Consider the following scenario:

• You enable the following Group Policy settings on a computer that is running Windows Vista Service Pack 2 (SP2) or Windows Server 2008 SP2:
  

  Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security\Backup log automatically when full
  Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log

• You enable the Archive the log when full, do not overwrite events option in the Security log.
• The Security log reaches its maximum log size.

In this scenario, the computer crashes. Additionally, you receive the following Stop error message:

0xc0000244 – {Audit Failed}
An attempt to generate a security audit failed.

Note: The expected behavior is that the computer backs up the Security log when the log reaches its maximum size, and the computer does not crash.

Consider the following scenario:

• You join a computer to a network. The computer is running one of the following operating systems:
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2008 R2
• The network is configured to use Internet Protocol security (IPsec) network address translation traversal (NAT-T) security.
• You use IPsec to communicate with another computer in the network.

In this scenario, you randomly receive a Stop error message that resembles the following, and then the computer restarts:

STOP 0x000000C2 (parameter1, parameter2, parameter3, parameter4)

Notes:

• This Stop error describes a BAD_POOL_CALLER issue.
• The four parameters in this error message vary, depending on the configuration of the computer.
• Not all “0x000000C2″ Stop errors are caused by this issue.

When you connect to a computer that is running Windows Server 2008 R2, Windows 7, Windows Vista or Windows Server 2008 by using the RDP protocol, the computer stops responding or you receive the following Stop error message:

STOP: 0x0000007F (0×0000008, parameter2, parameter3, parameter4)

Notes:

• The parameters in this Stop error message may vary, depending on the configuration of the computer. However, the first parameter is always 0×0000008.
• Not all “0x0000007F” Stop errors are caused by this issue.

For example, you have deployed a Microsoft Virtual Desktop Infrastructure (VDI) environment in a network. You log on to a virtual machine that is running Windows Server 2008 R2, Windows 7, Windows Vista or Windows Server 2008 in the VDI environment. In this situation, the virtual machine stops responding or you receive the Stop error message.

A computer that is running an x64-based version of Windows Vista Service Pack 2 (SP2) or of Windows Server 2008 SP2 crashes when you do one of the following:

• Restart the computer
• Restart the computer and then access the computer immediately by using Remote Desktop Protocol (RDP)

When this issue occurs, you receive the following Stop error message:

STOP: 0x0000001E : (ffffffffc0000005, fffff8000253254e, 0, ffffffffffffffff)
KMODE_EXCEPTION_NOT_HANDLED

Consider the following scenario:

• You join a computer that is running Windows Server 2008 or Windows Vista to a network.
• The network is configured to use Internet Protocol security (IPsec) network address translation traversal (NAT-T) security.
• You use IPsec to communicate with another computer in the network.

In this scenario, you randomly receive a Stop error message that resembles the following, and then the computer restarts:

STOP 0x000000C2 (parameter1, parameter2, parameter3, parameter4)

Notes:

• This Stop error describes a BAD_POOL_CALLER issue.
• The four parameters in this error message vary, depending on the configuration of the computer.
• Not all “0x000000C2″ Stop errors are caused by this issue.

When you change the network adapter teaming configuration on a computer that is running Windows Vista or Windows Server 2008, you randomly receive various Stop error messages that resemble the following:

STOP: 0x000000D1 (parameter1, parameter2, parameter3, parameter4)

Note: This Stop error describes a DRIVER_IRQL_NOT_LESS_OR_EQUAL issue.

STOP 0×00000050 (parameter1, 0, parameter3, parameter4)

Note: This Stop error describes a PAGE_FAULT_IN_NONPAGED_AREA issue.

STOP: 0x0000000A (parameter1, parameter2, parameter3, parameter4)

Note: This Stop error describes an IRQL_NOT_LESS_OR_EQUAL issue.

Notes:

• The parameters in these Stop error messages vary, depending on the configuration of the computer.
• Not all “0x000000D1″, “0×00000050″, and “0x0000000A” Stop errors are caused by this issue.
• You may also experience other Stop errors when this issue occurs.

Consider the following scenario:

• You have a computer that is running Windows Server 2008 R2, Windows 7, Windows Vista or Windows Server 2008, and that supports the hot removal of PCI devices.
• You perform a hot removal of a PCI device on a storage controller.

In this scenario, you receive a Stop error message that resembles the following:

STOP 0x0000007E (parameter1, parameter2, parameter3, parameter4) SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Notes:

• The parameters in this error message vary, depending on the configuration of the computer.
• Not all “0x0000007E” Stop errors are caused by this issue.

When you run an application that uses the RegSetValueEx function on a computer that is running Windows 7, Windows Server 2008 R2, Windows Vista or Windows Server 2008, the computer may crash. Additionally, you may receive a Stop error that resembles the following:

Stop 0×00000050 (parameter1, parameter2, parameter3, parameter4)
PAGE_FAULT_IN_NONPAGED_AREA

Notes:

• The parameters of the Stop error message vary, depending on the configuration of the computer.
• Not all “0×00000050″ Stop errors are caused by this issue.

On a computer that is running Windows Server 2008 or Windows Vista, the Csrss.exe process crashes when you open a console application. Additionally, you may receive a Stop error message that resembles the following:

STOP 0x000000F4 (0×00000003, parameter 2, parameter 3, parameter 4)
CRITICAL_OBJECT_TERMINATION

Notes:

• The parameters in this Stop error message may vary, depending on the configuration of the computer. However, the first parameter is always 0×00000003.
• Not all “0x000000F4″ Stop errors are caused by this issue.

Assume that you use offline files (client-side caching) on a computer that is running Windows Vista or Windows Server 2008. In this situation, the computer may crash when you try to wake the computer from Sleep (S3) mode. Additionally, you receive a Stop error message that resembles the following:

STOP: 0x0000007F (parameter1, parameter2, parameter3, parameter4)
UNEXPECTED_KERNEL_MODE_TRAP

Notes:

• Not all “0x0000007F” Stop errors are caused by this issue.
• Parameters in this Stop error message may vary, depending on the configuration of the computer.
• This issue occurs if no network connection is available when you wake the computer.
• This issue may be more likely to occur if the computer has remembered connections to Distributed File System (DFS) shares that contain offline files.