question

MattClitherow-7813 avatar image
0 Votes"
MattClitherow-7813 asked ·

KMODE_EXCEPTION_NOT_HANDLED - Windows 10 Laptop - mrxsmb20.sys

Hi,

I've got a colleague who's laptop has been experiencing regular KMODE_EXCEPTION_NOT_HANDLED crashes when working remotely over our company VPN.

All of the MiniDumps have pointed to mrxsmb20.sys being the problem, in combination with EXCEL.EXE. The laptop is running 19041 (May 2020) of Windows 10 Professional.

The end user works primarily on several linked Excel documents stored on the Company's storage that they connect to over VPN

I've already completely reinstalled Windows from scratch (blank setup downloaded from MS, not a reset to the OEM install) and the problem still exists.

Could it be a hardware issue? Or is it a flaw/bug when working with Linked documents over a VPN connection?

Thanks,

Matt

windows-10-generalwindows-10-networkwindows-10-hardware-performance
· 1
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @MattClitherow-7813,

There were no non-Microsoft drivers on the stack at the time of the crash, but one of the loaded drivers (that might have modified data structures before the crash) was SophosED.sys (Sophos Endpoint Defense).

Here are two suggestions:

  1. As a trial and error measure, just uninstall Sophos and check whether the problem persists.

  2. If the know-how is available, use Event Tracing for Windows (ETW) to trace the SMB activity prior to the crash and configure the problem system to create a bigger crash dump (anything other than just a minidump) so that the ETW data that has not been flushed to disk at the time of the crash can be extracted from the crash dump.

Gary



1 Vote 1 ·
Reza-Ameri avatar image
0 Votes"
Reza-Ameri answered ·

Try update Windows and Microsoft Excel.
Take a look at:
https://support.microsoft.com/en-us/sbs/windows/troubleshoot-blue-screen-errors-5c62726c-6489-52da-a372-3f73142c14ad
You may open start and search for feedback and open the Feedback Hub app and report this issue and you may share dump files and all relevant log files there.

· Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CandyLuo-MSFT avatar image
0 Votes"
CandyLuo-MSFT answered ·

Hi Matt,

Note: since this is a public forum, everyone could view your information, please remove private log information that might leak your privacy.

Please understand, analysis of dump file is beyond our forum support level and due to forum security policy, we have no such channel to collect user log information. So we recommend you open a case with MS Professional tech support service, they will help you open a phone or email case to Microsoft, so that you would get a technical support on a one-to-one basis while ensuring private information.

Here is the link:

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Best Regards,

Candy


If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.