This article has been archived. It is offered "as is" and will no longer be updated.
After you install Microsoft Windows 2000 Service Pack 4 (SP4), you may experience slow system performance, or your computer may stop responding.
If you have Microsoft Message Queuing installed, the Message Queuing program may stop sending and receiving messages because the program does not have sufficient resources. Events that are associated with Message Queuing that include the error codes 0xc00e0027 and 0xc000009a may be logged in the application event log.
If you turn on pool tagging to investigate a possible memory leak, the pool tagging output indicates that the "Toke" pool tag is using a lot of paged pool memory.
This problem occurs because of a regression that was introduced in Microsoft Windows 2000 SP4. The update that causes this problem involves a change to the "Impersonate a client after authentication" user right.
Note The "Impersonate a client after authentication" user right is also known as the SeImpersonatePrivilege user right. For additional information about the SeImpersonatePrivilege user right, click the following article number to view the article in the Microsoft Knowledge Base:
821546 Overview of the "Impersonate a client after authentication" and the "Create global objects" security settings
After you install Windows 2000 SP4, a memory leak may occur when a program makes a call to the RpcImpersonateClient function and to the RpcRevertToSelf function by using explicit credentials. This memory leak occurs in paged pool memory when the server side downgrades from impersonation to identity if an explicit user context is supplied.
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
This hotfix requires Windows 2000 Service Pack 3 (SP3) or later.
You must restart your computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name ----------------------------------------------------------- 21-Sep-2003 00:36 5.0.2195.6824 29,712 Mountmgr.sys 25-Nov-2003 18:27 5.0.2195.6876 1,699,136 Ntkrnlmp.exe 25-Nov-2003 18:27 5.0.2195.6876 1,698,432 Ntkrnlpa.exe 25-Nov-2003 18:27 5.0.2195.6876 1,719,232 Ntkrpamp.exe 25-Nov-2003 18:27 5.0.2195.6876 1,676,736 Ntoskrnl.exe
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section of this article.
You may experience the problem that is described in the "Symptoms" section if you installed Windows 2000 SP4 or any post-Windows 2000 Service Pack 3 (SP3) hotfixes that included the file Ntoskrnl.exe that is dated 25-Nov-2002 or later. This problem is fixed in the version of Ntoskrnl.exe that is dated 25-Nov-2003 or later. For additional information about how to turn on pool tagging, click the following article number to view the article in the Microsoft Knowledge Base:
177415 How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks
For additional information about how hotfix packages are named, click the following article number to view the article in the Microsoft Knowledge Base:
816915 New file naming schema for Microsoft Windows software update packages
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
For help with system performance issues in Windows Vista, visit the following Microsoft web page: