Geeks With Blogs
Brent Caskey Active Directory, Hyper-V, Clustering, and Exchange Blog


I have recently come across this issue a number of times and was unable to find any reliable information about this on the web. So, after hours of troubleshooting and some calls with Microsoft, I found the following information.


A Hyper-V Cluster will generate a 0x50 Blue screen during normal operation. This can happen on ANY node of the cluster.

When reviewing the memory dump, you will see something similar to the following in the stack trace:

fffff880`0c1787d8 fffff800`02150f14 : 00000000`00000050 fffffa80`84a00000 00000000`00000000 fffff880`0c178940 : nt!KeBugCheckEx
fffff880`0c1787e0 fffff800`020ce82e : 00000000`00000000 00000000`e69d9924 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`0c178940 fffff880`014e9862 : fffff8a0`20f457c8 fffff880`e6f4f951 00000000`8a0ad368 fffff880`a295d357 : nt!KiPageFault+0x16e
fffff880`0c178ad0 fffff880`014e4a05 : 00000000`ffffffe4 00000000`00000001 00000000`00000000 00000000`00000001 : cng!SHA256Update+0xa6
fffff880`0c178b10 fffff880`08012133 : fffff880`0c179100 fffffa80`6b3d9909 00000000`00000001 fffff880`08012010 : cng!MSCryptHashData+0x65
fffff880`0c178b40 fffff880`08022280 : fffff8a0`20f45780 00000000`00000004 fffff880`0c178cd8 00000020`00000001 : CSVFilter!ShaHash::Hash+0x7b
fffff880`0c178ba0 fffff880`0800d7ed : 00000000`c0000225 fffff880`0c178cc0 fffffa80`a6fe50c0 00000000`00000000 : CSVFilter!CfspVerify+0x30
fffff880`0c178c00 fffff880`08016194 : 00000000`00000142 00000000`00000001 00000000`00000000 fffffa80`70d8ba00 : CSVFilter!CfspGetCfsEa+0x69
fffff880`0c178c30 fffff880`01499027 : 00000000`00000000 fffff880`068c0750 00000000`000000e0 fffffa80`a6fe5160 : CSVFilter!CfsPreCreate+0x18c
fffff880`0c178fc0 fffff880`0149b8ca : fffffa80`87dcd600 fffffa80`87dcd600 fffffa80`669f7b00 fffffa80`64dd5800 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880`0c1790c0 fffff880`014b92a3 : fffffa80`bfea9840 fffffa80`bfea9840 fffffa80`bfea9840 fffff880`6d4e6f49 : fltmgr!FltpPassThroughInternal+0x4a
fffff880`0c1790f0 fffff800`023d3807 : 00000000`00000004 fffff800`023f2f30 fffffa80`99ef9440 00000000`00000000 : fltmgr!FltpCreate+0x293
fffff880`0c1791a0 fffff800`023c9c2f : fffffa80`669f7be0 00000000`00000000 fffffa80`8fff6b10 fffffa80`7281f400 : nt!IopParseDevice+0x5a7
fffff880`0c179330 fffff800`023cee4d : fffffa80`8fff6b10 fffff880`0c179490 fffffa80`00000040 fffffa80`613acc90 : nt!ObpLookupObjectName+0x32f
fffff880`0c179430 fffff800`023d5917 : fffffa80`682bf010 00000000`00000001 00000000`00000000 00000000`000007ff : nt!ObOpenObjectByName+0x1cd
fffff880`0c1794e0 fffff800`0237904b : fffff880`0c179960 00010000`00100081 fffffa80`92e0dca0 fffff880`0c179948 : nt!IopCreateFile+0x2b7
fffff880`0c179580 fffff880`0813b81e : 00000000`00000000 fffff880`0c1796a0 fffffa80`682bf010 fffff8a0`09a5e5f0 : nt!IoCreateFileEx+0xfb
fffff880`0c179620 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : srv!SrvIoCreateFile+0x31e

Notice that the CSVFilter is being called, then the cng.sys driver. The BSOD happens directly after that.

After numerous different troubleshooting steps, while working directly with Microsoft, we realized that this BSOD was only happening on the cluster node that was also hosting a Clustered File Share resource.

This Clustered File Share resource was NOT on a Cluster Shared Volume. It was on another disk in the cluster. We believed that we were still within a supported configuration.

 After working with Microsoft, this was the supported fix:


Remove the File share resource from the cluster.

After removing the File Share resource from the cluster, the BSOD’s went away, and all was well.


We were told that there would be updated documentation coming to TechNet. I will update this blog when I know more.


The reason why this has an issue is due to the fact that the CSVFilter.sys file system filter driver is attached to all disks in a cluster when Cluster Shared Volumes are enabled for the cluster – not only the disks that really are CSVs.

You can see this for yourself by running fltmc instances


Thanks for reading!


Posted on Friday, May 27, 2011 3:34 PM Hyper-V , Clustering | Back to top

Comments on this post: STOP Code 0x00000050 ( 0x50 ) pointing to cng.sys on a Hyper-V Cluster

No comments posted yet.
Your comment:
 (will show your gravatar)

Copyright © Brent Caskey | Powered by: