Windows Stop Code RDR_FILE_SYSTEM (0x00000027): Meaning, Parameters, and Troubleshooting
Quick Answer RDR_FILE_SYSTEM is Windows bug check 0x00000027. Microsoft says it indicates a problem in the SMB redirector file system, which participates whe...
Quick Answer
RDR_FILE_SYSTEM is Windows bug check 0x00000027. Microsoft says it indicates a problem in the SMB redirector file system, which participates when a Windows client accesses files on a network share. The first bug-check parameter identifies a category of redirector problem; Parameters 2 and 3 have documented exception-related meanings if RxExceptionFilter is on the stack. Microsoft Learn
Microsoft identifies nonpaged pool depletion as one possible cause. That does not mean every 0x27 crash is caused by insufficient RAM, a failed network connection, or a defective file server. Preserve the dump, read Arg1, inspect the redirector stack, and confirm whether memory pressure or another fault is present. Microsoft Learn
What Is the SMB Redirector?
SMB, or Server Message Block, enables a client computer to access resources on a server, including files on a network share. On the client, Windows uses redirector components to route file operations to that remote resource. Microsoft describes the Redirected Drive Buffering Subsystem (RDBSS) as a kernel-mode component used in the network redirector architecture. Microsoft Learn
A network path such as \\server\share or a mapped drive can involve this machinery. A crash in that path requires investigation of the client’s kernel execution context. The stop code alone does not prove that the remote server or network cable is faulty.
RDR_FILE_SYSTEM Parameters
| Parameter | Microsoft’s description | How to use it |
|---|---|---|
| 1 / Arg1 | Its high 16 bits identify the type of problem. | Compare its leading value with Microsoft’s documented categories below. |
| 2 / Arg2 | Address of the exception record, if RxExceptionFilter is on the stack. |
Interpret only when that condition applies. |
| 3 / Arg3 | Address of the context record, if RxExceptionFilter is on the stack. |
Use with .cxr when applicable. |
| 4 / Arg4 | Reserved. | Do not assign it an undocumented meaning. |
Microsoft’s reference lists several possible Arg1 category values. Retain the complete Arg1 value shown in your dump; the listed prefixes identify the category. Microsoft Learn
| Arg1 category value | Microsoft’s identifier |
|---|---|
0xCA550000 |
RDBSS_BUG_CHECK_CACHESUP |
0xC1EE0000 |
RDBSS_BUG_CHECK_CLEANUP |
0xC10E0000 |
RDBSS_BUG_CHECK_CLOSE |
0xBAAD0000 |
RDBSS_BUG_CHECK_NTEXCEPT |
These labels help direct debugging. A value associated with CLOSE, for example, is a reason to inspect the close path in the stack; it does not by itself name the original faulty driver. Microsoft Learn
The Documented Memory-Pressure Cause
Microsoft says that complete depletion of nonpaged pool can cause this bug check. It also describes a scenario in which available nonpaged pool is already very low during indexing and another kernel-mode driver requests memory, triggering the error. Microsoft Learn
This distinction matters: the driver making the final allocation request may simply be the component that encountered the shortage. If nonpaged pool grows continuously, investigate which component allocated and retained that memory. Microsoft’s PoolMon tool can display pool usage by tag to help investigate a suspected kernel-mode leak. learn.microsoft.com
How to Investigate a 0x27 Crash
1. Record what was happening
Confirm the exact stop code 0x00000027. Note whether the system was opening, saving, copying, closing, or indexing files on a network share. Record the share path, involved application, and time of the crash where available.
This context helps select a reproduction path, but it does not prove the share or application caused the crash.
2. Preserve the crash dump
Keep the dump generated by Windows. A screenshot of RDR_FILE_SYSTEM will not show Arg1’s category or whether RxExceptionFilter was present.
3. Run the initial WinDbg analysis
Open the dump in WinDbg:
!analyze -vRecord the complete Arg1–Arg4 values, stack, and modules. Match Arg1’s high 16 bits to the documented categories. Check whether the same category appears across repeated crashes. Microsoft Learn
4. Inspect the exception context when applicable
If RxExceptionFilter is on the stack and Arg3 identifies the context record described by Microsoft, run:
.cxr <Arg3 address>
kbReplace <Arg3 address> with the value in your dump. Microsoft recommends .cxr with Parameter 3 followed by kb for this debugging path. Do not assume Arg3 is a valid context-record address when RxExceptionFilter is absent. Microsoft Learn
5. Check nonpaged pool and related drivers
If the dump or system behaviour points to memory pressure, examine nonpaged pool use. PoolMon can help identify a pool tag that grows steadily. If the stack points to a particular network redirector, filter, or security driver, investigate that component’s version and vendor guidance. Microsoft Learn
6. Correlate with events and changes
Review Event Viewer → Windows Logs → System around the crash. Note recent changes to network, storage, security, and file-system software. Compare those observations with the dump rather than treating a nearby network error as a complete explanation for the blue screen.
What Should You Fix?
| Evidence from the investigation | Appropriate direction |
|---|---|
| Nonpaged pool is genuinely depleted. | Investigate pool growth and the responsible component. Microsoft also mentions adding physical memory for a confirmed depletion problem. |
| A third-party redirector or filter recurs in relevant stacks. | Seek a supported update or rollback from its vendor. |
| One network-share operation reliably reproduces the crash. | Preserve its exact steps and capture a dump for client-side driver analysis. |
| Only a routine share-connection failure is observed, with no confirmed 0x27 dump. | Troubleshoot SMB connectivity separately; do not assume it is this bug check. |
Microsoft’s suggestion to add physical memory addresses a confirmed nonpaged pool shortage. If a driver leaks pool memory, additional RAM may delay the failure without correcting the leak. Microsoft Learn
Guidance for Driver Developers
Use Arg1 to prioritize the redirector path, then inspect the call stack and any saved exception context. For a repeatable crash, trace the operation indicated by the category, including its request, completion, cleanup, and object lifetime. When memory is low, determine whether the driver on the failing stack consumed the pool or merely encountered its depletion.
RDBSS is part of the network mini-redirector architecture. A module such as rdbss.sys appearing on a stack identifies where execution passed; it does not, by itself, prove that Windows’ RDBSS code is the original source of corruption or a leak. Microsoft Learn
Frequently Asked Questions
What does RDR_FILE_SYSTEM mean?
Windows reported a problem in the SMB redirector file-system path and stopped with bug check 0x00000027. Microsoft Learn
Does it mean the file server is broken?
Not necessarily. The crash occurs on the affected Windows system. Its dump is needed to determine what happened in the client’s redirector path.
What does Parameter 1 identify?
Its high 16 bits identify a documented problem category, including cache support, cleanup, close, and an exception category. Microsoft Learn
Are Parameters 2 and 3 always exception-record pointers?
No. Microsoft assigns those meanings if RxExceptionFilter is on the stack. Microsoft Learn
Can nonpaged pool depletion cause 0x27?
Yes. Microsoft explicitly identifies it as a possible cause. Verify that condition before treating a memory upgrade as a remedy. Microsoft Learn
Should I disable SMB to stop the blue screen?
The stop code does not justify disabling SMB as a general fix. Identify the failing path and underlying cause from the dump; SMB access may be needed for normal work.
What if rdbss.sys appears in the analysis?
It is a relevant component of the network redirector path, but its presence does not establish the original fault. Examine the full stack, Arg1 category, and memory state. Microsoft Learn
Summary
RDR_FILE_SYSTEM (0x00000027) indicates a problem in the SMB redirector file system. Its Arg1 value narrows the reported category, and Arg2–Arg3 describe exception records only under the documented RxExceptionFilter condition. Nonpaged pool depletion is one possible cause. Preserve the dump, inspect the relevant redirector path, and confirm the cause before changing network or memory settings. Microsoft Learn
Sources
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.