Re: MMC.exe stops responding for up to 5 minutes during AD GPO browse / edit

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Lehman's Old-time Hardware - System Administrator (sysadmin-N-O-SP-AM_at_lehmans.com)
Date: 06/22/04 

Date: Tue, 22 Jun 2004 14:35:07 -0400

I compared all of the running filter drivers on the problem server with both
VPC test servers (one SP2 upgraded to SP4 and one installed from the
original OEM SP4 CD).

The only difference that I could find is the ntfs.sys file version.

Problem server: 5.0.2195.6710 dated 12/31/79 8:00 PM
Test VPC Server 1 (SP2 -> SP4): 5.0.2195.6753 dated 5/8/01 8:00 AM
Test VPC Server 2 (SP4): 5.0.2195.6710 dated 7/14/03 8:00 AM

Both test servers do not experience the problem.

I don't know what else to do at this point, except keep trying to recreate
the problem by making a test server a similar as possible to the problem
server (except for the hardware).

-djz

"Greg Lirette [MS]" <gregoryl@online.microsoft.com> wrote in message
news:eYtWurLVEHA.1048@tk2msftngp13.phx.gbl...
> No problem I am happy to assist. I can't really comment on the price but
I
> would assume you would be charged for a server incident. I don't really
> know how we charge, folks here may know better than me.
>
> you can use winmsd as a start to checkout the file dates. MPS reports
> (downloadable from our web site) is helpful as well.
>
> If you get a case opened please reference this thread and I can assist the
> case owner as well. If you wanted to try to get a memory.dmp file I would
> take a peek if you like. If you want to ping me offline with the path to
> the dump that would be fine.
>
>
>
> "Lehman's Old-time Hardware - System Administrator"
> <sysadmin-N-O-SP-AM@lehmans.com> wrote in message
> news:uPXa05KVEHA.2816@TK2MSFTNGP11.phx.gbl...
> Thanks for all the help you have been giving!
>
> How do I go about checking if the filter drivers are up-to-date?
>
> Would I be charged for opening a case with Microsoft?
>
> Thanks,
>
> -djz
>
> "Greg Lirette [MS]" <gregoryl@online.microsoft.com> wrote in message
> news:uKdtIUKVEHA.1764@TK2MSFTNGP10.phx.gbl...
> > No problem!
> >
> > I do suspect that mmc.exe is only a victim and the real issue is
whatever
> > the root cause is of the copy operation being so slow. It would not
> > surprise me if this is caused by a filter driver. Actually with a full
> > kernel dump it should show up. I would first see if your filter drivers
> and
> > such are all up to date and perhaps disable them and see if it has an
> > impact. You may want to get a case opened with us. If you wanted to I
> > would look at a full dump of the issue.
> >
> > Info on getting a full dump is at
> > http://support.microsoft.com/?id=244139
> >
> >
> > Thanks,
> > Greg Lirette
> >
> > "Lehman's Old-time Hardware - System Administrator"
> > <sysadmin-N-O-SP-AM@lehmans.com> wrote in message
> > news:eeOcSGKVEHA.212@TK2MSFTNGP12.phx.gbl...
> > Thanks for the reply.
> >
> > I tried the copy command you suggested and it took about 3 minutes.
Kinda
> > long for a file that is less than 1 MB.
> >
> > Does this mean that the problem with the GPO MMC is simply the
> manifestation
> > of a problem that could be related to other issues with this server,
such
> as
> > random performance "issues?"
> >
> > What should I do next? Is there anything that I can do or check to help
> fix
> > resolve this problem?
> >
> > Thanks,
> >
> > -djz
> >
> > ""Greg Lirette [MSFT]"" <gregoryl@online.microsoft.com> wrote in message
> > news:lHKtBZJVEHA.2980@cpmsftngxa10.phx.gbl...
> > >
> > > Thanks, the dump was helpful in getting us further!
> > >
> > >
> > > The dump is a snap shot in time so a different dump may show a
slightly
> > > different thing. Also this wasn't a complete memory dump but rather
> only
> > > mmc.exe so I only have the data available in that processes address
> space.
> > >
> > > Gptext.dll is loaded in the mmc.exe process, it spawned a new thread
in
> > the
> > > process, and the purpose of that thread is to load the ADM template.
> That
> > > thread is supposed to signal an event that it has done its work and we
> can
> > > proceed.
> > >
> > > We wait for 250 ms and if it is not signaled we then load the wait
> cursor
> > > and wait forever for it to be signaled. That is the state of what you
> see
> > > in the interface, you are in wait mode.
> > >
> > > In the other thread we spawned we are trying to copy a file. It could
> be
> > > different depending on what you clicked on but in this particular dump
> the
> > > file name is
> > >
> > > ( I have removed your company name and replaced with MyCompany)
> > >
> > > The operation we are performing is a copy with the following
parameters
> > >
> > > Source file
> > >
> >
>
\\MyCompany.lan\SysVol\MyCompany.lan\Policies\{DD8110D3-28F1-4DCE-A19C-7BA9B
> > > 5FE601C}\Adm\conf.adm
> > >
> > > Destination file
> > > C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1\adm2.tmp
> > >
> > > If the file exists override it
> > >
> > > I suspect if you performed the following command you would see a hang
as
> > > well
> > >
> > > Copy
> > >
> >
>
\\MyCompany.lan\SysVol\MyCompany.lan\Policies\{DD8110D3-28F1-4DCE-A19C-7BA9B
> > > 5FE601C}\Adm\conf.adm C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1\adm2.tmp
> > >
> > >
> > > From this dump I cannot tell you anything beyond this because we are
> only
> > > looking at user mode space and we now transition into kernel mode to
do
> > the
> > > copy. I am not sure from the dump if we are trying to access a server
> > that
> > > is our self or if it is remote. It could be a network issue, but I
> > suspect
> > > it may be our self and that it may be a filter driver in the kernel.
> > > Either way it would be interesting to see if you can eliminate the
> mmc.exe
> > > process by using a simply copy at the command line to reproduce the
> hang.
> > >
> > > The call stack and info about the kernel transition follows:
> > >
> > > ChildEBP RetAddr Args to Child
> > > 02b9efb4 7c578328 02b9f058 80100080 02b9eff4 ntdll!NtCreateFile+0xb
> > > 02b9f050 7c58e2b9 00000000 80000000 00000001
KERNEL32!CreateFileW+0x343
> > > 02b9f650 7c58e65e 02b9fd9c 02b9f8f4 00000000
> > KERNEL32!BasepCopyFileExW+0x10c
> > > 02b9f6ac 7c59f18c 02b9fd9c 02b9f8f4 00000000 KERNEL32!CopyFileExW+0x52
> > > 02b9f6c8 6fa479b2 02b9fd9c 02b9f8f4 00000000 KERNEL32!CopyFileW+0x1c
> > > 02b9fb34 6fa47870 02b9fd9c 6becbeb8 6fa40000
> > > gptext!CPolicyComponentData::ParseTemplate+0xeb
> > > 02b9ffa8 6fa47282 6becbeb8 0001003f 7c57438b
> > > gptext!CPolicyComponentData::LoadTemplates+0x214
> > > 02b9ffb4 7c57438b 00c374d8 6becbeb8 0001003f
> > > gptext!CPolicyComponentData::LoadTemplatesThread+0x20
> > > 02b9ffec 00000000 6fa47262 00c374d8 00000000
> KERNEL32!BaseThreadStart+0x52
> > > 0:003> u ntdll!NtCreateFile ntdll!NtCreateFile+0xb
> > > ntdll!ZwCreateFile:
> > > 77f87cac b820000000 mov eax,0x20
> > > 77f87cb1 8d542404 lea edx,[esp+0x4]
> > > 77f87cb5 cd2e int 2e
> > >
> > > Thanks,
> > >
> > > Greg Lirette
> > >
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > >
> > >
> >
> >
> >
>
>
>

Relevant Pages