Dump
Name: systemsettings.exe_170801_094202.dmp
Computer
Name: P974522
Windows 10 Version
15063 MP (4 procs) Free x64
Product: WinNt,
suite: SingleUserTS
15063.0.amd64fre.rs2_release.170317-1834
Debug session time:
Tue Aug 1 10:42:02.000 2017 (UTC - 4:00)
System
Uptime: 3 days 23:01:11.214
Process
Uptime: 0 days 0:00:02.000
Kernel time: 0 days 0:00:00.000
User time: 0 days 0:00:00.000
User
Name: H93
PID:
0x2698 = 0n9880
Comment:
'
***
"C:\Users\H93\Desktop\Procdump\procdump.exe" -accepteula -ma -j
"C:\Dumps" 9880 360 00000284D63B0000
***
Just-In-Time debugger. PID: 9880 Event Handle: 360 JIT Context: .jdinfo
0x284d63b0000'
User
Mini Dump File with Full Memory: Only application data is available.
CONTEXT:
(.ecxr)
rax=00000000ffffffff rbx=00000284d5b0b930
rcx=00000284d86188f8
rdx=0000000000000020
rsi=0000000000000000 rdi=ffffffffffffffff
rip=00007ff9d86f8a3f
rsp=000000cda4efe270 rbp=000000cda4efe2c0
r8=0000000000000000
r9=0000000000000006 r10=00000fff44e562aa
r11=0451044040040500
r12=0000000000000000 r13=000000cda4efe920
r14=0000000000000000
r15=0000000000000001
iopl=0
nv up ei ng nz ac po nc
cs=0033
ss=002b ds=002b es=002b fs=0053
gs=002b
efl=00010296
usercpl!CUserManager::_RemoveGuestTile+0x5b:
00007ff9`d86f8a3f
488364c35000 and qword ptr [rbx+rax*8+50h],0
ds:0000028c`d5b0b978=????????????????
Resetting
default scope
EXCEPTION_RECORD:
(.exr -1)
ExceptionAddress:
00007ff9d86f8a3f (usercpl!CUserManager::_RemoveGuestTile+0x000000000000005b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
Parameter[0]: 0000000000000001
Parameter[1]: 0000028cd5b0b978
Attempt
to write to address 0000028cd5b0b978
0:043>
k
Child-SP
RetAddr Call Site
000000cd`a4efc918
00007ffa`3309dd20 ntdll!ZwWaitForMultipleObjects+0x14
000000cd`a4efc920
00007ffa`3309dc1e KERNELBASE!WaitForMultipleObjectsEx+0xf0
000000cd`a4efcc20
00007ffa`332a191c KERNELBASE!WaitForMultipleObjects+0xe
000000cd`a4efcc60
00007ffa`332a142f kernel32!WerpReportFaultInternal+0x4bc
000000cd`a4efd210
00007ffa`33056a6f kernel32!WerpReportFault+0x73
000000cd`a4efd250
00007ffa`3354da9d KERNELBASE!UnhandledExceptionFilter+0x2af
(Inline
Function) --------`-------- ntdll!RtlpThreadExceptionFilter+0x27
000000cd`a4efd360
00007ffa`33536476 ntdll!RtlUserThreadStart$filt$0+0x38
000000cd`a4efd390
00007ffa`3354a08d ntdll!__C_specific_handler+0x96
000000cd`a4efd400
00007ffa`334b9c58 ntdll!RtlpExecuteHandlerForException+0xd
000000cd`a4efd430
00007ffa`3354910e ntdll!RtlDispatchException+0x368
000000cd`a4efdb40
00007ff9`d86f8a3f ntdll!KiUserExceptionDispatch+0x2e
000000cd`a4efe270
00007ff9`d86f8b7a usercpl!CUserManager::_RemoveGuestTile+0x5b
000000cd`a4efe2a0
00007ff9`d86f8dbe usercpl!CUserManager::_HandleGuestAccountTile+0x12a
000000cd`a4efe2e0
00007ff9`d870e739 usercpl!CUserManager::ResetUserData+0x1ce
000000cd`a4efe380
00007ffa`32f588d3 usercpl!CUserManagementWizards::GetUserManagerInstance+0x129
000000cd`a4efe450
00007ffa`32fbc93e rpcrt4!Invoke+0x73
000000cd`a4efe4a0
00007ffa`32ef91a4 rpcrt4!Ndr64StubWorker+0xbde
000000cd`a4efeb70
00007ffa`327c4d99 rpcrt4!NdrStubCall3+0xb4
000000cd`a4efebd0
00007ffa`32f43a2b combase!CStdStubBuffer_Invoke+0x59
000000cd`a4efec10
00007ffa`32867963 rpcrt4!CStdStubBuffer_Invoke+0x3b
(Inline
Function) --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing::__l6::<lambda_76d9e92c799d246a4afbe64a2bf5673d>::operator()+0x2b
000000cd`a4efec40
00007ffa`32866286
combase!ObjectMethodExceptionHandlingAction<<lambda_76d9e92c799d246a4afbe64a2bf5673d>
>+0x53
(Inline
Function) --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing+0x89
000000cd`a4efeca0
00007ffa`3286c75e combase!DefaultStubInvoke+0x216
(Inline
Function) --------`-------- combase!SyncStubCall::Invoke+0x2c
(Inline
Function) --------`-------- combase!SyncServerCall::StubInvoke+0x2c
(Inline
Function) --------`-------- combase!StubInvoke+0x290
000000cd`a4efeeb0
00007ffa`328683ff combase!ServerCall::ContextInvoke+0x45e
(Inline
Function) --------`-------- combase!CServerChannel::ContextInvoke+0x97
(Inline
Function) --------`-------- combase!DefaultInvokeInApartment+0xb0
(Inline
Function) --------`-------- combase!ClassicSTAInvokeInApartment+0x1e6
000000cd`a4eff190
00007ffa`328648aa combase!AppInvoke+0xa5f
000000cd`a4eff300
00007ffa`32803369 combase!ComInvokeWithLockAndIPID+0x57a
(Inline
Function) --------`-------- combase!ComInvoke+0x1c0
000000cd`a4eff580
00007ffa`32802fe8 combase!ThreadDispatch+0x2b9
000000cd`a4eff650
00007ffa`3335bc50 combase!ThreadWndProc+0x198
000000cd`a4eff6f0
00007ffa`3335b5cf user32!UserCallWinProcCheckWow+0x280
000000cd`a4eff850
00007ff9`d870d2dc user32!DispatchMessageWorker+0x19f
(Inline
Function) --------`--------
usercpl!Windows::Internal::ComTaskPool::CThread::_DispatchMessage+0x1a
000000cd`a4eff8d0
00007ff9`d870d761
usercpl!Windows::Internal::ComTaskPool::CThread::_WaitForThreadUpdate+0x70
000000cd`a4eff940
00007ff9`d870d13e
usercpl!Windows::Internal::ComTaskPool::CThread::_ThreadProc+0x37d
000000cd`a4effa00
00007ff9`d870d259 usercpl!Windows::Internal::ComTaskPool::CThread::s_ExecuteThreadProc+0x12
000000cd`a4effa30
00007ffa`332b2774
usercpl!Windows::Internal::ComTaskPool::CThread::s_ThreadProc+0x9
000000cd`a4effa60
00007ffa`33510d61 kernel32!BaseThreadInitThunk+0x14
000000cd`a4effa90
00000000`00000000 ntdll!RtlUserThreadStart+0x21
0c
000000cd`a4efe270 00007ff9`d86f8b7a usercpl!CUserManager::_RemoveGuestTile+0x5b
0:043>
dv
this = 0x00000284`d5b0b930
iGuest = 0n-1
ß failed to locate the
index of the Guest account
i = 0xffffffff
GPO Looks like this (wrong)
Cause:
The
systemsettings.exe crashed because it could not identify the index of the guest
account while loading user information. In our environment the guest
account is renamed by GPO to something different. This crash can happen if the
following two conditions are met:
1. The guest account
is disabled ore renamed
2. The number of
profiles stored under the following key is more than 100:
a. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList
Resolution: Renamed the “***Guest”
account to “Guest” and left the account disabled in GPO and we get the expected
functionality.
