SMS: Logon Discovery Agent Creates Multiple Connections When it Passes DDRs to Site Servers

The Windows NT Logon Discovery Agent service that is running on domain controllers may report errors when the service tries to copy Discovery Data Records (DDRs) to Systems Management Server (SMS) site servers. The following error message may be recorded hundreds of times in the Logon Discovery Agent log file (Ntlgdsca.log) that is located on the domain controller: The preceding entries are typical entries when this problem occurs. For example, there are five successful connections to the site server, four attempts to delete the connections that fail, although the first one succeeds.

The Logon Discovery Agent may create hundreds of connections to the SMS site server when it tries to send up the DDRs.

Over time, the number of connections that are made from the domain controller to the SMS site server may increase, and available memory on the domain controller may run out.

Logon Discovery Agent leaks memory (memory usage:Private Bytes) when it re-reads the site list from its configuration file (which happens at every DDR copy pass).

Service Pack Information

To resolve this problem, obtain the latest service pack for Microsoft Systems Management Server 2.0. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix Information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this fix should have the following file attributes or later:
NOTE: Due to file dependencies, the most recent hotfix or feature that contains the above files may also contain additional files.

To work around this problem:

1. Disable the Windows NT Logon Discovery method to remove the Logon Discovery Agent service from domain controllers.
2. Restart the Logon Discovery Agent service regularly on the domain controllers, for example, as part of a scheduled backup job.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Microsoft Systems Management Server 2.0 Service Pack 5.

In addition to the error message that is described in the "Symptoms" section of this article, you can run Perfmon.exe and view the memory usage (private bytes) on the Ntlgdsca.exe process to determine if a domain controller is affected by this problem.

Factors that have an affect on how fast the domain controller may run out of memory are:

• The role of the logon server in a shared domain scenario (a PDC is updated much more frequently than a BDC because only the senior site updates the BDCs).
• The logon point update frequency.
• The amount of RAM that is installed on the domain controller.
• The frequency of incoming DDRs. Note that it does not matter if a large batch of DDRs are received or just one; a new connection is appended as long as at least one DDR has been received since the last Logon Server Manager cycle.