PDC keeps crashing w/ "The server was unable to allocate from the system nonpaged pool because the pool was empty"

Posted on 2004-09-27
Last Modified: 2013-12-28
Our server keeps loosing connectivity and upon inspection has the following Event in the System Log:
"The server was unable to allocate from the system nonpaged pool because the pool was empty."

From what I've read, this appears to be a memory leak issue, but I can't seem to track it down.  After several crashes and lots of irritated user calls, I promoted by BDC and was getting ready to wipe the PDC.  Well, before I even got a chance to re-build the PDC, the BDC crashed w/ the same issue.  So something in our network is causing it, but it's not the PDC.

I'm in an Enterprise environment and we recently completed our migration to AD.  The NT servers are still necessary until we are able to migrate our Exchange 5.5 server to 2003.  Also, there is a team currently planning and testing SMS.  Based on what I've read, I'm leaning toward the SMS rollout as a possible cause.  Any input is greatly appreciated.
Question by:Geckotek
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Accepted Solution

rmullins earned 500 total points
ID: 12164498
Well, the bad news is there are enless things that can be causing this...

The good news is that if you are diligent and use Perfmon effectively (log on a different machine at an interval of something like 30 seconds or a minute to start narrowing it down so that you don't hammer the system gathering a zillion statistics every second). To save myself lots of typing, here's how to track it down:;en-us;130926

It is a pain, but if you are fairly savvy, you'll find the cause leveraging these techniques.
LVL 16

Expert Comment

ID: 12176952
just an idea, that it is poassible that this is a virus infection, this error message appears whenit has more than 4,094 simultaneous open connections, in a way your server may be abused by a network virus for all these connections to be opened, it had a similar problem but with my firewall that dropped connections because they exceeded 2048 and it was caused by a virus infection

unless your SMS deplyment/testing is causing all these connections to be opened

you may have a look at this as well:;en-us;272194&Product=nts40

if you run Norton Corporate Edition then you may have a look at this:;en-us;272568&Product=nts40

and possibly SMS uses winsock a lot, so you may have a look at this:;en-us;293841&Product=nts40



Expert Comment

ID: 12212919
Is the event log, is the error # 2019???

When you run a TCP/IP sockets based program on a Windows NT computer a non- paged pool memory leak occurs. When the memory leak occurs for a while it causes Windows NT to malfunction and the following out of memory error appears in the system log:

Event ID 2019

The server was unable to allocate from the system nonpaged pool because the pool was empty.

To determine that there is a memory leak:

   1. Run Performance Monitor.
   2. From the Edit menu, choose Add To Chart.
   3. In the Object field, select Memory.
   4. In the Counter field:
         1. Select Pool Nonpaged Bytes and choose Add.
         2. Select Pool Paged Bytes and choose Add.
   5. Choose Done and watch Performance Monitor in Chart view mode.

      If the Nonpaged value rises rapidly while the TCP/IP sockets program is running then you may be experiencing this problem.

Example configurations under which this problem may occur:

    * Systems Management Server needs to communicate with an SQL server.
    * A SQL default client is configured for sockets - not Named Pipes.
    * TCP/IP is installed on the server, but SQL Server is not set up to use it. SQL Server is designed to use Named Pipes only.
    * Systems Management Server uses the default SQL client configuration for sockets.
    * Systems Management Server attempts to access SQL using sockets repeatedly.

This problem can be caused by a TCP/IP sockets program that continuously attempts to open a socket port that does not exist.

To work around this problem, correct your TCP/IP sockets program so that it does not attempt to open the unsupported socket port.

Expert Comment

ID: 12334749
hi, there

to narrow down what the guy's are here saying would it be possible to install / insert a network packet sniffer on the subnet where the server reside if not you could add a additional subnet make a route and then insert a Network packet sniffer to see if there is something going on at the network part.

how much space is left on the OS Partition on each of these server's (are the also running as a print server ?)).
If print server where does the spooler reside on each printer ?.

If there is a lot of space assigned in your enterprise could you try move the print spooler + Page file ...

What does that give us.

Featured Post

What Is Transaction Monitoring and who needs it?

Synthetic Transaction Monitoring that you need for the day to day, which ensures your business website keeps running optimally, and that there is no downtime to impact your customer experience.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question