Hi,
I am facing a problem with the *Workstation* service on a Windows XP SP2 computer. This service starts without any problem with the Windows boot, however if I stop it and try to start again, I get a 2250 error code. This error code means:
kd> !error 0n2250
Error code: (NetAPI) 0x8ca (2250) - The network connection could not be found.
After doing some user mode debugging on this service, I found that it tries to load the *rdbss* driver, but it gets a c0000034 error code from this load.
kd> !error c0000034
Error code: (NTSTATUS) 0xc0000034 (3221225524) - Object Name not found.
Digging into the process to load a driver from kernel mode I found that the real problem is a c000038e error code, which means:
kd> !error c000038e
Error code: (NTSTATUS) 0xc000038e (3221226382) - The driver could not be loaded because a previous version of the driver is still in memory.
The Windows kernel masks this error returning the 0xc0000034 error code.
The module is really loaded as you can see below, however the driver is stopped according to the sc.exe (sc query rdbss) utility. It is not present also on the object manager \Driver directory.
kd> lm m rdbss
start end module name
f7417000 f7442180 rdbss (pdb symbols) C:\Program Files\Debugging Tools for Windows (x86)\sym\rdbss.pdb\6BFF7598D30C4A76A045FF4DD18DABE32\rdbss.pdb
C:\development>sc query rdbss
SERVICE_NAME: rdbss
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 1 STOPPED
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
Does anyone have any clue about what could be causing this driver not to be fully unloaded and preventing it to start again?
I am asking this question here because IMHO it relates to file system. I know that it is not directly related to driver development, but maybe someone have got this problem already.
Thanks!
-George
George Luiz Bittencourt wrote:
C:\development>sc query rdbss
SERVICE_NAME: rdbss
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 1 STOPPED
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
Does anyone have any clue about what could be causing this driver not to be fully unloaded and preventing it to start again?
I am asking this question here because IMHO it relates to file system. I know that it is not directly related to driver development, but maybe someone have got this problem already.
Thanks!
This is speculation but I would guess that it is the additional
reference taken out by the system when a file system registers. Because
of this, unloading of a file system is not supported under Windows.
I suppose a follow on question to this would be, why are you trying to
stop the workstation service? This is a system service and should not be
messed with or unexpected results will be encountered.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
> I suppose a follow on question to this would be, why are you trying to
stop the workstation service? This is a system service and should not be
messed with or unexpected results will be encountered.
Sysprep stops the Workstation service under certain circumstances (how’s
that for arcane?) and this does indeed unload the redirector. Found this
out the hard way when I didn’t handle this so gracefully 
The details are
different for XP and Vista obviously and I don’t quite remember all of them,
I first encountered the error on XP though.
Does anyone have any clue about what could be causing this driver not to
be fully unloaded and preventing it to start again?
Here are the immediate questions that come to mind:
Is mrxsmb still loaded?
Do you have a filter driver loaded on this system? If you have a filter
loaded, does it work without your filter?
Also, is this XP or Vista?
-scott
–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com
“Peter Scott” wrote in message
news:xxxxx@ntfsd…
> George Luiz Bittencourt wrote:
>>
>> C:\development>sc query rdbss
>>
>> SERVICE_NAME: rdbss
>> TYPE : 2 FILE_SYSTEM_DRIVER
>> STATE : 1 STOPPED
>> (NOT_STOPPABLE, NOT_PAUSABLE,
>> IGNORES_SHUTDOWN)
>> WIN32_EXIT_CODE : 31 (0x1f)
>> SERVICE_EXIT_CODE : 0 (0x0)
>> CHECKPOINT : 0x0
>> WAIT_HINT : 0x0
>>
>> Does anyone have any clue about what could be causing this driver not to
>> be fully unloaded and preventing it to start again?
>> I am asking this question here because IMHO it relates to file system. I
>> know that it is not directly related to driver development, but maybe
>> someone have got this problem already.
>>
>> Thanks!
>>
>
> This is speculation but I would guess that it is the additional reference
> taken out by the system when a file system registers. Because of this,
> unloading of a file system is not supported under Windows.
>
> I suppose a follow on question to this would be, why are you trying to
> stop the workstation service? This is a system service and should not be
> messed with or unexpected results will be encountered.
>
> Pete
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com
> 866.263.9295
>