High CPU Usage Occurs When There Are a Very Large Number of Connections on Port 445

When a Windows 2000 Server-based computer (and to a lesser extent, a Windows 2000 Professional-based computer) receives connection requests on port 445, it allocates memory and a small degree of increased CPU usage to serve these connections. When the connection is closed, the server releases these resources after a short time.

There is an inherent trade-off between the number of work items and responsiveness. It is important for administrators to determine the appropriate MaxWorkItems setting to improve system responsiveness. If you use an incorrect value, the server's responsiveness may be affected or one user may be able to monopolize system resources.

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

WORKAROUND

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
To work around this problem, create and then set the MaxWorkItems value in the registry to a value that the computer can support:

1. Start Registry Editor.
2. Locate and then click the parameters value under the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver
3. On the Edit menu, click Add Value.
4. Type maxworkitems in the Value Name box, click REG_DWORD in the Data Type box, and then click OK.
5. In the Data box, type one of the following values:
   • Type 1024 for computers that have a large amount of memory (greater than 2 gigabytes [GB]).
   • Type 512 for computers that have a medium amount of memory (from 512 megabytes [MB] to 2 GB).
   • Type 256 for computers that have a small amount of memory (less than 512 MB).
6. Click OK, and then quit Registry Editor.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

Computers that have a single CPU are more susceptible to this problem in which the CPU usage remains at 100 percent for a short time when it receives a very large number of connection requests. After the large number of connection requests stops, CPU usage remains at 100 percent for a few minutes, after which time it returns to standard levels. When the same situation occurs on a computer that has multiple CPUs, CPU usage returns to standard levels after about 30 seconds.

Acknowledgment: Peter Grundl of KPMG (http://www.kpmg.com/) contributed to this Microsoft Knowledge Base article.