Win2K advance Server Crashed sporadically

This is what I got from windebug MiniDump
Please help!!!


Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini011013-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: symbols timestamp is wrong 0x45ec3c9d 0x384d9b17 for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
Machine Name:
Kernel base = 0x80400000 PsLoadedModuleList = 0x80488fa0
Debug session time: Thu Jan 10 18:17:08.918 2013 (GMT-8)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: symbols timestamp is wrong 0x45ec3c9d 0x384d9b17 for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
........................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {9dabc104, 2, 1, 8045ed5e}

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt!_woutput+c9 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9dabc104, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8045ed5e, address which referenced memory

Debugging Details:
------------------

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

WRITE_ADDRESS: unable to read from 8047edb4
unable to read from 8047e864
unable to read from 8047e738
unable to read from 8046a85c
unable to read from 8047e750
unable to read from 8047e860
unable to read from 80471038
unable to read from 8047e8dc
unable to read from 8047ed80
9dabc104

CURRENT_IRQL: 2

FAULTING_IP:
nt!_woutput+c9
8045ed5e ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 00000000 to 8046e15c

STACK_TEXT:
ebc83bc4 00000000 9dabc104 00000002 00000001 nt!KiDoubleFaultStack+0x111c


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!_woutput+c9
8045ed5e ?? ???

SYMBOL_NAME: nt!_woutput+c9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c9d

FAILURE_BUCKET_ID: 0xA_nt!_woutput+c9

BUCKET_ID: 0xA_nt!_woutput+c9

Followup: MachineOwner
---------

That bugcheck has to do with either a faulty driver, service, or incorrect BIOS settings.

Have you updated anything recently or installed any new programs?

Start by checking event logs around the time of the restart to see if any device drivers or services are showing errors. This will typically begin pointing you in the right direction. You should also check to see if Windows Update has installed any new updates recently. (Not likely the case given the age of your system.)

I would also restart your system and watch the BIOS message or enter CMOS setup to see if your BIOS has the correct time and date. If not, this could indicate a failing CMOS battery that has allowed your BIOS settings to revert to system defaults.

If you haven't updated anything or installed any programs, and none of the above show anything, then you should test your RAM and hard drive. Inability to write to the page file can also cause this error under very specific circumstances. Again, given the age of the system, I would not rule out hardware failure as a possibility.

by the way, I have replaced all new FB-RAM already and still experiencing crashed.

Thanks a quick replied.

Unfortunately, I started to work here about a month and all events has been cleared out.
I will check bios the next time I restart the server. As for right now, there are lot of clients on it.

The drives are set at RAID 1, so if I want to replace both drive, should I just hot swap by pulling out Drive 1 then putting in the drive new drive in and wait till the mirror is done then do the same to drive 0?

That's typically the easiest way. But I wouldn't hot swap unless you have hot swappable hardware. Otherwise, shut it down while removing and replacing drives.

Since your are using RAID, I would check the RAID controller before the drives. It's the more likely culprit.

I noticed on every event that recorded server restarted unexpectedly, and, there's always an event network load balance created id..
So I unteam the network cards and will see how that go.

Thanks for you help. I will report back if no crash for a week or so..

Maybe it's time for a server upgrade. W2K server extended support ended in 2010 afaik.

Thank you all for your time.

I think I solved the problem. So far no crash for a whole 7 days straight after I broke the Intel NIC TEAMING.

Great! Thanks for posting back to let us know.