Corrupt NTDLL.DLL on Windows 2019 Server running on a virtual server.

Question

Greetings. Running a third party application in a brand new virtual server I get this error: Log Name: Application Source: Application Error Date: 11/01/2023 10:54:20 a. m. Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: N-1.nal.com Description: Faulting application name: AXE.exe, version: 4.2.1.1, time stamp: 0x00000000 Faulting module name: ntdll.dll, version: 10.0.17763.4974, time stamp: 0x761f6403 Exception code: 0xc0000005 Fault offset: 0x0003ff68 Faulting process id: 0x9c0 Faulting application start time: 0x01da0cdbabf485ff Faulting application path: E:\APPS\Programs\AXE.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: 86e0d68a-e17f-4e0b-b139-df462889357c Faulting package full name: Faulting package-relative application ID: Event Xml: http://schemas.microsoft.com/win/2004/08/events/event> 1000 2 100 0x80000000000000 1292 Application N-1.nal.com AXE.exe 4.2.1.1 00000000 ntdll.dll 10.0.17763.4974 761f6403 c0000005 0003ff68 9c0 01da0cdbabf485ff E:\APPS\Programs\AXE.exe C:\Windows\SYSTEM32\ntdll.dll 86e0d68a-e17f-4e0b-b139-df462889357c

Answer 1

Hi Raúl S. A.

Error code 0xc0000005 indicates that the ntdll.dll file on your Windows 2019 server is corrupted, causing the application to not function properly. You can try the following steps to resolve this issue:

1. Run an SFC (System File Checker) scan to find and fix system file errors. At the command prompt, type "sfc /scannow"(no quotes) and press enter.
2. If the SFC scan does not resolve the issue, you can try to repair the system image using the DISM (Deployment Image Servicing and Management) tool. At the command prompt, type "DISM /Online /Cleanup-Image /RestoreHealth" and press Enter.
3. If none of the above steps resolve the issue, you can try reinstalling the operating system or replacing the corrupted file with a backed up ntdll.dll file.

Please note that these steps may require administrator privileges to perform.

Hope it helps,

Lei

Answer 2

Thanks. We´ll try these recommendations and let you know if they worked. This will take a couple of days, because it´s a very restricted installation and many approvals are needed. Cheers.

Answer 3

Hello. We have reviewed everything and suspect there could be a policy or security issue. After tests and meetings with the customer, we all agreed to create a new virtual server outside the institution´s domain and network, so we install and test there, and if everything is ok, then move the server to the domain. We have done this in other servers (new/old) outside the customer´s installation and everything was ok. I´ll keep you posted. Cheers.

Answer 4

Hi. Wish you success.

Answer 5

Hello. Just to notify that the problem is solved. There was an application configuration file sent via email that somehow got corrupted and caused this problem. The strange thing is that the same file was used successfully outside the institution in two different installations also delivered via email, so probably one of the email protection applications at the institution altered it or something else related to emails did. Thanks for your help.