]

At this point I would bring it up with your sys admin. S/he would be able to see what is running at that time and then be able to whittle away at the root cause.

Unofruntely they aren't much help. They are just saying its something to do with a driver update but can't pinpoint where its come from. I also checked to see what updates are being pushed and can't find any driver update being pushed.

 

[jeremyj_83]

Unofruntely they aren't much help. They are just saying its something to do with a driver update but can't pinpoint where its come from. I also checked to see what updates are being pushed and can't find any driver update being pushed.

Great so they don't want to do their job and figure out the issue. About the only thing you could try doing is updating every driver in Device Manager for one of the computers and see if that fixes the issue.

 

[MDardas]

Great so they don't want to do their job and figure out the issue. About the only thing you could try doing is updating every driver in Device Manager for one of the computers and see if that fixes the issue.

I did a chipset driver download and it still is causing the BSOD, but havent done every driver. I can try that today and let you know tomorrow.

Also, I would like to emphasize there are other Windows 10 PCs that are not having the issue and they are running on version 1703 or 1803. So if we were to upgrade to 1903 I think that would fix it.

Is 1903 much better to use than 1809? Is 1809 not a good idea?

 

[jeremyj_83]

I did a chipset driver download and it still is causing the BSOD, but havent done every driver. I can try that today and let you know tomorrow.

Also, I would like to emphasize there are other Windows 10 PCs that are not having the issue and they are running on version 1703 or 1803. So if we were to upgrade to 1903 I think that would fix it.

Is 1903 much better to use than 1809? Is 1809 not a good idea?

1903 from my side seems to be more stable. It seems I was wrong on my earlier statement regarding LTS for the different editions of Windows. Each edition is supported for 18 months for Pro & Home but for Enterprise & Education the fall updates are supported for 30 months. https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet That said I personally haven't had an issue with 1903 and it will include different drivers that might fix the issue. You could also look into going 1909 as well since that is the most current.

 

[Colif]

i find updating windows when you getting BSOD just brings the problem driver along for the ride.

Can you go to c windows/minidump on one of these PC that you ran Bluescreenview on.

copy that file to documents

upload the copy from documents to a file sharing web site, and share the link in your thread so we can help fix the problem

ntoskrnl is a vital part of windows. NTOSKRNL = windows kernel. It handles all driver requests, power management, and memory management. It sits between Hardware and Applications. It got blamed but its not the cause

50 PC? Did they all get the updates? What were the updates? Don't you have a support program with MIcrosoft?

50+ makes me wonder if its something they all connect to.

 

[MDardas]

i find updating windows when you getting BSOD just brings the problem driver along for the ride.

Can you go to c windows/minidump on one of these PC that you ran Bluescreenview on.

copy that file to documents

upload the copy from documents to a file sharing web site, and share the link in your thread so we can help fix the problem

ntoskrnl is a vital part of windows. NTOSKRNL = windows kernel. It handles all driver requests, power management, and memory management. It sits between Hardware and Applications. It got blamed but its not the cause

50 PC? Did they all get the updates? What were the updates? Don't you have a support program with MIcrosoft?

50+ makes me wonder if its something they all connect to.

We actually put in a ticket with Microsoft, sent them the minidump files, and they finally got back to us they said:
"We looked at the dump; it comes back as relating to a known code defect that was fixed in November 2018 as part of our rollup package that month.

The crashing thread is in Inventory.exe – is this KACE or something Lotus Notes related? It is attempting to verify the file header below and fails, leading to the crash:"

They advise installing the latesy hotfix package (Jan. or Feb. 2020) and to let us know if the issue reoccurs.

How does one go about applying a hotfix package?

 

[jeremyj_83]

We actually put in a ticket with Microsoft, sent them the minidump files, and they finally got back to us they said:
"We looked at the dump; it comes back as relating to a known code defect that was fixed in November 2018 as part of our rollup package that month.

The crashing thread is in Inventory.exe – is this KACE or something Lotus Notes related? It is attempting to verify the file header below and fails, leading to the crash:"

They advise installing the latesy hotfix package (Jan. or Feb. 2020) and to let us know if the issue reoccurs.

How does one go about applying a hotfix package?

The hotfix should just be a Windows update. If not they probably gave your an update number like KB4524244 in which you can search for that on Microsoft's site and download it and run the installer.