T
tomaddison48
Whilst I'm unsure if this is specific to RDP or 2016, here is my issue
Throughout the day, our users experience random freezing of application loads. They'll try to start, say, iexplore.exe, and nothing happens. Any subsequent attempts to start a) our in-house applications, or b) even things like file explorer (to open a network drive), all stack up and hang until whatever is causing an issue is over, and subsequently started processes then all kick in, and it's fine again.
When I get reports of this, iexplore.exe is always one I can run and see the problem for myself, so on that basis, I proceeded to catch an occasion the issue was there, and I started iexplore.exe - and of course nothing loads
Using windbg, I opened a DMP file I created, the results of which are below. This seems to recognise that there is an application hang (the DMP file was created 40+ seconds after I first started the process) and points to a couple of things, but none of which I can find concrete information on when searching around. Are we missing something? Is this some form of new bug in 2016 that hasn't yet been seen?
We're on Windows Server 2016 Standard, Version 1607, OS Build 14393.2580.
Machine is a machine running atop VMware ESXi 6.7, with 24GB RAM (only 16GB being used maximum), and 4 x vCPU
Any assistance would be greatly appreciated
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\x64\FULLDUMP_HangMode_iexplore.exe__23ec_2019-09-18_14-50-37-943_1e20.dmp]
User Mini Dump File with Full Memory: Only application data is available
Comment: 'HangMode'
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 14393 MP (4 procs) Free x64
Product: Server, suite: TerminalServer
14393.2580.amd64fre.rs1_release_inmarket.181009-1745
Machine Name:
Debug session time: Wed Sep 18 14:50:38.000 2019 (UTC + 1:00)
System Uptime: 0 days 11:34:53.379
Process Uptime: 0 days 0:00:44.000
................................................................
............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(1e20.5f14): Wake debugger - code 80000007 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtFsControlFile+0x14:
00007ffd`45bd6224 c3 ret
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
KEY_VALUES_STRING: 1
Key : Timeline.OS.Boot.DeltaSec
Value: 41693
Key : Timeline.Process.Start.DeltaSec
Value: 44
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
Timeline: !analyze.Start
Name: <blank>
Time: 2019-09-18T13:57:15.234Z
Diff: 397234 mSec
Timeline: Dump.Current
Name: <blank>
Time: 2019-09-18T13:50:38.0Z
Diff: 0 mSec
Timeline: Process.Start
Name: <blank>
Time: 2019-09-18T13:49:54.0Z
Diff: 44000 mSec
Timeline: OS.Boot
Name: <blank>
Time: 2019-09-18T02:15:45.0Z
Diff: 41693000 mSec
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000000000039 rbx=000001a95ef01ba0 rcx=0000000000000404
rdx=0000000000000000 rsi=00000000000003e8 rdi=000000000000001a
rip=00007ffd45bd6224 rsp=00000090e0efc7a8 rbp=00000090e0efc859
r8=00000090e0efc7a8 r9=00000090e0efc859 r10=0000000000000000
r11=0000000000000246 r12=0000000000000020 r13=0000000040160000
r14=0000000000000000 r15=000000000000005c
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtFsControlFile+0x14:
00007ffd`45bd6224 c3 ret
Resetting default scope
FAULTING_IP:
+0
00000000`00000000 ?? ???
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000000000000
ExceptionCode: 80000007 (Wake debugger)
ExceptionFlags: 00000000
NumberParameters: 0
BUGCHECK_STR: 80000007
DEFAULT_BUCKET_ID: APPLICATION_HANG
PROCESS_NAME: iexplore.exe
ERROR_CODE: (NTSTATUS) 0x80000007 - {Kernel Debugger Awakened} the system debugger was awakened by an interrupt.
EXCEPTION_CODE: (HRESULT) 0x80000007 (2147483655) - Operation aborted
EXCEPTION_CODE_STR: 80000007
WATSON_BKT_PROCSTAMP: 5a49bbbb
WATSON_BKT_PROCVER: 11.0.14393.2007
PROCESS_VER_PRODUCT: Internet Explorer
WATSON_BKT_MODULE: unknown
WATSON_BKT_MODVER: 0.0.0.0
WATSON_BKT_MODOFFSET: 0
WATSON_BKT_MODSTAMP: bbbbbbb4
BUILD_VERSION_STRING: 14393.2580.amd64fre.rs1_release_inmarket.181009-1745
MODLIST_WITH_TSCHKSUM_HASH: 53ef4a9b0c0845c0fce6db6db2bf5320e828e77d
MODLIST_SHA1_HASH: d4a4614b218d997e9fe09f5b48a562bbdd4c8de9
COMMENT: HangMode
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
PRODUCT_TYPE: 3
SUITE_MASK: 16
DUMP_FLAGS: 8000c07
DUMP_TYPE: 3
ANALYSIS_SESSION_HOST: UK-C2TS3
ANALYSIS_SESSION_TIME: 09-18-2019 14:57:15.0234
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
DERIVED_WAIT_CHAIN: 00 1e20.5f14 Unknown
WAIT_CHAIN_COMMAND: ~0s;k;;
THREAD_ATTRIBUTES:
BLOCKING_THREAD: 0000000000005f14
THREAD_SHA1_HASH_MOD_FUNC: 0ce34443f5fe47a68f7564d7d3ee2d7cd77118a3
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 754de7f7e3f522ff52a463f11ae4ca0a103f1c9a
LAST_CONTROL_TRANSFER: from 00007ffd420889c1 to 00007ffd45bd6224
FAULTING_THREAD: 00005f14
STACK_TEXT:
00000090`e0efc7a8 00007ffd`420889c1 : 00000090`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtFsControlFile+0x14
00000090`e0efc7b0 00007ffd`433b0b95 : 00000000`000000e7 000001a9`5eeca1f8 00000000`00000404 00007ffd`433fe4fc : KERNELBASE!WaitNamedPipeW+0x1e1
00000090`e0efc8c0 00007ffd`43370fd6 : 00000000`00000000 000001a9`5ee74720 000001a9`5ee991e0 00000000`00000000 : rpcrt4!RpcAsyncRegisterInfo+0x28455
00000090`e0efc9a0 00007ffd`4337077e : 00000000`00000000 000001a9`5eeca020 00000090`e0efca90 00007ffd`433753c0 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x26f6
00000090`e0efca40 00007ffd`43372eee : 000001a9`5eeca490 000001a9`5eec90a0 00000000`00000000 000001a9`5eec9f88 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x1e9e
00000090`e0efcaf0 00007ffd`43373891 : 000001a9`5eec9ed0 00000000`00000001 000001a9`5eec90a0 000001a9`5eec90f0 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x460e
00000090`e0efcb90 00007ffd`43373afb : 00000000`00000000 00000090`e0efccf0 000001a9`5eec9158 000001a9`00000000 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x4fb1
00000090`e0efcbf0 00007ffd`43373c4f : 00000000`00000000 000001a9`5ee30000 00000000`00000000 00007ffd`43329ecc : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x521b
00000090`e0efcd40 00007ffd`433e83a4 : 00000090`e0efd1d0 00000000`00000000 000001a9`5eeca490 000001a9`5ee60000 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x536f
00000090`e0efcd90 00007ffd`433e5102 : 00007ffd`3e75b130 00000000`00000014 00000000`00000000 00000000`00000000 : rpcrt4!Ndr64AsyncServerCallAll+0x1d94
00000090`e0efd1a0 00007ffd`3e75173a : 00000090`e0efd570 00007ffd`3b67fc42 00000000`00000000 00000000`00000000 : rpcrt4!NdrClientCall3+0xf2
00000090`e0efd530 00007ffd`2570d5fe : 00007ffd`25c10098 00000000`0000000f 000021d8`00000004 00000000`00000000 : wkscli!NetGetJoinInformation+0x7a
00000090`e0efd5e0 00007ffd`2570d4b8 : 00000000`00000000 00007ffd`45b38190 0000457f`0fbaaddc 000001a9`5ee62610 : ieframe!Ordinal222+0x347ae
00000090`e0efd610 00007ffd`2570d44d : 000001a9`5ee62610 00000000`00000114 0000457f`0fbaaf3c 00007ffd`42045e92 : ieframe!Ordinal222+0x34668
00000090`e0efd640 00007ffd`2570d02f : 00000000`00000000 00000000`00000000 00000090`e0efd708 000001a9`5ee62610 : ieframe!Ordinal222+0x345fd
00000090`e0efd670 00007ffd`2570cff0 : 00000000`00000001 00000000`00000001 00000000`00000000 000001a9`5ee60000 : ieframe!Ordinal222+0x341df
00000090`e0efd6a0 00007ffd`2570c826 : 00000000`00000001 00000090`00012401 00000000`00000000 000001a9`5ee62610 : ieframe!Ordinal222+0x341a0
00000090`e0efd6d0 00007ffd`2570d886 : 00000000`00000001 00000000`00000001 00000000`00000000 000001a9`5eec6490 : ieframe!Ordinal222+0x339d6
00000090`e0efe800 00007ffd`2570dad0 : 127b82db`00000005 00000000`00000000 00000090`e0effa00 000001a9`5ee69580 : ieframe!Ordinal222+0x34a36
00000090`e0efe840 00007ffd`2572696c : 000001a9`5ee62610 000001a9`5ee62610 000001a9`5ee69580 00000000`00000001 : ieframe!Ordinal222+0x34c80
00000090`e0eff900 00007ffd`2570e039 : 00000000`00000000 000001a9`5ee69580 00000000`00000000 000001a9`5ee69580 : ieframe!Ordinal101+0x1ac
00000090`e0effb80 00007ffd`25798faf : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000000 : ieframe!Ordinal222+0x351e9
00000090`e0effc20 00007ff6`fc5b14e9 : 000001a9`5ee69580 00000000`00000001 00000000`00000001 00000000`00000000 : ieframe!Ordinal255+0x2f
00000090`e0effc50 00007ff6`fc5b1d77 : 00000000`00000001 00000000`00000000 00000000`0000001f 00000000`00000000 : iexplore+0x14e9
00000090`e0effe70 00007ffd`44148364 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : iexplore+0x1d77
00000090`e0efff30 00007ffd`45b9e851 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
00000090`e0efff60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
STACK_COMMAND: ~0s ; .cxr ; kb
THREAD_SHA1_HASH_MOD: 04bd420e3e7dfb25d20760fb925c686c8f86ace1
FOLLOWUP_IP:
wkscli!NetGetJoinInformation+7a
00007ffd`3e75173a 4889442460 mov qword ptr [rsp+60h],rax
FAULT_INSTR_CODE: 24448948
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: wkscli!NetGetJoinInformation+7a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: wkscli
IMAGE_NAME: wkscli.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 57899b4e
BUCKET_ID: 80000007_wkscli!NetGetJoinInformation+7a
PRIMARY_PROBLEM_CLASS: 80000007_wkscli!NetGetJoinInformation+7a
FAILURE_EXCEPTION_CODE: 80000007
FAILURE_IMAGE_NAME: wkscli.dll
BUCKET_ID_IMAGE_STR: wkscli.dll
FAILURE_MODULE_NAME: wkscli
BUCKET_ID_MODULE_STR: wkscli
FAILURE_FUNCTION_NAME: NetGetJoinInformation
BUCKET_ID_FUNCTION_STR: NetGetJoinInformation
BUCKET_ID_OFFSET: 7a
BUCKET_ID_MODTIMEDATESTAMP: 57899b4e
BUCKET_ID_MODCHECKSUM: 1e8d6
BUCKET_ID_MODVER_STR: 10.0.14393.0
BUCKET_ID_PREFIX_STR: 80000007_
FAILURE_PROBLEM_CLASS: 80000007_wkscli!NetGetJoinInformation+7a
FAILURE_SYMBOL_NAME: wkscli.dll!NetGetJoinInformation
FAILURE_BUCKET_ID: APPLICATION_HANG_80000007_wkscli.dll!NetGetJoinInformation
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOn...0.0/bbbbbbb4/80000007/00000000.htm?Retriage=1
TARGET_TIME: 2019-09-18T13:50:38.000Z
OSBUILD: 14393
OSSERVICEPACK: 2214
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-04-03 04:45:42
BUILDDATESTAMP_STR: 181009-1745
BUILDLAB_STR: rs1_release_inmarket
BUILDOSVER_STR: 10.0.14393.2580.amd64fre.rs1_release_inmarket.181009-1745
ANALYSIS_SESSION_ELAPSED_TIME: 39d8
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:application_hang_80000007_wkscli.dll!netgetjoininformation
FAILURE_ID_HASH: {4a9f3d44-4a90-42ca-4be0-988b476cc6c5}
Followup: MachineOwner
---------
Continue reading...
Throughout the day, our users experience random freezing of application loads. They'll try to start, say, iexplore.exe, and nothing happens. Any subsequent attempts to start a) our in-house applications, or b) even things like file explorer (to open a network drive), all stack up and hang until whatever is causing an issue is over, and subsequently started processes then all kick in, and it's fine again.
When I get reports of this, iexplore.exe is always one I can run and see the problem for myself, so on that basis, I proceeded to catch an occasion the issue was there, and I started iexplore.exe - and of course nothing loads
Using windbg, I opened a DMP file I created, the results of which are below. This seems to recognise that there is an application hang (the DMP file was created 40+ seconds after I first started the process) and points to a couple of things, but none of which I can find concrete information on when searching around. Are we missing something? Is this some form of new bug in 2016 that hasn't yet been seen?
We're on Windows Server 2016 Standard, Version 1607, OS Build 14393.2580.
Machine is a machine running atop VMware ESXi 6.7, with 24GB RAM (only 16GB being used maximum), and 4 x vCPU
Any assistance would be greatly appreciated
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\x64\FULLDUMP_HangMode_iexplore.exe__23ec_2019-09-18_14-50-37-943_1e20.dmp]
User Mini Dump File with Full Memory: Only application data is available
Comment: 'HangMode'
Symbol search path is: srv*
Executable search path is:
Windows 10 Version 14393 MP (4 procs) Free x64
Product: Server, suite: TerminalServer
14393.2580.amd64fre.rs1_release_inmarket.181009-1745
Machine Name:
Debug session time: Wed Sep 18 14:50:38.000 2019 (UTC + 1:00)
System Uptime: 0 days 11:34:53.379
Process Uptime: 0 days 0:00:44.000
................................................................
............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(1e20.5f14): Wake debugger - code 80000007 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtFsControlFile+0x14:
00007ffd`45bd6224 c3 ret
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
KEY_VALUES_STRING: 1
Key : Timeline.OS.Boot.DeltaSec
Value: 41693
Key : Timeline.Process.Start.DeltaSec
Value: 44
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
Timeline: !analyze.Start
Name: <blank>
Time: 2019-09-18T13:57:15.234Z
Diff: 397234 mSec
Timeline: Dump.Current
Name: <blank>
Time: 2019-09-18T13:50:38.0Z
Diff: 0 mSec
Timeline: Process.Start
Name: <blank>
Time: 2019-09-18T13:49:54.0Z
Diff: 44000 mSec
Timeline: OS.Boot
Name: <blank>
Time: 2019-09-18T02:15:45.0Z
Diff: 41693000 mSec
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000000000039 rbx=000001a95ef01ba0 rcx=0000000000000404
rdx=0000000000000000 rsi=00000000000003e8 rdi=000000000000001a
rip=00007ffd45bd6224 rsp=00000090e0efc7a8 rbp=00000090e0efc859
r8=00000090e0efc7a8 r9=00000090e0efc859 r10=0000000000000000
r11=0000000000000246 r12=0000000000000020 r13=0000000040160000
r14=0000000000000000 r15=000000000000005c
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtFsControlFile+0x14:
00007ffd`45bd6224 c3 ret
Resetting default scope
FAULTING_IP:
+0
00000000`00000000 ?? ???
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000000000000
ExceptionCode: 80000007 (Wake debugger)
ExceptionFlags: 00000000
NumberParameters: 0
BUGCHECK_STR: 80000007
DEFAULT_BUCKET_ID: APPLICATION_HANG
PROCESS_NAME: iexplore.exe
ERROR_CODE: (NTSTATUS) 0x80000007 - {Kernel Debugger Awakened} the system debugger was awakened by an interrupt.
EXCEPTION_CODE: (HRESULT) 0x80000007 (2147483655) - Operation aborted
EXCEPTION_CODE_STR: 80000007
WATSON_BKT_PROCSTAMP: 5a49bbbb
WATSON_BKT_PROCVER: 11.0.14393.2007
PROCESS_VER_PRODUCT: Internet Explorer
WATSON_BKT_MODULE: unknown
WATSON_BKT_MODVER: 0.0.0.0
WATSON_BKT_MODOFFSET: 0
WATSON_BKT_MODSTAMP: bbbbbbb4
BUILD_VERSION_STRING: 14393.2580.amd64fre.rs1_release_inmarket.181009-1745
MODLIST_WITH_TSCHKSUM_HASH: 53ef4a9b0c0845c0fce6db6db2bf5320e828e77d
MODLIST_SHA1_HASH: d4a4614b218d997e9fe09f5b48a562bbdd4c8de9
COMMENT: HangMode
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
PRODUCT_TYPE: 3
SUITE_MASK: 16
DUMP_FLAGS: 8000c07
DUMP_TYPE: 3
ANALYSIS_SESSION_HOST: UK-C2TS3
ANALYSIS_SESSION_TIME: 09-18-2019 14:57:15.0234
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
DERIVED_WAIT_CHAIN: 00 1e20.5f14 Unknown
WAIT_CHAIN_COMMAND: ~0s;k;;
THREAD_ATTRIBUTES:
BLOCKING_THREAD: 0000000000005f14
THREAD_SHA1_HASH_MOD_FUNC: 0ce34443f5fe47a68f7564d7d3ee2d7cd77118a3
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 754de7f7e3f522ff52a463f11ae4ca0a103f1c9a
LAST_CONTROL_TRANSFER: from 00007ffd420889c1 to 00007ffd45bd6224
FAULTING_THREAD: 00005f14
STACK_TEXT:
00000090`e0efc7a8 00007ffd`420889c1 : 00000090`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtFsControlFile+0x14
00000090`e0efc7b0 00007ffd`433b0b95 : 00000000`000000e7 000001a9`5eeca1f8 00000000`00000404 00007ffd`433fe4fc : KERNELBASE!WaitNamedPipeW+0x1e1
00000090`e0efc8c0 00007ffd`43370fd6 : 00000000`00000000 000001a9`5ee74720 000001a9`5ee991e0 00000000`00000000 : rpcrt4!RpcAsyncRegisterInfo+0x28455
00000090`e0efc9a0 00007ffd`4337077e : 00000000`00000000 000001a9`5eeca020 00000090`e0efca90 00007ffd`433753c0 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x26f6
00000090`e0efca40 00007ffd`43372eee : 000001a9`5eeca490 000001a9`5eec90a0 00000000`00000000 000001a9`5eec9f88 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x1e9e
00000090`e0efcaf0 00007ffd`43373891 : 000001a9`5eec9ed0 00000000`00000001 000001a9`5eec90a0 000001a9`5eec90f0 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x460e
00000090`e0efcb90 00007ffd`43373afb : 00000000`00000000 00000090`e0efccf0 000001a9`5eec9158 000001a9`00000000 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x4fb1
00000090`e0efcbf0 00007ffd`43373c4f : 00000000`00000000 000001a9`5ee30000 00000000`00000000 00007ffd`43329ecc : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x521b
00000090`e0efcd40 00007ffd`433e83a4 : 00000090`e0efd1d0 00000000`00000000 000001a9`5eeca490 000001a9`5ee60000 : rpcrt4!I_RpcTransGetThreadEventThreadOptional+0x536f
00000090`e0efcd90 00007ffd`433e5102 : 00007ffd`3e75b130 00000000`00000014 00000000`00000000 00000000`00000000 : rpcrt4!Ndr64AsyncServerCallAll+0x1d94
00000090`e0efd1a0 00007ffd`3e75173a : 00000090`e0efd570 00007ffd`3b67fc42 00000000`00000000 00000000`00000000 : rpcrt4!NdrClientCall3+0xf2
00000090`e0efd530 00007ffd`2570d5fe : 00007ffd`25c10098 00000000`0000000f 000021d8`00000004 00000000`00000000 : wkscli!NetGetJoinInformation+0x7a
00000090`e0efd5e0 00007ffd`2570d4b8 : 00000000`00000000 00007ffd`45b38190 0000457f`0fbaaddc 000001a9`5ee62610 : ieframe!Ordinal222+0x347ae
00000090`e0efd610 00007ffd`2570d44d : 000001a9`5ee62610 00000000`00000114 0000457f`0fbaaf3c 00007ffd`42045e92 : ieframe!Ordinal222+0x34668
00000090`e0efd640 00007ffd`2570d02f : 00000000`00000000 00000000`00000000 00000090`e0efd708 000001a9`5ee62610 : ieframe!Ordinal222+0x345fd
00000090`e0efd670 00007ffd`2570cff0 : 00000000`00000001 00000000`00000001 00000000`00000000 000001a9`5ee60000 : ieframe!Ordinal222+0x341df
00000090`e0efd6a0 00007ffd`2570c826 : 00000000`00000001 00000090`00012401 00000000`00000000 000001a9`5ee62610 : ieframe!Ordinal222+0x341a0
00000090`e0efd6d0 00007ffd`2570d886 : 00000000`00000001 00000000`00000001 00000000`00000000 000001a9`5eec6490 : ieframe!Ordinal222+0x339d6
00000090`e0efe800 00007ffd`2570dad0 : 127b82db`00000005 00000000`00000000 00000090`e0effa00 000001a9`5ee69580 : ieframe!Ordinal222+0x34a36
00000090`e0efe840 00007ffd`2572696c : 000001a9`5ee62610 000001a9`5ee62610 000001a9`5ee69580 00000000`00000001 : ieframe!Ordinal222+0x34c80
00000090`e0eff900 00007ffd`2570e039 : 00000000`00000000 000001a9`5ee69580 00000000`00000000 000001a9`5ee69580 : ieframe!Ordinal101+0x1ac
00000090`e0effb80 00007ffd`25798faf : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000000 : ieframe!Ordinal222+0x351e9
00000090`e0effc20 00007ff6`fc5b14e9 : 000001a9`5ee69580 00000000`00000001 00000000`00000001 00000000`00000000 : ieframe!Ordinal255+0x2f
00000090`e0effc50 00007ff6`fc5b1d77 : 00000000`00000001 00000000`00000000 00000000`0000001f 00000000`00000000 : iexplore+0x14e9
00000090`e0effe70 00007ffd`44148364 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : iexplore+0x1d77
00000090`e0efff30 00007ffd`45b9e851 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
00000090`e0efff60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
STACK_COMMAND: ~0s ; .cxr ; kb
THREAD_SHA1_HASH_MOD: 04bd420e3e7dfb25d20760fb925c686c8f86ace1
FOLLOWUP_IP:
wkscli!NetGetJoinInformation+7a
00007ffd`3e75173a 4889442460 mov qword ptr [rsp+60h],rax
FAULT_INSTR_CODE: 24448948
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: wkscli!NetGetJoinInformation+7a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: wkscli
IMAGE_NAME: wkscli.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 57899b4e
BUCKET_ID: 80000007_wkscli!NetGetJoinInformation+7a
PRIMARY_PROBLEM_CLASS: 80000007_wkscli!NetGetJoinInformation+7a
FAILURE_EXCEPTION_CODE: 80000007
FAILURE_IMAGE_NAME: wkscli.dll
BUCKET_ID_IMAGE_STR: wkscli.dll
FAILURE_MODULE_NAME: wkscli
BUCKET_ID_MODULE_STR: wkscli
FAILURE_FUNCTION_NAME: NetGetJoinInformation
BUCKET_ID_FUNCTION_STR: NetGetJoinInformation
BUCKET_ID_OFFSET: 7a
BUCKET_ID_MODTIMEDATESTAMP: 57899b4e
BUCKET_ID_MODCHECKSUM: 1e8d6
BUCKET_ID_MODVER_STR: 10.0.14393.0
BUCKET_ID_PREFIX_STR: 80000007_
FAILURE_PROBLEM_CLASS: 80000007_wkscli!NetGetJoinInformation+7a
FAILURE_SYMBOL_NAME: wkscli.dll!NetGetJoinInformation
FAILURE_BUCKET_ID: APPLICATION_HANG_80000007_wkscli.dll!NetGetJoinInformation
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOn...0.0/bbbbbbb4/80000007/00000000.htm?Retriage=1
TARGET_TIME: 2019-09-18T13:50:38.000Z
OSBUILD: 14393
OSSERVICEPACK: 2214
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-04-03 04:45:42
BUILDDATESTAMP_STR: 181009-1745
BUILDLAB_STR: rs1_release_inmarket
BUILDOSVER_STR: 10.0.14393.2580.amd64fre.rs1_release_inmarket.181009-1745
ANALYSIS_SESSION_ELAPSED_TIME: 39d8
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:application_hang_80000007_wkscli.dll!netgetjoininformation
FAILURE_ID_HASH: {4a9f3d44-4a90-42ca-4be0-988b476cc6c5}
Followup: MachineOwner
---------
Continue reading...