Monday, October 17, 2016

SCOM 2012 r2 console crash after windows patch

After I installed Oct 2016 windows patches
I got this error whenever I tried to open "windows Computers" under "Monitoring"

Application log:
Faulting application name: Microsoft.EnterpriseManagement.Monitoring.Console.exe, version: 7.1.10226.1177, time stamp: 0x5697e092
Faulting module name: ntdll.dll, version: 6.1.7601.23543, time stamp: 0x57d2fde1
Exception code: 0xc000041d
Fault offset: 0x000000000004ef57
Faulting process id: 0x18a0
Faulting application start time: 0x01d228f4261a1d54
Faulting application path: C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Console\Microsoft.EnterpriseManagement.Monitoring.Console.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 7a5e2e0a-94e7-11e6-ab30-0050569b0035


SCOM console logs:

Problem signature:
  Problem Event Name: APPCRASH
  Application Name: Microsoft.EnterpriseManagement.Monitoring.Console.exe
  Application Version: 7.1.10226.1177
  Application Timestamp: 5697e092
  Fault Module Name: ntdll.dll
  Fault Module Version: 6.1.7601.23543
  Fault Module Timestamp: 57d2fde1
  Exception Code: c0000005
  Exception Offset: 000000000004eef1
  OS Version: 6.1.7601.2.1.0.272.7
  Locale ID: 1033
  Additional Information 1: 383a
  Additional Information 2: 383a5f09f3fd70a29b8be053663a1d2a
  Additional Information 3: 0ebe
  Additional Information 4: 0ebe29effad583805ef4413487a5a75f

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt


It seems "October 2016 security monthly quality rollup" is causing the issue
KB3192392 for Windows 8.1 and Server 2012 R2
KB3185332 for Windows server 2012
KB3185330 for Windows server 2008 R2

Remove the KB and restart the SCOM server and it will be fixed.

3 comments:

Suyog Honakamble said...

We have Windows server 2012 R2 & have uninstall the patch KB3192392 & reboot the SCOM servers.
But still the problem persist on both the SCOM console.

When i click on "Windows Computers" under monitoring the console crash.

Is there anything that need to be checked.

HKIM said...

Not that I know of, It is basically a .net framework security patch causing the issue, try uninstalling recent .net framework patches.

Roberto Bustillo said...

There is a patch that solve this problem: https://blogs.technet.microsoft.com/germanageability/2016/10/17/october-2016-windows-patch-kb3192392-might-cause-scom-2012r2-console-to-crash/
I have installed it and now SCOM console runs ok.