Citrix Presentation Server 4.0 issue with Windows 2003.

Couples of forums are going through an issue for Citrix Presentation Server 4.0. This issue is related to Citrix and Microsoft both. Windows is causing a STOP error on servers having Citrix Presentation Server installed. This is caused because of a conflict between Win32k.sys and WDICA.sys module of Citrix.
�
Currently Citrix is handling all the cases one by one and then supply a private hotfix as the replacement of WDICA.sys file. We have suffered the same and after analyzing the dump, we have found that WDICA.sys and Win32k.sys are conflicting with each other.
�
We have unexpected shutdown on many of our production server on which Cirix Presentation Server 4.0 is installed. After analyzing memory dumps we have found that this is being caused by WDICA.sys and Win32k.sys system modules. WDICA.sys is the module being used by Citrix application and responsible for communication between Citrix Server and ICA Client. Win32k.sys is the Windows Kernel module and always active to process requests coming from other sub-components of Kernel. There was a page fault at the following address for WDICA.sys driver/module:
�
1.�������� 91c84184 8082cffc 0000008e c0000005 8087bb96 nt!KeBugCheckEx+0x1b
2. ������� 91c84548 808896e2 91c84564 00000000 91c845b8 nt!KeTerminateThread+0xee2�������������� Thread terminated unexpectedly !
3. ������� 91c845c8 80830e58 91c84628 8b371100 80892853 nt!Kei386EoiHelper+0x1d2
4. ������� 91c8462c f4515208 0000000c f4515526 878b4000 nt!ZwYieldExecution+0x19f8
�
����������� 91c84668 f4515907 878b4000 91c8468c 00000000 WDICA+0x12208
����������� 91c84684 f451621e 00000200 91c846d8 88539ff8 WDICA+0x12907
����������� 91c8469c f4516500 878b4000 f452627a 878b4000 WDICA+0x1321e
����������� 00000000 00000000 00000000 00000000 00000000 WDICA+0x13500
�
After analyzing DC (memory area: 1,2,3,4) of module in memory.dmp generated by �servers, I have found that one of the function from WDICA.sys replaced the memory area forcefully (because both the process/threads run in higher priority so anyone can replace each others memory area) used by Kernel module (Win32k.sys) and this resulted in termination of all the threads of Win32k.sys. Since Win32k.sys is a Kernel component, any termination in Kernel thread results in system crash or STOP error. After digging more into this, I found that this is an issue with both the modules. The new functions in Citrix module are conflicting with Win32k.sys while shadowing a user session from one Citrix server to another Citrix server. Users keep shadowing session for their purpose and after about 2-3 minutes one of the servers reboots with STOP error.
�
Solution and couple of points:
�
1. Its happening because of the two modules: Win32k.sys and WDICA.sys. Probably replacing WDICA.sys should be okay for now but its good to replace Win32k.sys too. A hotfix from Microsoft is available to replace the Win32k.sys module. Please note: Win32k.sys replacement is part of Service Pack 2 and Microsoft recommends to upgrade its product with latest version but one can obtain Wn32k.sys separately from Microsoft.
�
����������� http://support.microsoft.com/kb/907966
�
2. For WDICA.sys � You should contact Citrix to obtain the old version of WDICA.sys module. The file version must be 4.0.2198.1.
�
3. It started since when Hotfix replaced the module WDICA.sys with latest version.�
�
4. It happens when shadowing a user on another server. For example, Administrator is on Citrix1 shadowing a user on Citrix2 and after 2-5 minutes Citrix2 reboots with STOP error.
�

Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.