ZCM 11.2.3: BSOD on devices after installing agent

  • 7011969
  • 18-Mar-2013
  • 14-Apr-2015


Novell ZENworks Configuration Management 11.2.3


Windows blue screen of death (BSOD) is happening on devices, mostly happening on laptops, upon the second reboot after the ZCM 11.2.3 agent has been installed. 


This is fixed in version 11.2.3a - see KB 7011295 "ZENworks Configuration Management 11.2.3a - update information and list of fixes" which can be found at https://support.microfocus.com/kb/doc.php?id=7011295

Workaround: for affected machines, boot into safe mode and use "Last Known Good" configuration: that's not a fix, but should allow the device to function.


There have been some issues noted in 11.3.x code where if/when the system is restarting an invalid registry key is written out for the service entry for ZESDAC. 

Bring up in registry:


Confirm whether the "Start" DWORD is usually missing. 

If this is the case, then the filter driver needs to be manually removed from the 4 devices stacks it's attached to.

There are 4 registry keys that need to be cleaned up in this case. 

The one key affects the BSOD, but the other keys affect the functionality of the floppy disk drive, USB drives, and CDROM/DVD. 

So for each of the registry keys below, open up the multistring regValue key and REMOVE "zesdac" from the list. This issue will be addressed in the 11.3.2.x releases of ZEN.

regKey = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E 967-E325-11CE-BFC1-08002BE10318}";//DISK DRIVE
regValue = "LowerFilters";

regKey = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E 980-E325-11CE-BFC1-08002BE10318}";//FLOPPY DRIVE
regValue = "UpperFilters";

regKey = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E 965-E325-11CE-BFC1-08002BE10318}";//CDROM
regValue = "LowerFilters";

regKey = "SYSTEM\\CurrentControlSet\\Control\\Class\\{36FC9 E60-C465-11CF-8056-444553540000}";//USB
regValue = "LowerFilters";

Additional Information

The issue only happens if the following are true on the device.
- A 3rd party driver exists in the disk drive stack that has inserted itself ahead of the zesdac driver.  To verify if this is the case, check the registry key
The LowerFilters entry has 2 values and ZESDAC exists but is NOT the first one listed.  If there is only 1 value or zesdac is not listed here, the problem will not happen if the device is updated to 11.2.3.
- Agent Self Defense (ASD) has been disabled on the device or zone prior to 11.2.3 being installed.
- Agent was upgraded from 11.x to 11.2.3.  Devices upgraded from 10.3.x or 11.2.3 installed new should not have this issue.
- ZESM or ZFDE are not installed on the device.