Windows 2008 R2 started crashing

[orliego]

We have legacy windows 2008 R2 both on Azure and on-prem (under ESXi), couple of days ago, all of them started crashing.  We restored the one in Azure and restore a previous state, and started isolating the problem.  We started with turning off the windows update, but it still keeps on crashing and showing the recovery option page.  It only affects the Windows 2008 R2, as the other Windows servers (2012, 2016 and 2019 are all working just fine).  Appreciate any advise or help. Thanks!

[#2]

Does it BSOD, you say it crashes but in what way? If you recover the machine and you turned off windows update, it could be the AV solution that you're using that gets updated again for example? Or backup software?

[#3]

Hi, yes as soon as it start to load windows few seconds only it will shkw BSOD, then it reboots, followed by recovery options.

It doesnt even reached the log in page. We tried to restore from a previous image, and stop win update, AV and other stuff, we even tries going safe mode.. all results are the same, sometimes it will run few minutes to an hour (after restoring from older image) and does the same.

[#4]

And if you disconnect the network, does it also happen? You should be able to see in application/system logs if something is installed or updated... Weird

[#5]

The servers is a VM in Azure.

[#6]

You can still do that or make the gateway inaccessible or similar. But.. It's not an extension installation which occurs after recovering the vm? Nothing in the Azure logs?

[#7]

sadly nothing that I can see

[#8]

You could create a support ticket in Azure?

[#9]

would they still assist us to troubleshoot win2008 r2? since it is already EOL?

[#10]

It did receive extended updates in Azure, but not sure if you can report a ticket for it.. Try I guess?

[#11 · Accepted solution]

ok after almost 3 weeks of trying to figure this out... my colleague was able to resolve this issue. we have an application that seems to have messed up sysmondrv.sys, after he tried to rename both the exe and sys. was able to boot the windows 2008 R2 back up again. The process that led him to the solution was mounting the vmdisk on another vm, and open the even viewer logs, he also made a comparison to the other affected vms which was luckily able to boot first before crashing, and that got logged in which is the important clue.