You are currently offline, waiting for your internet to reconnect

Microsoft-Windows-RPC-Events Event 11 after reboot

Symptom
When you run the Server Manager Snap-in (servermanager.msc) for extended periods of time or start the Resource Host Monitor (rhs.exe) hosting FileServer Resource, the following Application event log warning is written:

For DHCP Servers you may notice the following event description:

Log Name: Application
Source: Microsoft-Windows-RPC-Events
Event ID: 11
Task Category: None
Level: Warning
Keywords:
User: CONTOSO\Administrator
Computer: contoso.com
Description:
Possible Memory Leak. Application ("C:\WINDOWS\SYSTEM32\MMC.EXE" "C:\WINDOWS\SYSTEM32\SERVERMANAGER.MSC" ) (PID: 584) has passed a non-NULL pointer to RPC for an [out] parameter marked [allocate(all_nodes)]. [allocate(all_nodes)] parameters are always reallocated; if the original pointer contained the address of valid memory, that memory will be leaked. The call originated on the interface with UUID ({6bffd098-a112-3610-9833-46c3f874532d}), Method number (2). User Action: Contact your application vendor for an updated version of the application.

For FileServer resource:

Description:
Possible Memory Leak. Application (C:\Windows\Cluster\rhs.exe -key SYSTEM\CurrentControlSet\Services\ClusSvc\Parameters\Rhs\<GUID> -parentPid <ParentPid> -initEvent <initEvent> -replyEndpoint <replyEndpoint>) (PID: <PID>) has passed a non-NULL pointer to RPC for an [out] parameter marked [allocate(all_nodes)]. [allocate(all_nodes)] parameters are always reallocated; if the original pointer contained the address of valid memory, that memory will be leaked. The call originated on the interface with UUID ({4B324FC8-1670-01D3-1278-5A47BF6EE188}), Method number (<Method number>). User Action: Contact your application vendor for an updated version of the application.
Cause
This issue occurs during the portion of the UID calls an internal structure with a parameter not initialized as NULL. This causes a false positive detection for a memory leak.
Resolution
There is no memory leak or functional impact to this specific condition. This warning can be ignored as long as the UUID is {6bffd098-a112-3610-9833-46c3f874532d} or {4B324FC8-1670-01D3-1278-5A47BF6EE188}, and memory is not leaking.
More Information
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 974814 - Last Review: 07/19/2016 16:18:00 - Revision: 3.1

Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Standard

  • kbrapidpub kbnomt KB974814
Feedback
"> ipt> r Route = "76500"; var Ctrl = ""; document.write(" p;did=1&t=">