If your WDS service unexpected restarts and you have multiple routers with ip helpers defined, the following problem can occure:
- Multiple router forward the same request to the WDS server
- The WDS starts a threads per request
- This threads access the same object at the same time
Error in Eventlog:
Faulting application name: svchost.exe_WDSServer, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000374
Fault offset: 0x00000000000c40f2
Faulting process id: 0x2208
Faulting application start time: 0x01cd81369133c89b
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: e2bc5c7e-ed29-11e1-89cc-2c768a4f3cc8
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000374
Fault offset: 0x00000000000c40f2
Faulting process id: 0x2208
Faulting application start time: 0x01cd81369133c89b
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: e2bc5c7e-ed29-11e1-89cc-2c768a4f3cc8
And
Faulting application name: svchost.exe_WDSServer, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: smspxe.dll, version: 5.0.7711.0, time stamp: 0x4f4306fd
Exception code: 0xc0000005
Fault offset: 0x00000000000392eb
Faulting process id: 0x1e44
Faulting application start time: 0x01cd812981f4788f
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: D:\Program Files\Microsoft Configuration Manager\bin\x64\smspxe.dll
Report Id: f47fe7e4-ed1c-11e1-861a-2c768a4f3cc8
Resolution
This Problem can be solved with restricting wds to use only one thread.
SCCM 2007
HKLM\Software\Microsoft\SMS\PXE\NumberOfThreads and set it to 1
SCCM 2012
HKLM\Software\Microsoft\SMS\DP\NumberOfThreads mit den Wert 1
Principal Security Consultant | MVP at baseVISION AG
I’m a consultant, trainer and architect for modern workplace and enterprise mobility projects with Microsoft Technologies in the past ten years. I love to push and design the modern workplace based on Microsoft 365 for my customers which is the only answer for the current security threats, agile world and the fast-changing business requirements of my customers. Important for me is to simplify and automate the operational processes, because there are the highest costs.
Latest posts by Thomas Kurth (see all)
- Microsoft Sentinel ASIM Parser demystified - March 31, 2024
- Enhancing Network Security Insights with IDS/IPS of Ubiquiti Dream Machine Pro and Microsoft Sentinel - March 10, 2024
- Ubiquiti Dream Machine Pro Logs to Microsoft Sentinel - February 6, 2024
1 Comment
Eve · July 27, 2016 at 04:10
Thanks for sharing. Your post is a useful cootnibutirn.