I'm dealing with a Windows Server 2019 that keeps crashing unexpectedly, and I'm struggling to pinpoint the issue. Before each crash, I've noticed three event IDs in the Windows Event Viewer that indicate a failed TLS connection request from a remote client application, with each instance having a different TLS version (1.0, 1.1, and 1.2). These logs appear right before the server crashes and haven't shown up in any prior logs or on other servers I've checked. I also found a bugcheck code of 0x00000139, which I read suggests running a system file check (sfc). I did that, but it found corrupt files it couldn't resolve. Any suggestions or tips would be greatly appreciated, and I'm ready to provide more info if needed.
5 Answers
Before moving on, make sure to fix the files that the sfc scan couldn’t repair. What specific message do you see at the end of the sfc scan? Also, which files are causing issues?
If your SFC scan couldn't fix the issues, definitely prioritize running DISM to restore your system image before digging into memory dumps for specific driver problems.
First things first, focus on fixing the files that both sfc and DISM flagged. The TLS errors are a separate issue, just showing that something on the network is trying to connect using outdated ciphers.
You might also want to grab the dump file from the crash and analyze it using WinDBG. It'll give you insights into what went wrong.
I have it open in there, but I'm not exactly sure what I should be looking for since this is my first time diving into it.
It looks like the main issue is the bugcheck code 0x139, which typically points to kernel panics due to memory or file corruption. You should run the `DISM /Online /Cleanup-Image /RestoreHealth` command to try and pull fresh files from Windows Update. If that doesn’t do the trick, your RAM or SSD might be failing, so make sure to test them quickly!
I'm running DISM right now, just had to get through some WSUS settings. I think I've managed to have it skip WSUS and I'm re-running it.
Thanks for this! This seems like a solid plan.
The only file it mentioned as unrepaired was "Hyper-V Manager.lnk," likely because the app was open during the scan. Everything else appears to be committed for repair.