I was able to get the following info after running the user.dmp file from Dr. Watson through a debugger (cut and paste from what looked most important):
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: winlogon.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00eda000
BUGCHECK_STR: ACCESS_VIOLATION
LAST_CONTROL_TRANSFER: from 01026276 to 7c9012f1
STACK_TEXT:
0006f634 01026276 00ed9ff8 0006f678 00000104 ntdll!RtlInitUnicodeString+0x1b
0006f890 01026506 0006f8a8 00000000 00079840 winlogon!GetScreenSaverInfo+0x3fa
0006f8d4 00000000 00000000 00000000 00000002 winlogon!RunScreenSaver+0x6e
It originally referenced an error regarding winlogon.exe with the faulting module being ntdll.dll. Would it be safe to say it was something video related since it's referencing something about starting the screensaver in the above info? If it matters this was on an Optiplex 320.
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: winlogon.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00eda000
BUGCHECK_STR: ACCESS_VIOLATION
LAST_CONTROL_TRANSFER: from 01026276 to 7c9012f1
STACK_TEXT:
0006f634 01026276 00ed9ff8 0006f678 00000104 ntdll!RtlInitUnicodeString+0x1b
0006f890 01026506 0006f8a8 00000000 00079840 winlogon!GetScreenSaverInfo+0x3fa
0006f8d4 00000000 00000000 00000000 00000002 winlogon!RunScreenSaver+0x6e
It originally referenced an error regarding winlogon.exe with the faulting module being ntdll.dll. Would it be safe to say it was something video related since it's referencing something about starting the screensaver in the above info? If it matters this was on an Optiplex 320.