- The Windows 2000\XP\.NET Resource Index  
Home | About Us | Search

Last Updated December 10, 2003

  Where to Start
  General Guides
  Boot.ini files
  Boot & Startup Issues
  Emergency Repair Disks
  Error Codes
  Event Logging
  Dr Watson
  Hang Conditions
  How to Guides
  Memory Dumps
  Memory Leaks
  Performance Tuning
  Recovery Console
  Task Manager
  Technical Articles
  Win2k Install Bugs
  WinNT Upgrade Bugs
  Win9x Upgrade Bugs

 Related Resources
  Hardware Guides
  Printer Mgmt
  Service Packs



LabMice Tip

Get a grip on Memory leaks and poor performance by using MemTurbo on your workstations and servers. It really works!

Click here to download a FREE no-nags evaluation copy!



Current Pricing




Memory Leaks

Memory leaks were a common problem in NT, and although they're a bit less common in Windows 2000, they can still bring a well built server to it's knees if you don't catch them. These leaks occur when a memory is allocated to a program or process, but not released. If repeated over time, memory leaks can cause the system to allocate all available memory (physical memory and paging file space), and cause the Operating System to hang until the system releases the memory.

Where to start...

Finding and Fixing NT Memory Leaks
By Paula Sharick, WindowsNT Magazine Feb 1999. Check out Paula's related articles Resource Kit Tools for Diagnosing and Monitoring Memory Leaks as well as her Shortcuts for spotting Memory Leaks. There is also a Guide to TechNet articles regarding NT memory Leaks here

How to Detect a Memory Leak By Using System Performance Monitor in Windows 2000
Microsoft Knowledge Base Article Online Support site WebCast: This presentation explains how to detect memory leaks using System Performance Monitor in Microsoft Windows 2000.

How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks 
Microsoft Knowledge Base Article: 177415 - This article describes how to use the Windows NT 4.0 utility, Poolmon.exe, as a troubleshooting tool to monitor memory tags. This information can be used by Microsoft Technical Support to find kernel mode memory leaks.

Umdhtools.exe: How to Use Umdh.exe to Find Memory Leaks 
Microsoft Knowledge Base Article: 268343 - The user-mode dump heap (UMDH) utility works with the operating system to analyze Windows heap allocations for a specific process. This utility, and the other tools associated with it, are primarily targeted for Windows 2000 and Windows XP.

Using Performance Monitor To Identify A Pool Leak
Microsoft Knowledge Base Article: 130926 A memory leak occurs when a memory pool allocates some of its memory to a process and the process does not return the memory. When this happens repeatedly, the memory pool is depleted. 

Sources of Memory Leaks

256 MB of Physical Memory Appears to Be Missing When 4 GB of Memory Is Installed
Microsoft Knowledge Base Article: 279151 - If you are using a computer that has over 4 gigabytes (GB) of memory installed, System properties, Microsoft System Diagnostics (WinMSD) or other system utilities report a memory value that is 256 megabytes (MB) less than the total physical memory that is installed.

A Nonpaged Memory Leak Occurs in Tcpip.sys 
Microsoft Knowledge Base Article: 317854 - System Monitor may display a steady increase in pool nonpaged bytes and the computer may stop responding (hang). The memory leak occurs on Windows 2000-based servers that run Routing and Remote Access and virtual private networking (VPN). you analyze the nonpaged pool tags you determine that NDPt is the largest consumer of nonpaged pool. 

Denial-of-Service Attack on Port 1720 May Cause a Memory Leak in Conf.exe 
Microsoft Knowledge Base Article: 299796 - A port attack on port 1720, which is used by the Microsoft NetMeeting Remote Desktop Sharing (RDS) process, may cause a memory leak. When this occurs, Conf.exe consumes all available memory and 50 percent of the CPU usage. 

DNS Service Memory Leak
Microsoft Knowledge Base Article: 258282 - The amount of memory being used by Dns.exe may continually grow and may not plateau, or memory may not be returned to the system over time. The rate of growth of the memory leak depends on the number of queries the server receives per hour. 

Dismounting an NTFS Volume May Cause Nonpaged Pool Memory Leak
Microsoft Knowledge Base Article: 288899 - If a volume is repeatedly mounted and dismounted, the NTFS file system may leak a small amount of nonpaged memory each time that the volume is dismounted. You can observe the leak in the NtFL pool tag by using PoolMon.exe.

FIX: Memory Leak When Calling Between Configured Components
Microsoft Knowledge Base Article: 265379 - A memory leak can occur when you make calls between components that reside in different contexts in a COM+ application. The memory leak occurs only when the call is made through the IDispatch interface. 

Kernel Mode Memory Leak Caused by Invalid TCP Checksums on Port 3389
Microsoft Knowledge Base Article: 292435 - A Windows 2000-based computer that is running Terminal Services may exhibit a kernel mode memory leak in the nonpaged pool. Networking services on the computer may eventually stop responding to client requests. 

LSA Memory Leak Due to SetPassword Call
Microsoft Knowledge Base Article: 288861 - When you use the System Monitor tool, you may notice memory leaks in the Local Security Authority (LSA) during a Kerberos change-password request or when LSA loads a security package. You may need to restart the computer to restore performance and to shrink Lsass.exe. 

Malformed Request to Domain Controller Can Cause Memory Exhaustion 
Microsoft Knowledge Base Article: 294391 -  A core service that runs on all Windows 2000 domain controllers (but not on any other computers), contains a memory leak that can be triggered when the service attempts to process a certain type of invalid service request. By repeatedly sending such a request, an attacker could deplete the available memory on the server. If memory were sufficiently depleted, the domain controller (DC) could become unresponsive, which would prevent it from processing logon requests or issuing new Kerberos tickets. Note that an affected computer could be restored to service by rebooting 

Mapping Shared Local Printers to Central Share Causes Server to Crash, Generates Event ID 2020 from SRV
Microsoft Knowledge Base Article: 286060 - When you have several shared local printers that are attached to Microsoft Windows 98-based clients on your network, and you map the shared local printers to a central share on a server running Microsoft Windows 2000, the server may crash and log the following Event ID 2020 error from source SRV: "The server was unable to allocate from the system paged pool because the pool was empty.  

Memory and Critical Section Leak in CExpire::GetExpireBlockProperties
Microsoft Knowledge Base Article: 253606 - The Windows 2000 NNTP service contains a minor memory leak in the newsgroup expiring process. 

Memory Leak in Atmuni.sys in Windows 2000
Microsoft Knowledge Base Article: 277722 - Atmuni.sys leaks memory if an NDIS miniport driver disables Interim Local Management Interface (ILMI).

Memory Leak in Internet Explorer When Background Image Is Resized
Microsoft Knowledge Base Article: 254637 - When a background image is resized by using Dynamic Hyper-Text Markup Language (DHTML) code, a memory leak occurs in Internet Explorer. 

Memory Leak in Keyboard and Mouse Class Drivers When You Unplug and Plug In USB Keyboard or Mouse
Microsoft Knowledge Base Article: 278323 - After you unplug and plug in a Universal Serial Bus (USB) keyboard or mouse several times (approximately 42), the system stops sending I/O system event error messages to the event log. 

Memory Leak in Lsass.exe with Large Built-in Groups
Microsoft Knowledge Base Article: 262539 - You might observe a memory leak in Lsass.exe private bytes with the System Monitor tool. 

Memory Leak in Pdh.dll Querying Performance Counters That Do Not Exist
Microsoft Knowledge Base Article: 263221 - When you query performance counters that do not exist, a memory leak in Pdh.dll occurs.

Memory Leak When Deleting File Control Blocks
Microsoft Knowledge Base Article: 262825 - When a program accesses files by using File Control Blocks (FCBs), memory may be leaked each time the program closes a file. Over time, this can cause low-memory error messages.

Memory Leak When You Gather Performance Counter Information on a Remote Server
A custom performance-monitoring program that obtains thread-count counter information on a remote server by using Performance Data Helper functions may leak memory. The leak occurs not only in the custom client program but also in the Regsvc.exe on the remote server 

Memory Leak When You Search for Group Policy Object Links 
Microsoft Knowledge Base Article: 310605 - When you use the Microsoft Management Console (MMC) to search for Group Policy object (GPO) links, memory may be leaked. You can find this memory leak in the Active Directory User and Computers snap-in if you click Properties for any GPO, and then click Find Now on the Links tab to search for links. The memory is released when you quit MMC.

Memory Manager Allocates Paged Pool Before it Is Needed
Microsoft Knowledge Base Article: 280790 - A Windows 2000-based computer may become unstable and allocate large amounts of paged pool memory. Also, the computer may not be able to open large files, and the computer may not be visible on the network. 

Multiple LDAP Binds to the Same Connection Cause Memory Leak
Microsoft Knowledge Base Article: 289644 - On a Windows 2000-based domain controller, multiple Lightweight Directory Access Protocol (LDAP) binds over the same connection to that domain controller cause a memory leak. 

Network Load Balancing WMI Provider Memory Leak
Microsoft Knowledge Base Article: 266375 - The Network Load Balancing (NLB) Windows Management Instrumentation (WMI) provider leaks significant amounts of memory in the Winmgmt process. In testing scenarios, the leak has been as much as 20 MB in 10 hours. 

NNTP Service in Windows 2000 Contains a Memory Leak 
Microsoft Knowledge Base Article: 303984 - The Network News Transfer Protocol (NNTP) service in Windows 2000 contains a memory leak in a routine that processes news postings. Each time a posting that contains a particular construction is processed, the memory leak causes a small amount of memory to no longer be available for use. If an attacker were to send a large number of posts, the server memory could be depleted to the point that normal service would be disrupted. An affected server could be restored to normal service by rebooting the server.

Non-Paged Pool Memory Leak on Master Browser
Microsoft Knowledge Base Article: 262386 - A server that is acting as a master browser (commonly a primary domain controller in Windows NT 4.0) may leak non-paged pool memory. 

OHCI1394 Driver May Cause a Memory Leak During Asynchronous Write Operation
Microsoft Knowledge Base Article: 260055 - A memory leak in the non-paged pool can be observed when a driver uses a REQUEST_ASYNC_WRITE request to perform an asynchronous write with certain parameters. 

Entire contents
© 1999-2003 and TechTarget
All rights reserved

This site and its contents are Copyright 1999-2003 by Microsoft, NT, BackOffice, MCSE, and Windows are registered trademarks of Microsoft Corporation. Microsoft Corporation in no way endorses or is affiliated with The products referenced in this site are provided by parties other than makes no representations regarding either the products or any information about the products. Any questions, complaints, or claims regarding the products must be directed to the appropriate manufacturer or vendor.