Computer restarting unexpectedly. Possible BSOD.

See post #9:
When available post chkdsk /r /v for each drive:
The command may take substantial time so run overnight.


For Ccleaner uncheck:

a) Memory Dumps
b) Windows Log Files

I have not gotten to the chkdsk yet. I did perform the ccleaner unchecks on memory dump and windows log files. However, I was able to catch the exact time when the machine stopped unexpectedly and actually would not reboot on its own. I connected a monitor up to it and received no video signal, yet the machine was powered on. It required a hard reboot to get it back up and running. I found in the event viewer some logs that might be of interest. I'll get back to you on the chkdsk. Here is another V2 if you need it.

Code:

Log Name:      System
Source:        EventLog
Date:          8/29/2021 3:00:08 PM
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EntertainmentR
Description:
The previous system shutdown at 2:40:22 PM on ‎8/‎29/‎2021 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-29T20:00:08.9321788Z" />
    <EventRecordID>24030</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>EntertainmentR</Computer>
    <Security />
  </System>
  <EventData>
    <Data>2:40:22 PM</Data>
    <Data>‎8/‎29/‎2021</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>127941</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>E507080000001D000E00280016002401E507080000001D0013002800160024013C0000003C000000000000000000000000000000000000000100000000000000</Binary>
  </EventData>
</Event>


--------------------------------------

Log Name:      System
Source:        volmgr
Date:          8/29/2021 3:00:04 PM
Event ID:      161
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EntertainmentR
Description:
Dump file creation failed due to error during dump creation.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="volmgr" />
    <EventID Qualifiers="49156">161</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-29T20:00:04.7369370Z" />
    <EventRecordID>24039</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="560" />
    <Channel>System</Channel>
    <Computer>EntertainmentR</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\HarddiskVolume1</Data>
    <Binary>000000000100000000000000A10004C000000600010000C000000000000000000000000000000000</Binary>
  </EventData>
</Event>

- - - Updated - - -

Here is chkdsk for C drive.

V2 log for C drive

More to come...

Run:
Tuneup_plus_log.bat ─ Click here to go to the BSOD batch repository to download and run this batch file.

SFCfromFile.bat - Click here to go to the BSOD batch repository to download and run this batch file.





Make a new restore point:
Create System Restore Point in Windows 10

zbook said:

Run:
Tuneup_plus_log.bat ─ Click here to go to the BSOD batch repository to download and run this batch file.

SFCfromFile.bat - Click here to go to the BSOD batch repository to download and run this batch file.

I am currently running chkdsk D: /r /v on my D: drive. It has been stuck at Progress: 1392 of 708848 for several hours. Hoping it is not frozen or stuck. As I understand it, it is not ideal to abort a chkdsk abruptly because it could cause corruption so I am going to give it a couple days. The D: drive is an external RAID 1 Mirror enclosure with I believe 10TB drive.

Code:

C:\windows\system32>chkdsk D: /r /v
The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process.  Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) Y
Volume dismounted.  All opened handles to this volume are now invalid.
Volume label is Plex Data.

Stage 1: Examining basic file system structure ...
  708864 file records processed.
File verification completed.
 Phase duration (File record verification): 5.75 seconds.
  35 large file records processed.
 Phase duration (Orphan file record recovery): 0.00 milliseconds.
  0 bad file records processed.
 Phase duration (Bad file record checking): 0.26 milliseconds.

Stage 2: Examining file name linkage ...
  12 reparse records processed.
  1119060 index entries processed.
Index verification completed.
 Phase duration (Index verification): 56.48 seconds.
  0 unindexed files scanned.
 Phase duration (Orphan reconnection): 5.68 seconds.
  0 unindexed files recovered to lost and found.
 Phase duration (Orphan recovery to lost and found): 1.32 milliseconds.
  12 reparse records processed.
 Phase duration (Reparse point and Object ID verification): 3.41 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
 Phase duration (Security descriptor verification): 22.95 milliseconds.
  205098 data files processed.
 Phase duration (Data attribute verification): 0.55 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
Progress: 1392 of 708848 done; Stage:  0%; Total:  7%; ETA:  12:30:56 ...

Please allow chkdsk to run overnight.
It is common to appear stuck but it is usually running.

zbook said:

Please allow chkdsk to run overnight.
It is common to appear stuck but it is usually running.

Here are the remainder chkdsk's.

D Drive V2 and readout.

Code:

Microsoft Windows [Version 10.0.19043.985]
(c) Microsoft Corporation. All rights reserved.

C:\windows\system32>chkdsk D: /r /v
The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process.  Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) Y
Volume dismounted.  All opened handles to this volume are now invalid.
Volume label is Plex Data.

Stage 1: Examining basic file system structure ...
  708864 file records processed.
File verification completed.
 Phase duration (File record verification): 5.75 seconds.
  35 large file records processed.
 Phase duration (Orphan file record recovery): 0.00 milliseconds.
  0 bad file records processed.
 Phase duration (Bad file record checking): 0.26 milliseconds.

Stage 2: Examining file name linkage ...
  12 reparse records processed.
  1119060 index entries processed.
Index verification completed.
 Phase duration (Index verification): 56.48 seconds.
  0 unindexed files scanned.
 Phase duration (Orphan reconnection): 5.68 seconds.
  0 unindexed files recovered to lost and found.
 Phase duration (Orphan recovery to lost and found): 1.32 milliseconds.
  12 reparse records processed.
 Phase duration (Reparse point and Object ID verification): 3.41 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
 Phase duration (Security descriptor verification): 22.95 milliseconds.
  205098 data files processed.
 Phase duration (Data attribute verification): 0.55 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
  708848 files processed.
File data verification completed.
 Phase duration (User file recovery): 11.18 hours.

Stage 5: Looking for bad, free clusters ...
  953035294 free clusters processed.
Free space verification is complete.
 Phase duration (Free space recovery): 0.00 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

   9537485 MB total disk space.
   5813484 MB in 503837 files.
    163860 KB in 205100 indexes.
         0 KB in bad sectors.
   1072951 KB in use by the system.
     65536 KB occupied by the log file.
   3722794 MB available on disk.

      4096 bytes in each allocation unit.
2441596415 total allocation units on disk.
 953035295 allocation units available on disk.
Total duration: 11.20 hours (40325775 ms).

C:\windows\system32>

E Drive V2 and readout.

Code:

Microsoft Windows [Version 10.0.19043.985]
(c) Microsoft Corporation. All rights reserved.

C:\windows\system32>chkdsk E: /r /v
The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process.  Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) Y
Volume dismounted.  All opened handles to this volume are now invalid.
Volume label is Active Drive.

Stage 1: Examining basic file system structure ...
  42240 file records processed.
File verification completed.
 Phase duration (File record verification): 617.81 milliseconds.
  2 large file records processed.
 Phase duration (Orphan file record recovery): 0.00 milliseconds.
  0 bad file records processed.
 Phase duration (Bad file record checking): 0.21 milliseconds.

Stage 2: Examining file name linkage ...
  12 reparse records processed.
  46702 index entries processed.
Index verification completed.
 Phase duration (Index verification): 6.37 seconds.
  0 unindexed files scanned.
 Phase duration (Orphan reconnection): 3.68 milliseconds.
  0 unindexed files recovered to lost and found.
 Phase duration (Orphan recovery to lost and found): 50.05 milliseconds.
  12 reparse records processed.
 Phase duration (Reparse point and Object ID verification): 2.00 milliseconds.

Stage 3: Examining security descriptors ...
Cleaning up 14 unused index entries from index $SII of file 9.
Cleaning up 14 unused index entries from index $SDH of file 9.
Cleaning up 14 unused security descriptors.
Security descriptor verification completed.
 Phase duration (Security descriptor verification): 60.90 milliseconds.
  2231 data files processed.
 Phase duration (Data attribute verification): 0.30 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
  42224 files processed.
File data verification completed.
 Phase duration (User file recovery): 2.44 hours.

Stage 5: Looking for bad, free clusters ...
  651210585 free clusters processed.
Free space verification is complete.
 Phase duration (Free space recovery): 0.00 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

   3815429 MB total disk space.
1301918308 KB in 39899 files.
     12236 KB in 2233 indexes.
         0 KB in bad sectors.
    227431 KB in use by the system.
     65536 KB occupied by the log file.
   2543791 MB available on disk.

      4096 bytes in each allocation unit.
 976750079 total allocation units on disk.
 651210586 allocation units available on disk.
Total duration: 2.44 hours (8801715 ms).

C:\windows\system32>

The R: drive is used by a program called RamDisk which creates a virtual storage drive from RAM. In this case 2GB. I am using it for my Plex server in order to output transcodes faster. So I am not sure if running chkdsk is viable on a virtual drive.

- - - Updated - - -

I also ran Tuneup_plus_log.bat and SFCfromFile.bat.

When available update the progress with the steps in post #23. (post results)

Read these links on Windows Driver Verifier (WDV):

Enable and Disable Driver Verifier in Windows 10
https://answers.microsoft.com/en-us/...3-c48669e4c983

Do NOT use the WDV tool until it is communicated in the thread.

zbook said:

When available update the progress with the steps in post #23. (post results)

Done. Added hyperlinks to the Tuneup_plus_log.bat and SFCfromFile.bat. on post#26.

Please make a new restore point: see post #23.

zbook said:

Please make a new restore point: see post #23.

I made a new restore point and enabled driver verifier. Rebooted. Now I assume I wait up to 48 hours for a BSOD. If no BSOD then disable driver verifier?

Also, should I run the computer like normal during driver verifier? For example, should I run all my servers that I normally run? Or should I disabled all my servers? I am wondering if one of my servers might be causing the issue. Reason why I am asking.