VM Machine's BSOD stop code 224 security Audit

[buzzlightyear_2]

HI over the last 4 days we have had 4 servers show the BSOD with stop code 224 secuirty audit.

I've had a quick scan online and cannot find anything related to windows 2008 about this. Wondering if it could be related to vSphere and if anyone else had seen it?

Host ESXI 4.1

Guest Windows 2008

Each server had the following event in the event viewer.

Not saying it's related to Vmware just asking for advise.

[VirtuallyMikeB]

Good day,

Were these VMs P2V'd?  If so, did you clean up the hardware after virtualizing them?  If not, try Kendrick Coleman's VM Advanced ISO and post-P2V scripts.

http://www.kendrickcoleman.com/index.php?/Tech-Blog/vm-advanced-iso-free-tools-for-advanced-tasks.ht...

Cheers,

Mike

http://VirtuallyMikeBrown.com

https://twitter.com/#!/VirtuallyMikeB

http://LinkedIn.com/in/michaelbbrown

[buzzlightyear_2]

No these machines would of been deployed from a template not P2V. They have been running for some time now this is the first time I've seen the problem.

Is it just co-incidence that I've had 4 fail with the same stop code over the last couple of days? 

[dales123]

Oe or two I could possibly put down to coincedence but 4..... I guess the next question is has anything changed, have you updated ESXi with VUM recently, has your guest patch management pushed out anything, what about your AV protection how frequent is the issue and what happens if you disable the protection for a while.

I've seen issues with bad a av patches before not this specific issue but it is worth having a quick look at your vendors forum or giving them a quick tinkle to see if they have had any other reports.

[buzzlightyear_2]

We've not updated with VUM or anything else for that matter.

regarding AV we have both phsyical and Virtual machines all running the same AV version and updates. I've only had the problem on Virtual machines.

Since Monday 4 machines have shown the BSOD, each one has been under a different host and datacentre 1 of which is managed via a different Vcentre.

Patching was last performed 2 weeks ago therefore the VM has been stable for 2 weeks before it started to occur.

Interesting....I notify if another one goes down.

[buzzlightyear_2]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail causing the problem