Typically in these scenarios, we would capture a memory dump when the crash occurs and have the customer send the dump file to us. So, we don’t know for sure what the culprit here is.
Report Id: b785c36e-8b36-11e4-be97-28e3471721edįaulting package-relative application ID:ĭescription: The process was terminated due to an unhandled exception.Įxception Info: exception code c0000005, exception address 00000000Īs you can see above, the faulting module is showing as unknown. 1000, time stamp: 0x5230d2b7įaulting application start time: 0x01d01f4374dffc6dįaulting application path: C:\Windows\CCM\SCClient.exe Sure enough, you would find the classical application crash events in the event viewer.Įvent related to Bit Locker Encryption Options crash:įaulting application name: MBAMControlUI.exe, version: 2.1.117.0, time stamp: 0x5271df47įaulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000įaulting package-relative application ID: %15Įvents related to Software Center’s crash:įaulting application name: SCClient.exe, version. Pretty confident that there has to be something interesting in the event logs. įor now, I would take the normal approach here. Well not really unknown in the end of this blog. Typically, it is supposed to show some more stuff under this, however before it could completely load everything, it would end up in crashing for some unknown reasons. ‘Bit Locker Encryption Options’ from the control panel:Ĭonfiguration Manager or SCCM’s ‘Software Center’:
This seems to be affecting hundreds of machine and has been happening for over a few months. Recently, I worked on an issue with a customer who had this particular scenario - Multiple processes would crash on launching. Thought of writing this blog with an example of an issue that I happen to solve for a customer using this tool. In my opinion, procmon is the most powerful troubleshooting tool (at least, I use it for resolving most cases) We use it on various troubleshooting occasions when we don't know what is really happening behind the scenes. The intention of this blog is to reveal some powers of procmon tool. While this is not debugging using windbg, procmon has the capability to aid us in debugging as long as we have the necessary symbol files.
0 kommentar(er)
