fredag den 28. august 2015

BSOD on Skype for Business server in-place

BSOD can possibly occure after inplace upgrade from LYNC 2013 server to SKYPE for Business server - when the following is true:

OS is 2012 or 2012R2
Server has or had Antivirus product installed that utilizes a TDI Filter driver
Inplace upgrade is performed from LYNC 2013 Server to SKYPE for business server 2015

BSOD giving Stop Error 0xD1 - caused by TDI Filter driver - a system file used by many different AV vendors - but i only had hands-on with the issue caused by a broken Mcafee client on one server in an enterprise pool.

Confirm that this IS indeed your problem by searching for this specific event ID
Run the following command command from an elevated PowerShell window:
get-eventlog -logname system  | ?{$_.eventid -eq "16001"}

Sadly for 2012 there is no hotfix - issue is being investigated - so best option in my opinion is to create new server from scratch with same name, install prerequisites and run bootstrapper, which also was what i decided to do.

For 2012R2 - there is a hotfix for this specific issue:
https://support.microsoft.com/en-us/kb/2957927

In the specific environment where i saw this, the problematic server had a leftover service from a previous Macafee installation named :Mcafee framework service

Still though - Happy SKYPE'ing as always :)