An ISA Server 2006 computer may stop responding under a heavy load

A Microsoft Internet Security and Acceleration (ISA) Server 2006 computer may stop responding when ISA Server 2006 is under a heavy load.

This problem may occur if the Microsoft Firewall service (Wspsrv.exe) process in ISA Server 2006 consumes 2 gigabytes (GB) of memory. By default, no more than 2 GB of address space are available for a 32-bit application.

To resolve this problem, apply hotfix rollup package 943215 on the ISA Server 2006 computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base: This hotfix adds a memory-monitoring mechanism that lets you set a threshold for the memory consumption of ISA Server 2006. When memory consumption reaches a specified value, ISA Server 2006 enters lockdown mode. At the same time, ISA Server 2006 issues a Log Failure alert. You can configure the Log Failure alert to restart the Microsoft Firewall service.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: To specify the memory consumption threshold, follow these steps:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate the following registry subkey, and then click it:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RAT\Stingray\Debug\Common
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type VM_THRESHOLD_ALERT, and then press ENTER.
5. Right-click VM_THRESHOLD_ALERT, and then click Modify.
6. Under Base, click Decimal.
7. In the Value data box, type an appropriate value, and then click OK.
   
   Note The value that you type inside the Value data box is the number of bytes that triggers the alert. For example, type 1900000000 in the Value data box for common configurations. If you type 0 in the Value data box, the memory monitoring mechanism is disabled.
8. Exit Registry Editor.

Note If the Log Failure alert is frequently triggered after you apply this hotfix, the ISA Server computer is likely to be overloaded. In this situation, you must add more servers to the ISA Server array.

To work around this problem, restart the Microsoft Firewall service before it reaches 2 GB of memory consumption.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about lockdown mode, click the following article number to view the article in the Microsoft Knowledge Base: For more information about advanced registry operations, click the following article number to view the article in the Microsoft Knowledge Base: