rdr_file_system 0x27 BSOD After Windows 10 2004 update, but only on domain profiles

Hi,

I've installed KB4586853 today and it seems to have resolved the issue.

I can now build, capture and deploy a Windows 10 Education x64 20H2 image with all my GPOs (including mapped drives and enabling offline files) in place.

Thanks,

Matt

A BIG THANK YOU to @mattcourtman for making me aware of this patch:

After installation of KB4586853BSOD has disappeared on both of my laptops - Halleluja!

Let's hope it survives the next patch day ...

For the record: I'm not in an enterprise environment, just syncing (a lot of) data from a NAS to my laptops. Had a BSOD since update from 1903 to 2004 (old laptop), right from the start (with 2004) on a brand new laptop, resp.

I installed December set of patches on one pilot computer (that was certainly crashing before) - and problem seems to disappeared. It will require some further testing. It was tested on Widnows 10 v. 2003 (H1).

Unfortunately my issue has returned, previous tests were when on vpn and reconnecting drives. Once back onsite and having the network connected from boot has reintroduced bsod. 

Patch installed but issue still exists here,

as soon as i remap drive with offline files enabled (CSC) instant blue screen.

edit: enabling provider flag 1 has allowed me to map and not bluescreen. I had to manually make the entries in registry and then map drive.

Heres what i used to map my H:\

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Network\H]

"RemotePath"="\\INSERTDOMAINNAMEDFS\restricted\users\philcowg"

"UserName"=""

"ProviderName"="Microsoft Windows Network"

"ProviderType"=dword:00020000

"ConnectionType"=dword:00000001

"ProviderFlags"=dword:00000001

"ConnectFlags"=dword:00000000

"DeferFlags"=dword:00000004

WHere im still confused is i thought this enabled smb v1 but when i run

PS C:\WINDOWS\system32> Get-SmbConnection

none of my results show connections over smb1

@PhilCowg, I am wondering if that's because the problem was only fixed for scenarios where the credential context is different on the local and remote computer. Returning again to the ever-cryptic change log--

"Addresses an issue that causes stop error 0x27 when you attempt to sign in to a device that is not in a domain using credentials for a device that is in the domain."

Maybe we're slowly learning through experience what that means.

In your case, you were logged on to the laptop with cached credentials when you were remote, but used domain credentials against the file server after you connected to the VPN. Likewise, @ToZi24 syncing with his NAS: SAM credentials against the local computer, NAS credentials against the remote NAS. Different security contexts in both examples. In that scenario, perhaps, the problem is solved by the update.

But once you booted up your laptop on the domain, you used domain credentials against the local computer and against the remote file server. If that scenario's not addressed, as the change log sorta seems like it's trying to say (maybe), then you still see BSODs.

That said, if it's solved for VPN users, the Disable-Offline-Files-In-Group-Policy-For-Desktop-Computers-That-Never-Leave-The-LAN workaround is at least somewhat less onerous. As long as laptop users log on before connecting to the LAN, they won't BSOD. (They won't get computer policy that's only applied during startup, either, like GPSI, but hey, you can't have everything.) And no one with a desktop will BSOD because Offline FIles is disabled for them.

I do note with interest that the recent forced upgrade from v1903 only upgraded v1903 to v1909. Normally they push you to the latest version. Perhaps there's still some awareness at Microsoft, however dim, that there is a big problem with Offline Files in v2004+, and they don't want to force the LTSB enterprise folks, likely using Redirection & Offline Files, from a reliable version to one guaranteed to BSOD at every logon.

OK, that's more than enough speculation for one post.

Pushing KB4592438 out to my problem site today, so hopefully can to do a little experimenting of my own on my next site visit.

I had this issue as well with 20H2 (not tried the latest des. patch yet). One alternative to Offline Files is Work Folders. Works much better than the old Offline Files. Fairly easy to migrate,  You could use a GPO with a WMI filter for only new Windows 10 (20H1 and 20H2) that has the Work Folders settings. 

Perhaps this is Microsoft sneaky way of "forcing" customers to move away from legacy technology...