BSOD pcw.sys

[AlexLeadingEdge]

I had a server die today and I'm trying to restore it from the backup and when it fully restores it proceeds to load then blue screens.

Any idea what is causing this? I can't get into Safe Mode, Normal Mode or even the Advanced Startup Options menu.

None of the backups are working

[AlexLeadingEdge]

It seems to be caused by the driver injection after the restore. Unticking "Inject these drivers into operating system while performing bare metal recovery" seems to fix it.

[Delo123]

Yep, we also had this a few times doing restores. Others have said they deleted pcw.sys would work for them, but we managed to restore without injecting drivers as you!

[Dima P.]

Hi,

Indeed pcw.sys BCOD is usually caused by driver conflicts, so you should not inject drivers from recovery media or you might want to add any customer drivers to the recovery media and install them prior running recovery via Load Driver tool. Anyway, glad you nailed it!

[Mike Resseler]

To add to Dima's information...

Pcw.sys is the Performance Counters for Windows driver. 0x0000007E is a system thread exception. Maybe you know of changes that have been done on that server in-between the creation of the recovery media and the time of recovery. For example, PCW.sys can give that exception when the recovery media tries to install a driver (for example v1.1) that was used during that recovery media build but you upgraded the driver / firmware of the hardware afterwards to v1.2 or something. (Even if you didn't do that yourself, sometimes these things come with Windows Update which is on the one hand good... On the other hand... I like to know these things ). So ideally, when you make hardware changes / firmware updates etc... A good practice is always to quickly make a new recovery media.

Mike

[AlexLeadingEdge]

Indeed pcw.sys BCOD is usually caused by driver conflicts, so you should not inject drivers from recovery media or you might want to add any customer drivers to the recovery media and install them prior running recovery via Load Driver tool. Anyway, glad you nailed it!

Yes, we used the Load Driver tool to install the RAID drivers and then didn't inject drivers into the restore. One little tick box screwed up the restore, with each restore attempt taking 1-2 hours, so it took us 8 hours to have the server back up and running as we didn't know it was the driver injection that was causing this

[AlexLeadingEdge]

A good practice is always to quickly make a new recovery media.

The server was only built a week ago but Microsoft patches have come out since then, which may have changed multiple drivers. Is there a way to automate the creation of the recovery media? I'm thinking some sort of command line call from Task Scheduler? The recovery media is kept on all the USB Backup drives and on an internal drive, usually the R Drive (R for Recovery, hehe), and it would be nice to create an ISO recovery media every so often so we don't get caught with our pants down again.

[Mike Resseler]

No,
There is no command line utility for it... But now that MSFT is changing how updates are delivered and installed, it might be a good time to rethink a few things (after next release at least )

[Delo123]

Hi Mike,

we have seen this 2 times under testing.
- Install veeam endpoint backup
- create media
- full backup
- boot from media
- full restore -> failed with pcw.sys

we got it running eventually but it's not "just" an issue with having changed drivers between creation etc.. as nothing was changed in our tests.

[Dima P.]

Hi Guido,

it's not "just" an issue with having changed drivers between creation etc.. as nothing was changed in our tests.

Was the backup file and recovery media created within one machine? Did you have any USB devices connected during backup/recovery media creation?

[Mike Resseler]

PS: Alex, Guido,

Our apologies for all of the additional questions and thank you already for helping us out here... We really want to figure out what is happening and how this is happening...

Mike

[Delo123]

Hi Mike,

in our case we were doing recovery tests, so same hardware, media created just before the backup etc.
USB devices used were mouse, keyboard and the usb stick for booting (removed the stick after recovery).
Hardware was an Intel NUC with usb3 ports only and windows 2008R2 as OS. We saw it in 2 out of 10 cases, in 1 case were were able to fix it simply by rebooting into safe mode. The other one we needed to fiddle with pcw.sys

[Mike Resseler]

Thanks Guido,
So, you created a recovery disk PER server right?
PS: The NUC draws my attention... I heard about some issues with them from friends that use these on a regular basis as DEMO environments (and therefore reinstall / restore / backup etc... a lot). I will try to contact them this week to get more information from them

Mike

[Delo123]

Yes, every nuc has it's own recovery usb.
Yes, i agree.... the Nuc's especially the "new" Braswell types have been quite tricky with everything OS restore / clone related...