STOP 0x00000035 NO_MORE_IRP_STACK_LOCATIONS error when shadowing on XenApp 6

This issue started occurring when testing a newly build XenApp 6 server. When shadowing a user from this newly built XenApp 6 server the newly built server would bluescreen with STOP 0x00000035 NO_MORE_IRP_STACK_LOCATIONS as soon as the user accepted the shadow prompt.
I analysed a memory dump and found mup.sys to be the faulting module and I soon found I wasn’t the only one seeing this issue.

After a couple of days constantly tweaking the build process it looks like I have a fix. The build process was:
deploy OS image > install Windows Updates > install XenApp & applications > install Windows updates
and this equalled a bluescreen when shadowing

I then tried this process:
deploy OS image > install XenApp & applications
and hurray, no bluescreen, but we really do need those 80 odd security patches!

This was next:
deploy OS image > install XenApp & applications > install Windows Updates
Now things are getting interesting! With this process Windows Updates failed to install KB2467175 which is a VC++ 2005 update, but still no bluescreen

Finally this process worked:
deploy OS image > install XenApp & applications > install vcredist_x64 & vcredist_x86 > install Windows Updates

Installing KB2467175 prior to XenApp was causing the bluescreen, but attempting to install KB2467175 after XenApp caused KB2467175 to fail. The answer was to download the vcredist executables and silently install them prior to running Windows Update (which installs KB2467175).

The VC++ executables are silently installed using the commands:
vcredist_x64.exe /q:a
vcredist_x86.exe /q:a

This worked for us, hopefully it will for you too!

EDIT – 7 May 2011: The above did not fully fix this issue, as I saw the same BSOD again. This time I uploaded the dump to Citrix who provided a private hotfix named “258948V1” which updates icatdpipe.sys. So far, so good.

EDIT – 23 June 2011: Citrix have released a public hotfix for this issue: XA600W2K8R2X64062


  1. Anonymous says:

    Is there another way this KB2467175 might appear? I cannot find that item installed on my image.

  2. Jason Poyner says:

    You can use this PowerShell command to double check if the hotfix is installed:
    get-hotfix | select HotfixID | where {$_.HotfixID -eq “KB2467175”}

    Perhaps there is also an older version of a vcredist update that also causes the issue? Maybe this:

Leave a Reply

Your email address will not be published. Required fields are marked *

Contact Deptive

Level 13 (Regus)
92 Albert St
We also have a virtual office in Wellington.

Contact Details

0800 000 141

Postal Address
PO Box 34797,
Birkenhead, Auckland 0746