Specifics:
- Backup Server: Symantec Backup Exec R3 SP4 on Windows 2003 SP2
- Dell PowerEdge 1850 (yes, it's that old)
- Backup Target: Windows 2008 R2
- Domain Controller
- GC, Infrastructure Master, Domain Naming Master, Bridgehead
- Virtualized on VMWare 6
- Running on closed-network
Noticed that every time we logged into this server, there was an unexpected shutdown notification prompt (daily). Searched through the logs and found that these, "Windows-has-started-after-an-unexpected-shutdown" event do actually occur once daily around 1700-ish (+/- 30-90 mins). Asked one of the techs if that meant anything to them and they said there was a Symantec job that runs around that time. So we checked on the server and noticed that the Domain Controller job was failing (daily) also. But, just to verify, we initiated a backup at 0900 the following morning and 20-ish minutes later (still during the backup job), the DC BSOD'd again.
It is worth noting that it completely finishes on one of the other DCs before failing on the one in question. I'm currently trying to download and bring over the 2K8 R2 symbols to debug the dump to see if I can identify the faulting module/function but if it's a Symantec DLL and not a MS DLL, I won't have that available.
It is worth noting that in trying to troubleshoot any associated information, the System and Application logs show nothing of note. System shows normal DC-operations, then a 15-ish minute break in events, and then a system startup event. There is nothing of note in the Application log.
In hunting for Symantec logs, I'm not sure if it's relevant or not but I found a log named (PDVFS)[Datetime].LOG under C:\Program Files\Symantec\Backup Exec\RAWS\logs\PDVFS. There are daily logs around the same 1700ish timeframe with 2 entries (which are always the same):
[Datetime] (2852:2856) PDVFS - CPersistentConnection::RemoveConnection: RegDeleteKey failed with error: 2250
[Datetime] (2852:2856) PDVFS - CDiskManager::UnmapDrive: caught exception; error: -536870909
Is anyone aware of anything similar to this that we might need a hotfix/patch for?