Slow system performance or your computer stops responding because of a memory leak in paged pool memory in Windows 2000 SP4

Hotfix Download Available
View and request hotfix downloads

View products that this article applies to.

SYMPTOMS

After you install Microsoft Windows 2000 Service Pack 4 (SP4), you may experience slow system performance, or your computer may stop responding.

If you have Microsoft Message Queuing installed, the Message Queuing program may stop sending and receiving messages because the program does not have sufficient resources. Events that are associated with Message Queuing that include the error codes 0xc00e0027 and 0xc000009a may be logged in the application event log.

If you turn on pool tagging to investigate a possible memory leak, the pool tagging output indicates that the "Toke" pool tag is using a lot of paged pool memory.

Back to the top

CAUSE

This problem occurs because of a regression that was introduced in Microsoft Windows 2000 SP4. The update that causes this problem involves a change to the "Impersonate a client after authentication" user right.

Note The "Impersonate a client after authentication" user right is also known as the SeImpersonatePrivilege user right. For additional information about the SeImpersonatePrivilege user right, click the following article number to view the article in the Microsoft Knowledge Base:

821546 (http://support.microsoft.com/kb/821546/ ) Overview of the "Impersonate a client after authentication" and the "Create global objects" security settings

After you install Windows 2000 SP4, a memory leak may occur when a program makes a call to the RpcImpersonateClient function and to the RpcRevertToSelf function by using explicit credentials. This memory leak occurs in paged pool memory when the server side downgrades from impersonation to identity if an explicit user context is supplied.

Back to the top

RESOLUTION

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

This hotfix requires Windows 2000 Service Pack 3 (SP3) or later.

Restart requirement

You must restart your computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version            Size    File name
   -----------------------------------------------------------
   21-Sep-2003  00:36  5.0.2195.6824      29,712  Mountmgr.sys
   25-Nov-2003  18:27  5.0.2195.6876   1,699,136  Ntkrnlmp.exe     
   25-Nov-2003  18:27  5.0.2195.6876   1,698,432  Ntkrnlpa.exe     
   25-Nov-2003  18:27  5.0.2195.6876   1,719,232  Ntkrpamp.exe     
   25-Nov-2003  18:27  5.0.2195.6876   1,676,736  Ntoskrnl.exe

Back to the top

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section of this article.

Back to the top

MORE INFORMATION

You may experience the problem that is described in the "Symptoms" section if you installed Windows 2000 SP4 or any post-Windows 2000 Service Pack 3 (SP3) hotfixes that included the file Ntoskrnl.exe that is dated 25-Nov-2002 or later. This problem is fixed in the version of Ntoskrnl.exe that is dated 25-Nov-2003 or later. For additional information about how to turn on pool tagging, click the following article number to view the article in the Microsoft Knowledge Base:

177415 (http://support.microsoft.com/kb/177415/ ) How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks

For additional information about how hotfix packages are named, click the following article number to view the article in the Microsoft Knowledge Base:

816915 (http://support.microsoft.com/kb/816915/ ) New file naming schema for Microsoft Windows software update packages

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 (http://support.microsoft.com/kb/824684/ ) Description of the standard terminology that is used to describe Microsoft software updates

For help with system performance issues in Windows Vista, visit the following Microsoft web page:

Problems with overall system speed and system performance (http://support.microsoft.com/gp/slow_windows_performance)

Back to the top