I have a Windows Server 2008 Enterprise (32-bit)(Dell PowerEdge 410 with 12G RAM) with only AD and DNS loaded. I just put it into production last week and it has froze (but crashed with no BSODs) 3 times with this error. It occurs every other day and I have to warm boot it through the Dell DRAC. I've turned on the Handles and NonPaged Pool columns in the Performance monitor, and it consistently runs at Handles=5440ish and NP Pool=21,000k. Comparedtoa Windows 2003 PowerEdge w/4G and it runs at 5300ish and 779k.I've run hardware diagnostics, nothing turns up there. I do get a ton of Error 1202 Security policies were propogated with warning. 0x534 No mapping between account names and security IDs were done. But the fixes I find only apply to Windows Server 2003. But it doesn't seem to be the culprit.I've looked up poolmon, but it doesn't appear that it can be run against Windows Server 2008. We are using this version for other virtual servers with no problem, I believe this is the first physical server with AD and DNS in this environment. Any help or ideas would be appreciated, I've been researching quite a few solutions but hitting a wall as most solutions apply to earlier versions.

Hi Jmdelacruz, Thanks for the detailed analysis of the issue and you are on right track by examining the handle count at the first stage . The event id 2019 corresponds to the non-paged pool which means that this memory segment will not be paged out to the disk so that memory is reserved and usually used for drivers. So analyzing handles either using PE / Handles.exe would actually tell you the symptom and i usually keep 5000 handles for any process to be safe and over 5000 is something we must start diagonize and over 12000 is scary and the first thing i would like to eliminate is a) i will check for any active applications running on the system and will stop those applications and check if the handle count has reduced b) Second diagnostic tool i would use is pooltag and i would encourage you to use the below link http://support.microsoft.com/default.aspx?scid=kb;EN-US;177415c) I would suspect majority of the drivers performing this task as they have direct access to kernel memory. d) I would then fall back to live dbg using (windbg tool from microsoft ) If a, b and c doesnt work , i would recommend you to raise a ticket to microsoft for dump analysis or live KD with which you could resolve the problem quickly and find the root cause You may obtain the phone numbers for specific technology request please take a look at the web site listed below: https://support.microsoft.com/common/international.aspx?iid=174859&iguid=56907522-6886-4238-a70f-a1d06a4473c7_2_2&rdpath=1 Solutions Architect

Thanks for the response.I want to try Poolmon as I am convinced it's some errant app, driver, or service and done the following:1. Downloaded the xp support toolfrom http://www.microsoft.com/downloads/details.aspx?FamilyID=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en2. did the reg hack to change hklm\system\currentcontrolset\control\sessionmanager\globalflags=0x00000400, rebooted the server3. Poolmon commands are here - http://msdn.microsoft.com/en-us/library/ms792887.aspx BUT none of the command syntax shows me how to specify which machine/server to run poolmon againstIs there a poolmon to download for Windows Server 2008? Am I missing something? Thanks again.

Hi Jmdelacruz, thanks for the info Pool tagging is enabled by default for later versions of operating system.Poolmon should work on windows 2008 32 bit edition as i have checked poolmon cannot be used for windows 2008 server 64bit edition.

I have the same issue on 2 server 2008 std sp1 machines. One is PDC, other is DC2. DNS.exe process on each has ~5300 handles, 20mb npp. That is 20% of all npp for x32 machine. Why is DNS using this much npp? Why isn't a service using ram or pagefile? It is only using 1k of page pool. btw, these are Saturday numbers when no one is on the network (except me remotely). How do we get DNS out of the npp? I thoughtnpp was supposed to be for drivers and kernel process??I actualy had a bsod from this on PDC on Friday. Don't need that on a regular basis thanks anyway! Any suggestions?

as an update, the broadcom teaming software was the culprit. drove me nutty until another engineer ran into the same issue.

as an update, the broadcom teaming software was the culprit. drove me nutty until another engineer ran into the same issue. Did you have to remove the broadcom teaming software or was there an update you applied to the software to correct the issue? I am running into the same issue with an IBM HS22 blade using the Broadcom Teaming software.

I am seeing this as well. Did you remove the broadcom software, or find a fix?Thx.

Hi. I had one similar Event:2019 + hang issue on a Dell 2900 Win2008-R2 with a Broadcom Network adapter. But since march 9 2010 I had many of this event in a brandless Win2003 server (all updates) with 3Com network adapter. DNS.exe consumes ~75% of the Nonpaged pool and more than 5000 handles. I used Performance Monitor to track all processes/instances "pool nonpaged bytes" usage and there was no difference in the graphic between the moments when the server was working normally and the moments the server was not allowing users to print or have access to the shared drives. I used pmon too (I have the copy/pasted outputs saved). Memtriage -s alerts: %%%%%%%%%%%%% WARNING: Following processes have used more than 1000 Handle objects SUGGESTION: Examine the process that used most of the handles, if any of process' handle has grown significantly unexpectedly, this is probably a handle leak. To list details about all the handles owned by each process, use Microsoft Support Tools: oh.exe ============ List Of Processes =========== Process ID Proc.Name Handle 1616 dns.exe 5221 4 System 5171 436 lsass.exe 1447 868 svchost.exe 1434 2092 explorer.exe 1123 4616 avgwdsvc.exe 1048 352 csrss.exe 1024 WARNING: Non-Paged Pool Usage is 240MB (Non-Paged Pool Usage limit 100MB) SUGGESTION: Examine the pool tag that consumed most of the pool space, if any pool tag's pool consumption has grown significantly unexpectedly, there is probably a pool leak. If the driver name is provided in the report, contact the driver manufacturer directly for further assistance. =============== List Top 5 Pool Consumers ================= Tag Type Allocs Frees Diff Bytes Per Alloc Mapped_Driver AvgU Nonp 457565 76687 380878 82269648 216 [avgtdix] File Nonp 64505201 64118229 386972 58822000 152 [<unknown> - File objects] Irp Nonp 12044718 11725931 318787 53170584 166 [<unknown> - Io, IRP packets] TCPc Nonp 458007 77023 380984 18287232 48 [tcpip] GMIS Nonp 2 1 1 2621440 2621440 [<unknown> - Gdi Objects] Note: Paged Pool Usage is 80MB (Limit 100MB) Available Paged Pool is 271MB %%%%%%%%% So, it's not a Broadcom issue. Any clues? Thanks Luis DEE - PUC-Rio