Memory leak in the remote registry service causes Windows to hang

Dotyczy: Windows Server 2012 R2 DatacenterWindows Server 2012 R2 StandardWindows Server 2012 Datacenter


On a Windows-based computer, you notice that more system memory and paged pool memory are being consumed than expected. This memory leak occurs after about 10 minutes of system uptime and eventually causes the system to hang. 

Additionally, PoolMon analysis may show that the Windows Notification Facility (WnF) tag is consuming all the available paged pool memory.


The issue occurs in the Endpoint Mapper Logic component. The Remote Registry service is designed to stop running after the connection has been idle for 10 minutes.


To work around this issue, follow these steps:
  1. Open the run command box by pressing the Windows key+R.
  2. Type regedit.exe, and then press Enter.
  3. Locate the following registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RemoteRegistry
  4. In the details pane (on the right side), double-click DisableIdleStop.
  5. Change the value to 00000001.

    Note The default value is 00000000.
  6. Exit Registry Editor.
For more information on Poolmon.exe refer to the following Knowledge Base article:

177415  How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks