Here comes the procedure to reproduce a severe bug in the windows xp terminal
service (RDPDD.dll):

Set up a windows xp pro host and connect then from a remote computer via
remote desktop.

1)
connect and logon (create new session) at color depth 15bit

2)
disconnect (leave the user logged on)

3)
connect and logon to the created session at color depth 16bit

4)
disconnect

5)
connect and logon to the created sesseion at color despth 15bit

-> voila, the remote desktop host system reboots!

- I can reproduce this bug on all 4 availble computers (all xp pro with sp3)
at my location. -

Thank you for sharing your experience with us.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"techsc" <techsc@discussions.microsoft.com> wrote in message
news:20768C0C-0030-4E63-86F5-794C346A1E43@microsoft.com...

Can you also repdroduce the issue?

"Robert L. (MS-MVP)" wrote:

Hi!

I am having a similar issue. I connect to a XP Pro sp3 machine from multiple
clients with different resolutions and the XP pro machine has locked up 3
times since I installed sp3. I have a dump analysis from ERD CDR if anyone is
interested. It said RDPDD.dll was to blame. Here is some of the log. Thanks!

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: bcbafff0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf85b739, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


PEB is paged out (Peb.Ldr = 7ffd800c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd800c). Type ".hh dbgerr001" for details

READ_ADDRESS: bcbafff0

FAULTING_IP:
win32k!MultiUserGreTrackRemoveEngResource+17
bf85b739 8b01 mov eax,dword ptr [ecx]

MM_INTERNAL_CODE: 0

IMAGE_NAME: RDPDD.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4802a10b

MODULE_NAME: RDPDD

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: csrss.exe

TRAP_FRAME: a9034a88 -- (.trap 0xffffffffa9034a88)
..trap 0xffffffffa9034a88
ErrCode = 00000000
eax=00000001 ebx=e301f2d8 ecx=bcbafff0 edx=00000000 esi=bcbafff0 edi=00000000
eip=bf85b739 esp=a9034afc ebp=a9034afc iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!MultiUserGreTrackRemoveEngResource+0x17:
bf85b739 8b01 mov eax,dword ptr [ecx]
ds:0023:bcbafff0=????????
..trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 80529160 to 80537672

"techsc" wrote:

I have the same issues after updating Windows XP Pro to SP3.

Is there any solution in sight?

Greetz.