rdr_file_system 0x27 BSOD After Windows 10 2004 update, but only on domain profiles

Anonymous
2020-06-08T14:50:36+00:00

Good morning, I am having an issue on some PCs recently after some PCs received the Windows 10 2004 build update. After receiving said update, the machines will BSOD with a 0x027 error code when logging into a domain profile while connected to the network.

If I remove the network cable from the PC and log into a domain account that was cached on the machine before the update, it will log in without issues and then I can connect it to the network and it seems to resume function. I can also sign into a local account on the machine, with and without network connectivity. 

I used Bluescreen View to look at the dumps which seem to be showing rdbss.sys and mrxsmb20.sys as drivers that are causing the issue. I have tried updating network drivers etc from the vendors websites and not relying on Windows to, but am still having the issue.

The other bizarre thing is if the PC crashes 3 times, boots into the recovery mode to try and repair your PC and I restart it, it will then log in once to a domain account and seem to be functioning, however if the PC is restarted it will BSOD on log in.

Has anyone seen or heard of any issues like this since this update? Could it be something out dated on the server that is causing the issue to happen to the machines on the newer OS? I can't help but feel like it has something to do with folder redirection and that is why cached accounts will work with no network connection however I am stumped how to get around this other than not updating every other machine, and rolling back if possible (I had a PC that was upgraded from Windows 7 to 10 and went straight to the 2004 build and BSOD'd, I tried to roll back to Win7 and system will not boot at the moment saying it is missing system files etc.).

I have some mini dumps I can share if that would help as I would like to get to the bottom of this if possible.

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

167 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2020-12-09T15:18:29+00:00

    Was this answer helpful?

    0 comments
  2. Anonymous
    2020-12-09T14:40:29+00:00

    @Frodesen, Work Folders can substitute for Offline Files used alone. But Work Folders is not a substitute for Offline Files with Folder Redirection.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2020-12-09T07:22:52+00:00

    I had this issue as well with 20H2 (not tried the latest des. patch yet). One alternative to Offline Files is Work Folders. Works much better than the old Offline Files. Fairly easy to migrate,  You could use a GPO with a WMI filter for only new Windows 10 (20H1 and 20H2) that has the Work Folders settings. 

    Perhaps this is Microsoft sneaky way of "forcing" customers to move away from legacy technology...

    Was this answer helpful?

    0 comments
  4. Anonymous
    2020-12-08T22:08:17+00:00

    @PhilCowg, I am wondering if that's because the problem was only fixed for scenarios where the credential context is different on the local and remote computer. Returning again to the ever-cryptic change log--

    "Addresses an issue that causes stop error 0x27 when you attempt to sign in to a device that is not in a domain using credentials for a device that is in the domain."

    Maybe we're slowly learning through experience what that means.

    In your case, you were logged on to the laptop with cached credentials when you were remote, but used domain credentials against the file server after you connected to the VPN. Likewise, @ToZi24 syncing with his NAS: SAM credentials against the local computer, NAS credentials against the remote NAS. Different security contexts in both examples. In that scenario, perhaps, the problem is solved by the update.

    But once you booted up your laptop on the domain, you used domain credentials against the local computer and against the remote file server. If that scenario's not addressed, as the change log sorta seems like it's trying to say (maybe), then you still see BSODs.

    That said, if it's solved for VPN users, the Disable-Offline-Files-In-Group-Policy-For-Desktop-Computers-That-Never-Leave-The-LAN workaround is at least somewhat less onerous. As long as laptop users log on before connecting to the LAN, they won't BSOD. (They won't get computer policy that's only applied during startup, either, like GPSI, but hey, you can't have everything.) And no one with a desktop will BSOD because Offline FIles is disabled for them.

    I do note with interest that the recent forced upgrade from v1903 only upgraded v1903 to v1909. Normally they push you to the latest version. Perhaps there's still some awareness at Microsoft, however dim, that there is a big problem with Offline Files in v2004+, and they don't want to force the LTSB enterprise folks, likely using Redirection & Offline Files, from a reliable version to one guaranteed to BSOD at every logon.

    OK, that's more than enough speculation for one post.

    Pushing KB4592438 out to my problem site today, so hopefully can to do a little experimenting of my own on my next site visit.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2020-12-08T21:23:26+00:00

    Unfortunately my issue has returned, previous tests were when on vpn and reconnecting drives. Once back onsite and having the network connected from boot has reintroduced bsod. 

    Patch installed but issue still exists here,

    as soon as i remap drive with offline files enabled (CSC) instant blue screen.

    edit: enabling provider flag 1 has allowed me to map and not bluescreen. I had to manually make the entries in registry and then map drive.

    Heres what i used to map my H:\

    Windows Registry Editor Version 5.00

    [HKEY_CURRENT_USER\Network\H]

    "RemotePath"="\\INSERTDOMAINNAMEDFS\restricted\users\philcowg"

    "UserName"=""

    "ProviderName"="Microsoft Windows Network"

    "ProviderType"=dword:00020000

    "ConnectionType"=dword:00000001

    "ProviderFlags"=dword:00000001

    "ConnectFlags"=dword:00000000

    "DeferFlags"=dword:00000004

    WHere im still confused is i thought this enabled smb v1 but when i run

    PS C:\WINDOWS\system32> Get-SmbConnection

    none of my results show connections over smb1

    Was this answer helpful?

    0 comments