Blue screen errors on a target file server after installing the Enterprise Vault (EV) File System Archiving (FSA) Agent.
Problem
After installing the FSA agent on a target file server the server experiences a blue screen.
Uninstalling the FSA Agent will make the server operational again.
Error Message
An analysis of the memory dump file may show the following:
STACK_TEXT:
fffff880`02199ae8 fffff800`02068fcc : 00000000`00000018 00000000`00000000 fffffa80`ff886720 00000000`00000002 : nt!KeBugCheckEx
fffff880`02199af0 fffff880`06f63f4e : 00000000`00000003 00000000`c000000d fffffa80`c8a29110 fffffa80`c8a29110 : nt! ?? ::FNODOBFM::`string'+0x462d1
fffff880`02199b50 fffff880`01398f13 : 00000000`00000000 00000000`00000000 fffffa80`c8a29110 fffffa80`ff886720 : evmf!EvWorkerGetDosVolumeName+0x476 [v:\redistributables\intel\filesystemfilter\evminifilter\source\src\evmf_init.c @ 3119]
fffff880`02199c70 fffff800`020de7e1 : fffff880`01398ed0 fffff800`022765a0 fffffa80`c1505040 00000000`00003000 : fltmgr!FltpProcessGenericWorkItem+0x43
fffff880`02199cb0 fffff800`023716fa : 00000000`00000000 fffffa80`c1505040 00000000`00000080 fffffa80`c14f8840 : nt!ExpWorkerThread+0x111
fffff880`02199d40 fffff800`020afb46 : fffff880`01fb0180 fffffa80`c1505040 fffff880`01fbb0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02199d80 00000000`00000000 : fffff880`0219a000 fffff880`02194000 fffff880`021998d0 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_NAME: evmf!EvWorkerGetDosVolumeName+476
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: evmf
IMAGE_NAME: evmf.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ebd8e56
FAILURE_BUCKET_ID: X64_0x18_OVER_DEREFERENCE_evmf!EvWorkerGetDosVolumeName+476
BUCKET_ID: X64_0x18_OVER_DEREFERENCE_evmf!EvWorkerGetDosVolumeName+476
Solution
Implementation of the following registry key on the target file server where the FSA agent is installed has proven to work around this issue.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EvFilter\
DWORD value
Enter the name as IncrementVPBCount
Set the value as 1
Applies To
Windows 2008 R2 x64