How to allow Poolmon.exe to run by setting GlobalFlag value

This article was previously published under Q164933
This article has been archived. It is offered "as is" and will no longer be updated.
Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
The utility Poolmon.exe located on the Windows NT CD-ROM can be used totrack memory usage in both paged and nonpaged pools of memory. When POOLMONis run from the command prompt of Windows NT, the following error isdisplayed:
Query pooltags Failed c0000002
Poolmon.exe uses a global pooltag in the registry located at a value calledGlobalFlag. The default value for GlobalFlag is 0, so Windows NT does notexpend extra overhead in gathering pooltag information.
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys AndValues" Help topic in Registry Editor (Regedit.exe) or the "Add and DeleteInformation in the Registry" and "Edit Registry Data" Help topics inRegedt32.exe. Note that you should back up the registry before you edit it.

To allow Windows NT to gather pooltag information, the GlobalFlag valuemust be changed using Registry Editor (Regedt32.exe). Before makingchanges, write down the current value of GlobalFlag so that it can be resetonce running Poolmon.exe is no longer necessary.

The following hex values for GlobalFlag will set up memory tagging inWindows NT for the following versions:

Windows NT 3.5: 0x01000000
Windows NT 3.51: 0x00000400
Windows NT 4.0: 0x00000400

If you are running Windows NT version 3.51 or 4.0 but do not have theWindows NT 4.0 Resource Kit, follow these steps.

To change the value of the GlobalFlag, you need to modify its value in theregistry.
  1. Start Registry Editor (Regedt32.exe) and locate the following subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  2. Double-click on the GlobalFlag Value on the right pane.
  3. In the Data Type field, select REG_DWORD and click OK.
  4. In the Data Field, type in either 01000000 or 00000400,depending on the version of Windows NT. Select the Hex option and click OK.
          Range:   0 - 0xFFFFFFFF (not continuous)      Default: 0						
  5. Quit Registry Editor, shutdown, and restart your computer.
If you have a computer running Windows NT 4.0 and you have the resourcekit, there is utility called GFLAGS. GFLAGS is a GUI tool that enables adeveloper or system administrator to edit the NtGlobalFlag settings forWindows NT Server or Windows NT Workstation without having to make manualchanges in the registry.

To use this utility to enable Pool tagging:
  1. Double-click on the Gflags.exe file in the resource kit directory or open a MS-DOS command prompt and type in GFLAGS and press Enter.
  2. After the GFLAGS window opens, set the destination in the upper windows to System Registry.
  3. In the lower portion of the window, click to select the "Enable Pool Tagging" check box.
  4. The computer running Windows NT will have to be restarted for the change to take affect.
GFLAGS can also set the flag required for the kernel feature of Oh.exe, atool that shows the handles of open windows. For usage information, at a MS-DOS command prompt type:
gflags /?
GlobalFlag consists of 32 bits that are used as switches to enable ordisable several different advanced internal system diagnostics andtroubleshooting tests.

Note In Windows NT versions 3.51 and earlier, changing the value of thisentry to 0x20100000 disabled the OS/2 subsystem and caused OS/2-boundapplications to run in a virtual DOS computer. This does not work inWindows NT 4.0.

Article ID: 164933 - Last Review: 02/24/2014 08:27:37 - Revision: 3.1

  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
  • kbnosurvey kbarchive kbprb kbusage KB164933