Memory leak in the remote registry service causes Windows to hang

Symptoms
On a Windows-based computer, you notice that more system memory and paged pool memory are being consumed than expected. This memory leak occurs after about 10 minutes of system uptime and eventually causes the system to hang. 

Additionally, PoolMon analysis may show that the Windows Notification Facility (WnF) tag is consuming all the available paged pool memory.
Cause
The issue occurs in the Endpoint Mapper Logic component. The Remote Registry service is designed to stop running after the connection has been idle for 10 minutes.
Workaround
To work around this issue, follow these steps:
  1. Open the run command box by pressing the Windows key+R.
  2. Type regedit.exe, and then press Enter.
  3. Locate the following registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RemoteRegistry
  4. In the details pane (on the right side), double-click DisableIdleStop.
  5. Change the value to 00000001.

    Note The default value is 00000000.
     
  6. Exit Registry Editor.
For more information on Poolmon.exe refer to the following Knowledge Base article:

177415 How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks
Properties

Article ID: 3105719 - Last Review: 06/15/2016 03:29:00 - Revision: 3.0

Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8 Enterprise, Windows 8 Pro

  • KB3105719
Feedback