Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1003 Source: System

Error code <error code>, parameter1 <value>, parameter2 <value>, parameter3 <value>, parameter4 <value>.
The most important bit of information in the event description is the error code listed. Based on that, you can start troubleshooting this in the right direction.

Most of the problems leading to this event indicate faulty hardware, bugs in device drivers or incompatible hardware.

A troubleshooting approach from a newsgroup post: "Boot from CD to start the Recovery Console, then read setuplog.txt, and setupapi.log, to see what happens when it boots.

Another newsgroup posts suggests that this error requires the debugger to look at the parameters of the error. Usually this is some hardware driver failure. Running 'verifier' may identify it. Article ME244617 - How to Use Driver Verifier to Troubleshoot Device Drivers in Windows 2000 may help."

Error code 0000000a = "IRQL_NOT_LESS_OR_EQUAL" - The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS. For additional details see the link to Error code 0x0000000a.

Error code 00000020 = "KERNEL_APC_PENDING_DURING_EXIT" - May indicate a bug in a device driver. For additional details see the link to Error code 0x00000020.

Error code 00000050 = "PAGE_FAULT_IN_NONPAGED_AREA"  - See the link to Error code 00000050 for information about what may cause this.

Error code 0000009c = "MACHINE_CHECK_EXCEPTION" - This indicates that a fatal machine check exception has occurred. See also ME162363 and Error code 0x0000009c.

Error code 000000ce = "DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS" - This indicates that a driver failed to cancel pending operations before unloading. If the driver responsible for the error can be identified, its name is printed on the blue screen.

Error code 000000ea = "THREAD_STUCK_IN_DEVICE_DRIVER" - A device driver is spinning in an infinite loop, most likely waiting for hardware to become idle. This usually indicates problem with the hardware itself, or with the device driver programming the hardware incorrectly. In many cases this is the result of a bad video card or a bad display driver.

Error code 1000007f = "UNEXPECTED_KERNEL_MODE_TRAP_M" - The first parameter displayed on the blue screen specifies the trap number. Trap number 0x00000000, or Divide by Zero Error, may indicate memory corruption. Other hardware problems, or software failures can cause this error. See EV100084 -Interpreting a Bug Check Code - for more explanations about various trap numbers.

Error code 1000008e = "KERNEL_MODE_EXCEPTION_NOT_HANDLED_M" - Most of newsgroup comments about this error point to faulty hardware or drivers. The hardware varies from modems, video cards, USB device to memory or sound cards. Sometimes it proves to be hardware that it is not compatible with Windows XP. ME310740 gives an example of this error occuring when and old Audigy sound card driver is installed.

Error code 000000be = "ATTEMPTED_WRITE_TO_READONLY_MEMORY" - This is issued if a driver attempts to write to a read-only memory segment. If the driver responsible for the error can be identified, its name is printed on the blue screen. A faulty device driver would typically be the cause of that. Also, potential file corruption.

Error code 100000ea = "THREAD_STUCK_IN_DEVICE_DRIVER_M" - This indicates that a thread in a device driver is endlessly spinning. See the information for Error code 000000ea.

Error code 0000007F = "UNEXPECTED_KERNEL_MODE_TRAP" - From a newsgroup post: "According to ME104292, there are two known causes for this error:
- corrupt system files, especially file system files
- mismatched memory or motherboard problem
This error generally occurs during boot, with no parameters specified except the first one. Suggested troubleshooting is to run repair to check for corrupt files, then low-level hardware diagnostics (including diagnosing RAM and the motherboard)." See also the link to Error code 0x0000007F.

Error code 0x10000050 = Some information about this type of error can be found via the Error code 0x10000050 link.

Error code 0x0000004e = PFN_LIST_CORRUPT - While this error points to a corrupt memory structure, some forum posts reported this as happening when Panda Antivirus was conflicting with another antivirus program.
Error code 0x000000f7 - May indicate a problem with one of the drivers. If there was any new device installed, you may want to remove it or update its drivers.
Error code 0x00000024 - See ME910311 for a hotfix applicable to Microsoft Windows Server 2003 as well as the comments for Error code 0x00000024.
Error code 0xc0000218 -  This error may be appear due to registry failure unable to load registry hive. Perform a check disk using the chkdisk /r command.
In my case, I had this error on a Windows XP Pro SP3 system, new load, crash/blue screen several times a day, no pattern in terms of which application. Error codes included 00000019, 000000FC, 1000000A, 10000050, 1000007E, 1000007F, 1000008E, 100000BE, 100000D1 ... total of 40 codes all within 3 days! System was scanned for virus and trojans. All Windows patches applied. All drivers were updated. Unnecessary hardware removed. All boards / pins / cables were carefully reseated to make good contact. No improvement. Ran the Windows Memory Diagnostic (see EV100088) and found that one of the 2 DIMMs was marginal. Replaced the DIMM and no more crashes.

Error code 0x000000f4 and Error code 0x00000077  - This resulted in spontaneous rebooting and blue screens on SBS 2003. It was caused by a possible incompatibility between a eSATA Hard Drive attached to a PCI Express eSATA controller.  Specifically, a Fantom Drives GreenDrive II GDII1000EU 1TB External Hard Drive connected to a Rosewill RC-214 Silicon Image PCI Express External eSATA Controller Card with driver version  I had no problems with other eSATA hard drives attached to the same controller.
- Error code 000000D6 - See ME935198 for a hotfix applicable to Microsoft Windows XP.
- Error code 000000D5 - See ME935198 for a hotfix applicable to Microsoft Windows XP.
- Error code 0000007F- See ME928006 for a hotfix applicable to Microsoft Windows Server 2003.
- Error code 0x00000077 - See the link to Error code 0x00000077 for general information about this error.
- Error code 0x000000CB - See Error code 0x000000CB.
- Error code 0x000000de - See ME304208 for a possible solution.
- Error code 0000000A - See ME908369.
- Error code 000000E3 - See ME900808 for a hotfix applicable to Microsoft Windows XP.
- Error code 00000020 - See ME905539.
- Error code 0x0000009C - See ME329284, ME840551 and the link to EV100087 - Stop message 0x0000009C.
- Error code 00000019 - See ME892260 for a hotfix applicable to Microsoft Windows Server 2003.
- Error code 0x0000007E - See ME820362 for a hotfix applicable to Microsoft Windows Server 2003 and Microsoft Windows Small Business Server 2003.
- Error code 000000C2 - See ME890756 for a hotfix applicable to Microsoft Windows 2000 and Microsoft Windows Server 2003, and ME896674 for a hotfix applicable to Microsoft Windows 2000.
- Error code 0000008E - See ME894061, ME898542 and ME907966 for three hotfixes applicable to Microsoft Windows Server 2003. Also see ME903251 and ME959252 for additional information about this event.
- Error code 000000D1 - See ME892137 for a hotfix applicable to Microsoft Windows 2000, ME925922 for a hotfix applicable to Microsoft Windows XP and ME894086, ME926754 and ME931322 for three hotfixes applicable to Microsoft Windows Server 2003.
- Error code 1000007e - From a newsgroup post: "Turns out it was an errant file from the Sonic MyDVD program that I never use. I found this out because whenever it would crash to the blue screen, it mentioned the file tfsnpool.sys. I did a search for that file, checked the properties and found it was put there by Sonic and had something to do with the drive letter. So I renamed the files, which was probably taking a big chance, deleted everything Sonic related and all is well". Also check ME330182 for possible causes and a resolution.
- Error code 100000d1 - From a newsgroup post: "In the end it was the pagefile that was corrupted. I selected the no pagefile option under the performance menu in system properties, rebooted, and then recreated the pagefile".
- Error code 0x000000C4 - This problem might be happening because of Norton AntiVirus. See ME325672 for details.
We ran the free MS memory tester, and 1 stick of RAM was bad. To get the RAM tester follow the link “Windows Memory Diagnostic”.
- Error code 1000007e - This problem occurs only during the use of the CD-DVD player/burner. Microsoft's response to this error: "it's a device driver". Dell's Crash Analysis Tool says the problem is caused by tfsnifs.sys from Sonic. I have found some evidence (Google) that others have had a problem with the Sonic DLA and that by disabling DLA the crashes stop. The current driver version is 5.2 and I am using 4.88 so upgrading to the latest driver may fix this problem.
- Error code 0x000000de - Go to Services in Administrative Tools and find the "Remote Procedure Call" (RPC) service. Open it and change it from "Restart the computer" to "Restart the service". This will solve the reboot issue.
- Error code 0x00000050 = "PAGE_FAULT_IN_NONPAGED_AREA" - See ME817197, ME894278, ME897079, and ME903251.
- Error code 0x0000001E - See ME820767, ME822563, and ME898114.
- Error code 0x000000A5 - See ME831691 and the link to Error code 0x000000A5.
- Error code 0x000000d1= "DRIVER_IRQL_NOT_LESS_OR_EQUAL" - See ME837432.
- Error code 0x000000c5 = DRIVER_CORRUPTED_EXPOOL - See the link to "Error code 0x000000c5" for details on this error code.
- Error code 0x000000D5 - See ME870895 and ME870896.
- Error code 0x0000007f - See ME870908 and ME891722.
- Error code 0x0000000A - See ME897079.
- Error code 0x00000076 - See ME895473.

See EV100085 - Windows XP Stop Errors for information regarding error codes.
- Error code 0x00000050 - In my case, the error was caused by a IRQ/DMA conflict with the parallel port. The Windows-suggested configuration of LPT 1 was E/A 0278-027F, DMA 3, set to "auto" in the Bios. Setting it via Bios manually to DMA 1, E/A 0378-037F, ECP solved the problem.
- Error code 0x000000EA - If you have a video card with an Intel chipset, update to the latest drivers to resolve this problem.

- Error code 0x000000d1 - If you have installed Backup Exec 9.0 revision 4454 or Backup Exec 9.1 revision 4691, then see EV100086 - "Veritas Support Document ID: 261728" for information on resolving this problem.
- Error code 0xc0000005 = STATUS_ACCESS_VIOLATION - My computer started to reboot randomly after I installed Windows XP SP2. After searching the Web, I found this to be related to a new addition in Windows XP brought by SP2, namely Data execution prevention (DEP). If you have hardware or software that does not work properly after the installation of SP2 then deactivate DEP. You do that in the “boot.ini” file with the “/noexecute=AlwaysOff” switch. After I modified the “boot.ini” file accordingly, this problem ceased to reappear. See the link to TB457155 - Memory Protection Technologies in Microsoft Windows XP Service Pack 2 for more details on this issue.
From the net, someone mentioned setting the Virtual memory to 0, reboot and delete the pagefile.sys file. Then set the virtual memory back to normal. It worked for me. See ME255205 for information on how to delete the pagefile.sys file in Recovery Console.
If you are running on the following hardware: "HP ProLiant DL380 G3", then HP suggests that it can be solved by a BIOS update.
- Error code 0xD1 - See ME829120 for a hotfix applicable to Microsoft Windows 2000 and to Microsoft Windows XP.
On my Alienware Area 51 M laptop computer, this error was generated due to a conflict between the Linksys Wireless -G notebook adapter and the native Windows XP wireless manager. If you get this error and you have one of these cards you need to call Linksys tech support and they will walk you through installing the drivers for the card without installing the control utility, which is what conflicts with Windows XP.
See ME322205 for info on how to troubleshoot Hardware and Software Driver problems in Windows XP.
In my case, the error occurred after installing Kingston HyperX KHX3200/512 in a P4C800 and activated performance mode in BIOS. After I disabled Performance Mode, the problem disappeared.
Error code 0000007f = "UNEXPECTED_KERNEL_MODE_TRAP" - When I remote controlled a machine with Altiris Carbon Copy 5.8.410 and tried to open a shortcut on the desktop of the controlled machine it caused the machine to hang up and to reboot.

Error code 0000007f = "UNEXPECTED_KERNEL_MODE_TRAP" - This error surfaced on my machine running Windows XP Professional, SP-1. I tried the suggestion of setting the virtual memory to zero and rebooting. After logon, I recreated the page file and the problem dissapeared.
Error code 000000d1 = "DRIVER_IRQL_NOT_LESS_OR_EQUAL". A faulty device driver would typically be the cause of that. See also the comments for event id 1001 from "Save Dump".

Error code 000000c2 = "BAD_POOL_CALLER" - See ME265879 link below.
Error code 00000044 = "MULTIPLE_IRP_COMPLETE_REQUESTS" - See ME196022, ME296734 and ME294876.
In my case, this error for a motherboard using Bus Mastering and a NIC that does not support Bus Mastering. When Bus mastering is disabled from BIOS, this type of error went away.
Turned out to be BlackIce v2.9 causing blue screen.
Windows XP SP1 resolve this issue. See ME317277.
Error code 100000ea - this occurred in my case due to a faulty video card.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.