Terminal Server 2003 hangs after a number of hours

Posted on 2007-08-09
Last Modified: 2013-11-05
I have a very annoying problem. We have a Windows 2003 Terminal server Xeon 3Ghz with 3GB ram. Ten users
Ram and CPU never appeared to be over taxed bothered.

AV is Trend Micro with real time scanning disabled

Every other day, maybe consecutive days or work for a few days and then basically stop working . Users complain they can no longer access files on the main file server and if they log off , when they try and log back on the system says that it cannot load their user profile. (Local no roaming) Plenty of space on the C: Drive
We get different messages such as not being able to Windows cannot access the file gpt.ini for GPO,
An I/O operation initiated byt the Registry failed unrecoverably and a number of others.

I suspected system non-paged pool memory. I adjusted the registry as per some tech articles.

The really strange thing is that it only ever happens after 3:00 in the afternoon on an irregular basis.

Any ideas.

Question by:flynnpaul
    LVL 13

    Expert Comment

    Anything in the system event log?  What is your pagefile set to?  It should be 1.5x RAM at a minimum in a TS environment.
    LVL 23

    Expert Comment

    by:Malli Boppe
    I think its the problem with the Trend.Stop the trend service to see if that makes any difference.
    Also check the open files for each users.I
    LVL 19

    Expert Comment

    What about resources....are u monitoring your CPU..RAM could create warn you when low limits are reached.
    LVL 2

    Expert Comment

    Not sure if this helps but we're having the same or similar issue on our exchange server.  Wanted to put this online for anyone else having a similar problem since google isn't yielding much on my particular issue.  

    Every day, for the past 4 days, my exchange server (has some network files), has done this non paged memory nonsense.

    Event Type:     Error
    Event Source:   Srv
    Event Category: None
    Event ID:       2000
    Date:           11/4/2007
    Time:           4:46:59 PM
    User:           N/A
    Computer:       <<servername>>
    The server's call to a system service failed unexpectedly.

    For more information, see Help and Support Center at  <>
    0000: 00 00 04 00 01 00 54 00   ......T.
    0008: 00 00 00 00 d0 07 00 c0   ....Ð..À
    0010: 00 00 00 00 0a 01 00 c0   .......À
    0018: 00 00 00 00 00 00 00 00   ........
    0020: 00 00 00 00 00 00 00 00   ........
    0028: 34 03 bd 00               4.½.

    Event Type:     Error
    Event Source:   Srv
    Event Category: None
    Event ID:       2020
    Date:           11/6/2007
    Time:           8:50:37 AM
    User:           N/A
    Computer:       <<servername>>
    The server was unable to allocate from the system paged pool because the pool was empty.

    For more information, see Help and Support Center at  <>
    0000: 00 00 04 00 01 00 54 00   ......T.
    0008: 00 00 00 00 e4 07 00 c0   ....ä..À
    0010: 00 00 00 00 9a 00 00 c0   ....?..À
    0018: 00 00 00 00 00 00 00 00   ........
    0020: 00 00 00 00 00 00 00 00   ........
    0028: 04 00 00 00  

    After checking we found that  the biggest Paged pool memory hog is Tag Vmem with Bytes = 109887488 (related to Trend Micro).

    After looking I found this article related to the issue (posted yesterday). however it relates to office scan 8 and we're running office scan 7.6 but it looks very familar.  

    So we called TrendMicro.  They have had a few calls related to office scan 7.6 and engine version 8.550 (which is what we have).  However, they haven't gotten enough calls to release a hotfix for it so he gave us the following work arounds.
    Workaround #1.

    Enlarge paged pool - reboot required

    Please open up the registry editor and edit the values specified below:

    HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
    Value: PagedPoolSize
    Data: 0xFFFFFFFF

    Workarpound #2.

    Enable SystemMapView - reboot required

    Value: EnableSystemView
    Data: 1  (DWORD)

    Reboot the system.

    I think that is nonsense, and am uninstalling Trend and pushing Symantec on to the server from another office site.

    Good luck, hope no one else is getting this stupid issue.
    LVL 1

    Accepted Solution

    I eventially found the problem to be a third party application which was casuing a memory leak.

    Though in itself it was displaying any great number of errors; the problem was visible if I selected Handle Count under the Process screen in task manger. Gebneraly most apps will max out around 1-2K handles. This app was consuming upwards of 1990K handles which basically sucked all thh resources from the system. I obtained an update from the vendor and the problem was solved. (We had asked them earlier if there were any known problems with their application but they denied there were.. gees who would have thought !!)
    LVL 1

    Expert Comment

    What third party app was it? I'm having the exact same issue with Trend Micro, the memory leak, and those same events in the event viewer.
    LVL 1

    Author Comment

    The appliocations was a locally developed App so probaly not your cause. The key here was to use task manager and select additional comlumns and select Handles. The maximum handles should be on any system is probaly around 8000. On our system we had processes using handles in execess of  a 190000. If you have such a process, then that would be the culprit

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
    In a recent article here at Experts Exchange (, I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now