The File Server Resource Manager (FSRM) service may cause high CPU usage in a Windows Server 2003


In Windows Server 2003, you may experience high CPU usage. For example, you notice the following behavior:
  • The CPU usage may be constantly greater than 60 percent.
  • In Task Manager, you find that the Svchost.exe process is using the CPU resources constantly. This process is used by the File Server Resource Manager (FSRM) service.
  • The CPU that is consumed by the FSRM service increases when you start the Quota FSRM Manager.
  • The Quota FSRM Manager takes a long time to open and it takes a long time for the objects to be loaded.
When this problem occurs, the performance of the system is affected.


This problem occurs because of a known bug in Windows Server 2003 that is fixed in Windows Server 2008. The FRSM service has a polling thread that attempts to refresh the Distributed File System (DFS) cache every hour. This is because the FSRM service reads the DFS mappings for the local shares so that they can be displayed in the FSRM console. To troubleshoot quota issues if you are an administrator, review the DFS path to determine the local share that is being connected to.


Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To resolve this problem, change the value data of the DisableSearchDfs registry entry in the following registry subkey to 1:

More Information

Debugging dump output sample

//Dump the threads that are using the most CPU
Thread Time
19:66c 9 days 23:37:21.250
21:1120 8 days 21:22:31.531
20:1084 7 days 23:47:08.296
22:664 6 days 2:26:38.562
23:500 5 days 13:49:09.359
16:80c 0 days 0:00:28.375
0:758 0 days 0:00:00.187

//Dump thread 19

00b3f128 49a63abe 000ad530 00000001 4805415c ntdll!RtlEnumerateGenericTable+0x3f (FPO: [Non-Fpo]) (CONV: stdcall)
00b3f17c 48115bf8 000ad4a8 01f8f8d4 00000000 dfsext!DfsMapCacheQueryReversePath+0x68 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3f1e8 48117cf9 01f8f8d4 00d9020c 00dcb5b8 srmsvc!CPathMapCache::GetDfsPathsForSharePath+0x6e (FPO: [Non-Fpo]) (CONV: thiscall)
00b3f38c 480e88d4 00152cf8 00b3f44c 48041d7c srmsvc!CPathMapCache::GetSharePathsForLocalPath+0x2f4 (FPO: [Non-Fpo]) (CONV: thiscall)
00b3f464 480d61a8 00000000 00152cf8 00b3f558 srmsvc!FormatRemotePathsForMacro+0xcc (FPO: [Non-Fpo]) (CONV: stdcall)
00b3f56c 480d79da 00000000 00000267 00b3f738 srmsvc!CDataScreenAction::GetMacroValueForId+0x3b3 (FPO: [Non-Fpo]) (CONV: thiscall)
00b3f604 480eeb26 00000000 00da29b2 00b3f738 srmsvc!CDataScreenAction::GetMacroValue+0x104 (FPO: [Non-Fpo]) (CONV: thiscall)
00b3f75c 480f45a7 01fb7cf4 00b3fba4 00000000 srmsvc!ISrmMacroExpansion::GetMacroExpansion+0x2ec (FPO: [Non-Fpo]) (CONV: thiscall)
00b3fbd4 480dab45 00b3fc7c 480c6189 00da2814 srmsvc!CSrmActionEmail::Run+0x90d (FPO: [Non-Fpo]) (CONV: thiscall)
00b3fbdc 480c6189 00da2814 4803bd60 4803bcf8 srmsvc!CDataScreenTemplateActionEmail::Run+0x13 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3fc7c 480c82de 00da2818 00d821b0 4803a48c srmsvc!CDataScreen::HandleViolationEvent+0x350 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3fcfc 480bddce 00d821b0 00000000 48043eb8 srmsvc!CDataScreen::DataScreenEventHandler+0xd7 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3fe28 480e03d6 0003ff88 00038b44 00000000 srmsvc!CDataScreenFilterAsync::FilterMessageHandler+0x5c0 (FPO: [Non-Fpo]) (CONV: thiscall)
00b3feec 7c83a827 00dc4b48 7c889080 00100ba0 srmsvc!CSrmFilterAsync::GenericMessageHandler+0x128 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3ff44 7c83aa0b 480e02ae 00dc4b48 00000000 ntdll!RtlpWorkerCallout+0x71 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3ff64 7c83aa82 00000000 00dc4b48 00100ba0 ntdll!RtlpExecuteWorkerRequest+0x4f (FPO: [Non-Fpo]) (CONV: stdcall)
00b3ff78 7c839f60 7c83a9ca 00000000 00dc4b48 ntdll!RtlpApcCallout+0x11 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3ffb8 77e64829 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x61 (FPO: [Non-Fpo]) (CONV: stdcall)
00b3ffec 00000000 7c839efb 00000000 00000000 kernel32!BaseThreadStart+0x34 (FPO: [Non-Fpo]) (CONV: stdcall)

//looking in detail

00b3f128 49a63abe ntdll!RtlEnumerateGenericTable(
struct _RTL_GENERIC_TABLE * Table = 0x000ad530,
unsigned char Restart = 0x01 '')+0x3f
00b3f17c 48115bf8 dfsext!DfsMapCacheQueryReversePath(
void * MapCache = 0x000ad4a8,
unsigned short * TargetPath = 0x01f8f8d4,
unsigned long BufferSize = 0,
unsigned long * RequiredSize = 0x00b3f1d8,
unsigned long * Total = 0x00dcb5b8,
unsigned short ** Buffer = 0x00000000)+0x68
00b3f1e8 48117cf9 srmsvc!CPathMapCache::GetDfsPathsForSharePath(
unsigned short * strSharePath = 0x01f8f8d4,
class CSrmAutoCppPtr<unsigned short * *> * pDfsPat