Article ID: 941296 - View products that this article applies to.
A Microsoft Internet Security and Acceleration (ISA) Server 2006 computer may stop responding when ISA Server 2006 is under a heavy load.
This problem may occur if the Microsoft Firewall service (Wspsrv.exe) process in ISA Server 2006 consumes 2 gigabytes (GB) of memory. By default, no more than 2 GB of address space are available for a 32-bit application.
To resolve this problem, apply hotfix rollup package 943215 on the ISA Server 2006 computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
943215This hotfix adds a memory-monitoring mechanism that lets you set a threshold for the memory consumption of ISA Server 2006. When memory consumption reaches a specified value, ISA Server 2006 enters lockdown mode. At the same time, ISA Server 2006 issues a Log Failure alert. You can configure the Log Failure alert to restart the Microsoft Firewall service.
(http://support.microsoft.com/kb/943215/ )Description of the ISA Server 2006 hotfix package: October 7, 2007
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756To specify the memory consumption threshold, follow these steps:
(http://support.microsoft.com/kb/322756/ )How to back up and restore the registry in Windows
To work around this problem, restart the Microsoft Firewall service before it reaches 2 GB of memory consumption.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
For more information about lockdown mode, click the following article number to view the article in the Microsoft Knowledge Base:
838711For more information about advanced registry operations, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/838711/ )Lockdown mode of operation in ISA Server 2006 or in ISA Server 2004
(http://support.microsoft.com/kb/256986/ )Windows registry information for advanced users
Article ID: 941296 - Last Review: November 16, 2007 - Revision: 1.4