question

CukanJan-1318 avatar image
0 Votes"
CukanJan-1318 asked CukanJan-1318 edited

Sysmon v13.31 generate Windows bug check 0x00000171

Hello,
we are fully upgraded sysmon to last version 13.31. During upgrade I found out that 3 servers had problem with upgrade:

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000171 (0x000000006e737276, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000).

From mini dumps I saw that issue is related driver rspndr.sys. Mentioned servers are not clusters only standalone servers then bugcheck is surprise (https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x171--cluster-csv-clussvc-disconnect-watchdog).

I used standard steps for uninstall previous version by running command: c:\windows\sysmon64.exe -u force

I nstalled the new version of Sysmon with the new configuration by running command: sysmon64.exe -accepteula -i c:\temp\Sysmon_13.31_conf.xml

Do you know more about mentioned issue? Exist any steps how to fixed? OS is windows 2012.

Best regards

Jan

windows-sysinternals-sysmon
· 1
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CukanJan-1318 avatar image CukanJan-1318 ·

Maybe is 0x171 related CRYPTO_LIBRARY_INTERNAL_ERROR

Jan

0 Votes 0 ·

2 Answers

MatthewClairmont-9471 avatar image
0 Votes"
MatthewClairmont-9471 answered MatthewClairmont-9471 published

What version of windows server are you seeing this on?

5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CukanJan-1318 avatar image
0 Votes"
CukanJan-1318 answered CukanJan-1318 edited

190161-sysmondrv.png I added more details.

OS is Windows 2012 Standard.



sysmondrv.png (6.5 KiB)
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.