MICROSOFT CORPORATION AND/OR ITS RESPECTIVE SUPPLIERS MAKE NO REPRESENTATIONS ABOUT THE SUITABILITY, RELIABILITY, OR ACCURACY OF THE INFORMATION AND RELATED GRAPHICS CONTAINED HEREIN. ALL SUCH INFORMATION AND RELATED GRAPHICS ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT AND/OR ITS RESPECTIVE SUPPLIERS HEREBY DISCLAIM ALL WARRANTIES AND CONDITIONS WITH REGARD TO THIS INFORMATION AND RELATED GRAPHICS, INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, WORKMANLIKE EFFORT, TITLE AND NON-INFRINGEMENT. YOU SPECIFICALLY AGREE THAT IN NO EVENT SHALL MICROSOFT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF USE, DATA OR PROFITS, ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE USE OF OR INABILITY TO USE THE INFORMATION AND RELATED GRAPHICS CONTAINED HEREIN, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, EVEN IF MICROSOFT OR ANY OF ITS SUPPLIERS HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES.
Citrix WDICA.sys and Win32k.sys conflicting with each other and causes System crash or STOP error.
Couples of forums are going through an issue for Citrix Presentation Server 4.0. This issue is related to Citrix and Microsoft both. Windows is causing a STOP error on servers having Citrix Presentation Server installed. This is caused because of a conflict between Win32k.sys and WDICA.sys module of Citrix.
Currently Citrix is handling all the cases one by one and then supply a private hotfix as the replacement of WDICA.sys file. We have suffered the same and after analyzing the dump, we have found that WDICA.sys and Win32k.sys are conflicting with each other.
We have unexpected shutdown on many of our production server on which Cirix Presentation Server 4.0 is installed. After analyzing memory dumps we have found that this is being caused by WDICA.sys and Win32k.sys system modules. WDICA.sys is the module being used by Citrix application and responsible for communication between Citrix Server and ICA Client. Win32k.sys is the Windows Kernel module and always active to process requests coming from other sub-components of Kernel. There was a page fault at the following address for WDICA.sys driver/module:
After analyzing DC (memory area: 1,2,3,4) of module in memory.dmp generated by servers, I have found that one of the function from WDICA.sys replaced the memory area forcefully (because both the process/threads run in higher priority so anyone can replace each others memory area) used by Kernel module (Win32k.sys) and this resulted in termination of all the threads of Win32k.sys. Since Win32k.sys is a Kernel component, any termination in Kernel thread results in system crash or STOP error. After digging more into this, I found that this is an issue with both the modules. The new functions in Citrix module are conflicting with Win32k.sys while shadowing a user session from one Citrix server to another Citrix server. Users keep shadowing session for their purpose and after about 2-3 minutes one of the servers reboots with STOP error.
Solution and couple of points:
1. Its happening because of the two modules: Win32k.sys and WDICA.sys. Probably replacing WDICA.sys should be okay for now but its good to replace Win32k.sys too. A hotfix from Microsoft is available to replace the Win32k.sys module. Please note: Win32k.sys replacement is part of Service Pack 2 and Microsoft recommends to upgrade its product with latest version but one can obtain Wn32k.sys separately from Microsoft.
2. For WDICA.sys – You should contact Citrix to obtain the old version of WDICA.sys module. The file version must be 4.0.2198.1.
3. It started since when Hotfix replaced the module WDICA.sys with latest version.
4. It happens when shadowing a user on another server. For example, Administrator is on Citrix1 shadowing a user on Citrix2 and after 2-5 minutes Citrix2 reboots with STOP error.