• ×
    Information
    Windows update impacting certain printer icons and names. Microsoft is working on a solution.
    Click here to learn more
    Information
    Need Windows 11 help?
    Check documents on compatibility, FAQs, upgrade information and available fixes.
    Windows 11 Support Center.
  • post a message
  • ×
    Information
    Windows update impacting certain printer icons and names. Microsoft is working on a solution.
    Click here to learn more
    Information
    Need Windows 11 help?
    Check documents on compatibility, FAQs, upgrade information and available fixes.
    Windows 11 Support Center.
  • post a message
Guidelines
Any failures related to Hotkey UWP service? Click here for tips.
Check out our WINDOWS 11 Support Center info about: OPTIMIZATION, KNOWN ISSUES, FAQs, VIDEOS AND MORE.
HP Recommended
OMEN Obelisk 875-0127c and OMEN Obelisk 675-0014
Microsoft Windows 10 (64-bit)

I have seen other posts on this issue, but have yet to find a solution.  We have two OMEN Obelisks, mainly being used to complete school work.  The older one (model 675-0014) entered a BSOD loop about a week and a half ago.  We performed a full clean install (wiped everything), which resolved the problem until tonight.  Within a hour of each other, both computers entered the BSOD loop.  I have attempted system restore points (which either fail, or don't resolve the issue), as well as the options to roll back updates and features.  Nothing has worked thus far.  Neither computer will even boot in safe mode, just endless BSOD loops.  Its the last week of school, and this is causing a huge issue.  Any guidance would be greatly appreciated.

 

Additional information:  Both computers installed an HPSF update today!  Tried to restore to point prior, but neither would successfully restore to an earlier point.

6 REPLIES 6
HP Recommended

There is a huge thread with many of us trying to pinpoint the issue. 

https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

 

We have found a workaround for  now:

-----------------------------------------------------

Okay, so a quick summary so far:

 

For most of us, to reproduce the BSOD, we can manually try to turn off Windows Defender in the GUI and immediately get a BSOD with KMODE, but we are able to log back in.  However, when we get the BSOD unexpectedly, usually we go into a boot loop where we can't even get back into Windows, even with safe mode.  The only way to escape that and log back in WITHOUT doing a system restore OR re-installing windows, is to use the system recovery command prompt and disable Windows Defender.

 

If you are in a BSOD boot loop, follow these instructions from @SaltyLager to disable Windows Defender
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

 

  1.  In the recovery screen - go to troubleshoot - advanced options - command prompt.
  2. Login with your password
  3. In the command prompt enter regedit and press enter.
  4. Double-click hkey local machine
  5. Click file - load hive
  6. Browse to C( was D in my recovery environment):\windows\system32\config
  7. Open software
  8. Enter a Key Name, I used temp
  9. Open the temp key, then expand policies - Microsoft - windows defender
  10. Create a 32bit dword DisableAntiSpyware. Set it to 1
  11. Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords set to 1
    1. DisableBehaviorMonitoring
    2. DisableOnAccessProtection
    3. DisableScanOnRealtimeEnable
  12. Scroll back up and highlight the temp key, and then click file unload hive.
  13. Then highlight hkey local machine again, and choose load hive. This time load system from the same location, and set Temp\contolset001\services\windefend start to 4

 

If you are still able to log into your computer and want to disable Windows Defender, follow these instructions from @RJWard
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

 

  1. DISABLE TAMPER PROTECTION via Windows Security \ Virus & Threat protection \ Manage settings.  This is important or defender will continue to reactivate.  DO NOT try to turn of defender while you are in here.
  2. Edit the registry via REGEDIT.  There are FOUR entries to make.
    1. Right click on the folder [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defenderin the registry and add a new DWORD (32) "DisableAntiSpyware" and set it to 1
    2.  Right click again on the same folder in the registry and add a new KEY (folder)  "Real-Time Protection"
      1. Right click on the new key from above (Real-Time Protection) and add the following new DWORD(32) values and set each to 1
        1. "DisableBehaviorMonitoring"
        2. "DisableOnAccessProtection"
        3. "DisableScanOnRealtimeEnable"

 

With Windows Defender disabled, you are unprotected and would recommend downloading a free 3rd party software.  Kaspersky, Avast, AVG, McAfee, etc.

HP Recommended

Is a temporary answer to use a third party software in lieu of Windows Defender?

HP Recommended

Here are steps I performed on my machine, Not sure if it resolves but sharing for others to try out.

 

Disconnected from Internet, created restore points between each step.
Ran SFC /Scannow (Admin Command prompt)
Uninstalled Samgsung NVM Express Controller Driver under Storage Controllers (Windows defaulted it back to windows driver) (Was an error in my event logs maybe unrelated as not original SSD from when purchased)
KB4556799 - found in control panel > add/remove > installed updates and removed this update. 
Ran windows update hide tool (wushowhide.diagcab)(http://download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab) and it found KB2267602 to hide.
Connected back to internet to test.

HP Recommended

@FireBall90 wrote:

Here are steps I performed on my machine, Not sure if it resolves but sharing for others to try out.

 

Disconnected from Internet, created restore points between each step.
Ran SFC /Scannow (Admin Command prompt)
Uninstalled Samgsung NVM Express Controller Driver under Storage Controllers (Windows defaulted it back to windows driver) (Was an error in my event logs maybe unrelated as not original SSD from when purchased)
KB4556799 - found in control panel > add/remove > installed updates and removed this update. 
Ran windows update hide tool (wushowhide.diagcab)(http://download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab) and it found KB2267602 to hide.
Connected back to internet to test.


Do you have the rest of the latest updates?  Can you try manually turning off real-time protection in the Windows Security Settings?  For some of us, when we flip the switch, it BSODs right away.  If it doesn't, it might point to something in KB4556799 making Windows Defender and HP go crazy.  Although many of us had the BSOD boot loop prior to that update.

HP Recommended

@TWYates wrote:

Is a temporary answer to use a third party software in lieu of Windows Defender?


If you can still log into your computer, I would follow the instructions to disable Windows Defender first and then install 3rd party software.  I tried installing Kaspersky before doing that and it BSOD, because it tried to turn off Windows Defender.

HP Recommended

It turns off and on with no problem

† The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the <a href="https://www8.hp.com/us/en/terms-of-use.html" class="udrlinesmall">Terms of Use</a> and <a href="/t5/custom/page/page-id/hp.rulespage" class="udrlinesmall"> Rules of Participation</a>.