Certain system cleaning tools have started causing Blue Screen of Death (BSOD) errors during operation. This issue arises because these tools stop the Cryptographic Services to clear the Windows Update cache and residuals. Consequently, this action triggers a crash in the Smartlocker Filter Driver, which depends on this service, resulting in a BSOD caused by applockerfltr.sys.
Recommended Solution: Developers should avoid stopping the cryptSvc service and simply skip any locked update files during the cleaning process.
For example, this net command can trigger this BSOD: net stop cryptSvc /y
Sample crash dump file:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen and saved in
KiBugCheckDriver.
Arguments:
Arg1: fffff800b56b9cb0, memory referenced
Arg2: 0000000000000010, value 0 = read operation, 1 = write operation
Arg3: fffff800b56b9cb0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, Mm internal code.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2984
Key : Analysis.Elapsed.mSec
Value: 5076
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 24
Key : Analysis.Init.CPU.mSec
Value: 1718
Key : Analysis.Init.Elapsed.mSec
Value: 139435
Key : Analysis.Memory.CommitPeak.Mb
Value: 86
Key : Analysis.Version.DbgEng
Value: 10.0.29507.1001
Key : Analysis.Version.Description
Value: 10.2511.5.1 amd64fre
Key : Analysis.Version.Ext
Value: 1.2511.5.1
Key : Bugcheck.Code.LegacyAPI
Value: 0xce
Key : Bugcheck.Code.TargetModel
Value: 0xce
Key : Dump.Attributes.AsUlong
Value: 0x21008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0x0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: 0xCE_IMAGE_applockerfltr.sys
Key : Failure.Exception.IP.Address
Value: 0xfffff800b56b9cb0
Key : Failure.Exception.IP.Offset
Value: 0x9cb0
Key : Failure.Hash
Value: {5ccfe20f-9331-5cc0-a343-cb03251a3db7}
Key : Faulting.IP.Type
Value: Unloaded
Key : WER.System.BIOSRevision
Value: 5.29.0.0
BUGCHECK_CODE: ce
BUGCHECK_P1: fffff800b56b9cb0
BUGCHECK_P2: 10
BUGCHECK_P3: fffff800b56b9cb0
BUGCHECK_P4: 0
FILE_IN_CAB: 013126-17031-01.dmp
DUMP_FILE_ATTRIBUTES: 0x21008
Kernel Generated Triage Dump
FAULTING_THREAD: ffffe20eb574e040
WRITE_ADDRESS: fffff800e23c44c0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
fffff800b56b9cb0
IMAGE_NAME: applockerfltr.sys
MODULE_NAME: applockerfltr
FAULTING_MODULE: 0000000000000000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
IP_MODULE_UNLOADED:
<Unloaded_applockerflt>+9cb0
fffff800`b56b9cb0 ?? ???
STACK_TEXT:
ffffe088`ac959f58 fffff800`e174032d : 00000000`00000050 fffff800`b56b9cb0 00000000`00000010 ffffe088`ac95a1c0 : nt!KeBugCheckEx
ffffe088`ac959f60 fffff800`e172d356 : ffffe088`ac95a068 ffff8000`00000000 fffff800`b56b9cb0 0000007f`fffffff8 : nt!MiSystemFault+0x78d
ffffe088`ac95a050 fffff800`e1ab12cb : 00000000`00000000 00000000`00000000 fffff800`e22f6de0 00000000`00000000 : nt!MmAccessFault+0x646
ffffe088`ac95a1c0 fffff800`b56b9cb0 : fffff800`e1e9292c ffffe088`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x38b
ffffe088`ac95a358 fffff800`e1e9292c : ffffe088`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : <Unloaded_applockerflt>+0x9cb0
ffffe088`ac95a360 fffff800`e189a152 : ffffe20e`d0f42920 00000000`00000000 fffff800`e23cfb40 ffffe20e`b5978c20 : nt!CmFcpFeatureUsageProviderSubscriptionWrapper+0x3c
ffffe088`ac95a390 fffff800`e171e74b : ffffe20e`b574e040 ffffe20e`c28d8c00 00000000`00000000 ffffe20e`b5978c20 : nt!CmpWorkItemWrapper+0x42
ffffe088`ac95a3c0 fffff800`e188c4da : ffffe20e`b574e040 ffffe20e`b574e040 fffff800`e171e290 ffffe20e`b5978c20 : nt!ExpWorkerThread+0x4bb
ffffe088`ac95a570 fffff800`e1aa32d4 : ffffd001`3621a180 ffffe20e`b574e040 fffff800`e188c480 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
ffffe088`ac95a5c0 00000000`00000000 : ffffe088`ac95b000 ffffe088`ac954000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34
STACK_COMMAND: .process /r /p 0xffffe20eb5725040; .thread 0xffffe20eb574e040 ; kb
FAILURE_BUCKET_ID: 0xCE_IMAGE_applockerfltr.sys
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5ccfe20f-9331-5cc0-a343-cb03251a3db7}
Followup: MachineOwner
