BSOD at night - HP ZBook - ntoskrnl.exe

User6878 · Feb 14, 2024

Laptop has been BSOD'ing for a while now. Happens only at night between 11pm-4am. I've fixed this in the past but can't remember what I did. I had more minidump files but ran CC cleaner last week and apparently deleted those, whoops.

Anyhow, ran the V2 log collector, here's the results: Z33B00K-(2024-02-14_18-46-32).zip

Thanks for your time.

zbook · Feb 14, 2024

There were two problematic GPU drivers.

The Nvidia GPU drivers were causing BSODs.

The Intel GPU drivers were causing hangs.

Please perform the following steps:

1) Run Tuneup plus > post a share link

https://www.tenforums.com/attachments/bsod-crashes-debugging/360139d1645183596-batch-files-use-bsod-debugging-tuneup_plus_log.zip

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

2) Make a new restore point:

Create System Restore Point in Windows 11 Tutorial

This tutorial will show you how to manually create a restore point in Windows 11. Turning on system protection for a drive allows System Restore to include the drive when restore points are created so you can undo undesired system changes by reverting to a previous point in time. System...

www.elevenforum.com

3) Uninstall the Nvidia and Intel GPU drivers using DDU

Reinstall drivers from the HP website

Display Driver Uninstaller: How to use

How to Use Display Driver Uninstaller to Uninstall any Installed Display Driver

www.sevenforums.com

Display Driver Uninstaller (DDU) download latest version 18.0.7.6

Official Display Driver Uninstaller (DDU) download website. DDU is a driver removal utility that can help you completely uninstall AMD/NVIDIA/INTEL graphics card drivers and packages from your system, trying to remove all leftovers (including registry keys, folders and files, driver store).

www.wagnardsoft.com

https://support.hp.com/us-en/drivers/swdetails/hp-zbook-studio-g5-mobile-workstation/model/18865655/swItemId/ob-321531-1?sku=8XA67UT&serialnumber=5CD0141TCW

https://support.hp.com/us-en/drivers/swdetails/hp-zbook-studio-g5-mobile-workstation/model/18865655/swItemId/ob-277437-1?sku=8XA67UT&serialnumber=5CD0141TCW

4) Download and install: HP PC Hardware Diagnostics UEFI – v10.3.0.0

https://ftp.hp.com/pub/softpaq/sp150501-151000/sp150582.exe

Code:

nvlddmkm    nvlddmkm    c:\windows\system32\driverstore\filerepository\nvblwi.inf_amd64_ee2f73d9d836236e\nvlddmkm.sys

Code:

igfx    igfx    c:\windows\system32\driverstore\filerepository\iigd_dch.inf_amd64_51f685305808e3a5\igdkmd64.sys

Code:

Name    NVIDIA Quadro P1000
PNP Device ID    PCI\VEN_10DE&DEV_1CBB&SUBSYS_8427103C&REV_A1\4&1ADD25E3&0&0008
Adapter Type    Quadro P1000, NVIDIA compatible
Adapter Description    NVIDIA Quadro P1000
Adapter RAM    (1,048,576) bytes
Installed Drivers    C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ee2f73d9d836236e\nvldumdx.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ee2f73d9d836236e\nvldumdx.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ee2f73d9d836236e\nvldumdx.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ee2f73d9d836236e\nvldumdx.dll
Driver Version    31.0.15.3799
INF File    oem15.inf (Section060 section)
Driver    C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\NVBLWI.INF_AMD64_EE2F73D9D836236E\NVLDDMKM.SYS (31.0.15.3799, 56.47 MB (59,212,952 bytes), 1/10/2024 8:39 AM)

Code:

Name    Intel(R) UHD Graphics 630
PNP Device ID    PCI\VEN_8086&DEV_3E9B&SUBSYS_8427103C&REV_00\3&11583659&0&10
Adapter Type    Intel(R) UHD Graphics Family, Intel Corporation compatible
Adapter Description    Intel(R) UHD Graphics 630
Adapter RAM    1.00 GB (1,073,741,824 bytes)
Installed Drivers    C:\WINDOWS\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_51f685305808e3a5\igdumdim64.dll,C:\WINDOWS\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_51f685305808e3a5\igd10iumd64.dll,C:\WINDOWS\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_51f685305808e3a5\igd10iumd64.dll,C:\WINDOWS\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_51f685305808e3a5\igd12umd64.dll
Driver Version    31.0.101.2111
INF File    oem195.inf (iCFL_w10_DS section)
Driver    C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\IIGD_DCH.INF_AMD64_51F685305808E3A5\IGDKMD64.SYS (31.0.101.2111, 42.18 MB (44,233,280 bytes), 10/22/2022 6:30 AM)

User6878 · Feb 15, 2024

Thank you. I'm working through the steps now. Here is the Tune Up log file results: Tuneup_log 2024-02-14 at 21-03-13.zip

zbook · Feb 15, 2024

Tuneup plus results were good.

Please run diskpar info > post a share link

https://www.tenforums.com/attachments/bsod-crashes-debugging/355861d1640707960-batch-files-use-bsod-debugging-diskparinfo.bat

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

Post images or share links displaying disk management:

How to Post a Screenshot of Disk Management

How to Post a Screenshot of Disk Management at Ten Forums

www.tenforums.com

User6878 · Feb 15, 2024

diskpar results: DiskParInfo.log
Was the code from your first reply what was found in the mini dump file? Nothing I need to do with it?

zbook · Feb 15, 2024

The default recovery partition is missing and Windows Recovery Environment is disabled.

Were these deliberate or by accident?

User6878 · Feb 15, 2024

zbook said:
The default recovery partition is missing and Windows Recovery Environment is disabled.

Were these deliberate or by accident?

The missing recovery partition sounds like something I would deliberately delete. It's been years since this original install.
I don't recall the Windows Recovery Environment though.

zbook · Feb 15, 2024

The recovery partition nor an enabled RE are necessary as long as you continue to make Macrium backup images.

Run administrative command prompt:

reagentc /info
reagentc /enable
reagentc /info

Post a share link.

User6878 · Feb 15, 2024

zbook said:
The recovery partition nor an enabled RE are necessary as long as you continue to make Macrium backup images.

Run administrative command prompt:

reagentc /info
reagentc /enable
reagentc /info

Post a share link.

Thanks for your help last night. I'm using Macrium to access historical backup archives. I don't use it to back my device up. Anything important I store on my NAS. I also use cloud backups too. That said, is there any value in using RE still? Thanks!

zbook · Feb 15, 2024

A bootable Windows 11 Media Creation Tool (MCT)(Windows 11 iso) can be used instead of a Windows recovery partition.

It can be created on a Windows computer with a flash drive (> or = 8 GB).

Download Official Windows 11 ISO file from Microsoft Tutorial

This tutorial will show you how to download an official Windows 11 ISO file from Microsoft. Microsoft provides ISO files for Windows 11 to download. You can use these ISO files to clean install or in-place upgrade Windows 11. The Flight Hub can also help you keep updated on which Windows 11...

www.elevenforum.com

Download Windows 11

Recovery options in Windows - Microsoft Support

Learn about the recovery options in Windows. Find out how to reset your PC, go back to a previous version of Windows, or use media to reinstall Windows.

support.microsoft.com

User6878 · Feb 22, 2024

I got another bluescreen today. In the past the laptop would shut down. This time it hung and was unresponsive. I had to manually power it off/on.

I accidentally ran tuneup first and then V2 log collector

https://drive.google.com/file/d/1dkKqObTklnyHJk4nS1Py9boNQsqrqwGW/view?usp=drive_link
https://drive.google.com/file/d/1932Rz8fwUkgub-j1wIKGzR9ir59kQpAk/view?usp=drive_link

zbook · Feb 22, 2024

Make sure that links are available without sign in:

Sign in

to continue to Google Drive

User6878 · Feb 22, 2024

Apologies, try again.

zbook · Feb 22, 2024

Overnight run the HP UEFI hardware diagnostics in loop until error.

Power on and repetitively click F2 or F10 > UEFI hardware diagnostics > system > extensive > loop until error >

the next day if there has been two or more loops > click esc > take pictures >

post images or share links displaying the tests performed with results

Download and install: HP PC Hardware Diagnostics Windows v2.4.0.0

https://ftp.hp.com/pub/softpaq/sp149501-150000/sp149728.exe

zbook · Feb 23, 2024

Uninstall Fortinet software during the troubleshooting.

Technical Tip: How to uninstall a managed FortiClient in Windows Machines

Description This article describes the steps that need to be taken to uninstall a managed FortiClient using the FC Removal Tool. Scope FortiClient 6.0+, 6.2+, 6.4+, 7.0+, 7.2+. Solution Sometimes there is a need to force the FortiClient uninstallation from an endpoint that has no...

community.fortinet.com

Uninstalling FortiClient | Administration Guide

docs.fortinet.com

Code:

Event[4585]
  Log Name: System
  Source: Service Control Manager
  Date: 2024-02-16T09:02:48.3060000Z
  Event ID: 7045
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic,
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: z33b00k
  Description:
A service was installed in the system.

Service Name:  Forticlient Early Launch Boot Driver
Service File Name:  system32\DRIVERS\fortiElam.sys
Service Type:  kernel mode driver
Service Start Type:  boot start
Service Account:   

Event[4586]
  Log Name: System
  Source: Service Control Manager
  Date: 2024-02-16T09:02:48.3340000Z
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic,
  User: N/A
  User Name: N/A
  Computer: z33b00k
  Description:
The Forticlient Early Launch Boot Driver service failed to start due to the following error:
A device attached to the system is not functioning.

Event[4587]
  Log Name: System
  Source: Service Control Manager
  Date: 2024-02-16T09:02:54.6070000Z
  Event ID: 7045
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic,
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: z33b00k
  Description:
A service was installed in the system.

Service Name:  Forticlient Endpoint Protected Process Service
Service File Name:  "C:\Program Files\Fortinet\FortiClient\FctSecSvr.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem

Event[4588]
  Log Name: System
  Source: Service Control Manager
  Date: 2024-02-16T09:02:54.6070000Z
  Event ID: 7030
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic,
  User: N/A
  User Name: N/A
  Computer: z33b00k
  Description:
The Forticlient Endpoint Protected Process Service service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

User6878 · Feb 23, 2024

Ah FortiClient, I did make some extensive changes to that configuration. Makes sense now... the BSOD was not the same (hang vs. turning off). I will ping Fortinet to troubleshoot.

Here are the results from the overnight scan. I didn't see the message to uninstall FortiClient until this AM.
shared - Google Drive

zbook · Feb 23, 2024

The UEFI hardware diagnostics were good.

Please reinstall the Nvidia GPU drivers (nvlddmkm.sys) from the HP website after a clean using DDU.

The HP Windows hardware diagnostics may have interactive GPU testing.

Please perform these tests too.

Monitor the computer using reliability monitor:

View Reliability History in Windows 11 Tutorial

This tutorial will show you how to view reliability history for your Windows 11 device. The Reliability Monitor provides a system stability overview and details about events that impact reliability. It calculates the Stability Index shown in the System Stability Chart. Reliability Monitor...

www.elevenforum.com

User6878 · Feb 23, 2024

zbook said:
The UEFI hardware diagnostics were good.

Please reinstall the Nvidia GPU drivers (nvlddmkm.sys) from the HP website after a clean using DDU.

The HP Windows hardware diagnostics may have interactive GPU testing.

Please perform these tests too.

Monitor the computer using reliability monitor:

View Reliability History in Windows 11 Tutorial

This tutorial will show you how to view reliability history for your Windows 11 device. The Reliability Monitor provides a system stability overview and details about events that impact reliability. It calculates the Stability Index shown in the System Stability Chart. Reliability Monitor...

www.elevenforum.com

Will do.
Does it show the NVIDIA driver staying the same meaning Windows didn't auto update it or anything? By reinstalling we are ruling out a corrupt installation?

zbook · Feb 23, 2024

Starting from a clean install creates a fresh installation for the new monitoring period.

Repetitive BSOD with multiple drivers especially different versions typically indicates malfunctioning hardware.

The best tested drivers are on the HP website.

The newest driver versions are on the component manufacturer website.

Plan:

1) Install a fresh driver from the HP website

2) If there are no recurrent problems then that completes the troubleshooting

3) If there are recurrent BSOD caused by misbehaving Nvidia GPU drivers then try each a newer and an older driver from the Nvidia website

3) If computer instability continues caused by Nvidia GPU drivers then turn off the Nvidia dGPU and only use the
Intel UHD Graphics 630 iGPU

4) And consider servicing at HP or at a local computer store