I've recently installed Windows Server 2008 Standard SP2 32bit, upgraded it, installed 5 CALs to terminal services, and i've noticed increasing memory usage for svchost.exe. I've isolated every service assiociated to that svchost by using sc config command, and after reboot I can say for sure, that "Network Store Interface Service" - NSI is causing memory leak. Yesterday at 4PM server was rebooted, and this service was using only 1023KB, today at 8AM it was consuming about 40MB, right now (10:50AM) it is consuming 305MB and growing fast. I've found online similar problem with windows 7 (http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/windows-7-servicesexe-consuming-all-memory/06212d45-9716-4399-96f2-c7debb32ce91?msgId=8ab9add9-f467-48e1-92e2-51740016844b) But there is no answer to that. Is there a way to get rid of this service without loosing ability to use network? BR Jerzy Dukaj

Hi Jerzy, Thanks for posting here. Firstly, I’d like to say that we cannot simple disable the NSI service. Because this service is a necessary services on OS networking which the Internet connection is part of it. Generally speaking, high memory usage of NSI service are mostly causing by third party service or some spyware and adware. In order to troubleshoot, please scan your server for viruses and malwares first. Clean any suspect files after the scan. Then, try to boot the server with clean boot and safe mode with no Internet connection to check if the issue still persists. Steps to clean boot: 1. Click Start->Run…->type msconfig and press Enter 2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services 3. Click Startup tab and Disable All startup items 4. Click OK and choose Restart 5. After reboot, check whether the problem still occurs If the issue still persists, and you want to know the root cause of the issue, we need to analyze the memory dump file to narrow down the issue. Since the forum is not the best channel to troubleshoot this issue, I would suggest that you contact Microsoft Customer Support Service to troubleshoot this issue efficiently. They are the best resource for this kind of issues. Your understanding is highly appreciated. http://support.microsoft.com/common/international.aspx?RDPATH=dm;en-us;select&target=assistance Best Regards, Aiden

I have all third-party services disabled. In startup i have only Microsoft Essentials, that I've installed few days ago, because I've read similar post about spyware and adware. Today I had to reboot server, because this service was consuming 1,6GB of memory. After I logged out all users and shutted down all non-microsoft programs this service was still consuming 1,6GB of memory. I've changed network cards, maybe one of them was faulty. If that will not help, I will try clean boot and save mode, but i'm pretty sure, that in that mode service will not consume that much memory. That link You posted is redirecting me to paid technical support. As a owner of genuine copy of windows server I don't have rights to access to free tech support?

Hi, How are things going? I just want to check the status of the issue. Please note that I am not saying you cannot ask question here, just providing a good choose for you to resolve this issue effectively. If the issue still exists, I will try my best to help you at this issue. Thanks for your understanding. Best Regards, Aiden

Hi Aiden, Based on my knowledge, the "Network Store Interface Service" is the most important and basic component for network, we can't disable it. I didn't find any the updates for Network Store Interface Service so far. In this situation, would you please try to perform the following action plan on the affected server? 1. Please try to apply all the updates for the hardware drivers, such as the NIC cards/BIOS/firmware/anti-virus software. 2. Please try to keep monitoring the instance of the SVChost.exe, if this issue still occurs, i suggest you open a MS Support case for this issue, since maybe we will collect the Dump file or the TTTrace log for further troubleshooting. Thanks.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I've posted problem on http://social.microsoft.com/Forums/en-US/partnerwinserver7rcthreads/thread/d64bdc4f-d331-4ff5-93eb-cc1fe5e10ffa Right now i'm waiting for dump files to be analyzed. I would like to analyze it myself, which tools should I need for it? I've tried Windbg, but it seems that i'm missing symbols file or something like that. BR Jerzy Dukaj

Hi Jerzy, we can use the Windbg tool to debug this dump files, please refer to the following information: a. Install Debugging Tools. http://msdl.microsoft.com/download/symbols/debuggers/dbg_amd64_6.11.1.404.msi or : http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx b. Download and install Windows Symbol Packages http://msdn.microsoft.com/en-us/windows/hardware/gg463028 c. Configuring Symbol. Start Windbg, go file—symbol search path—Browse (choose the folder you installed at step b) d. starting to analyzing Dump files. I am not sure if the public Symbol file can be help on this analysis. Meanwhile, i still suspect the NIC cards/BIOS/firmware/anti-virus software, since the NSI is a critical service, and i didn't find any known issue for this issue. Upgrading the hardware drivers can at least avoid the known issue for the outdated drivers. Thanks.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I've changed all network cards to new Edimax cards based on RTL 8139/810x chipset. There is not much network traffic going in and out of it, mostly ICMP packets testing rechability of network devices. That server should work as a monitoring server for a network. Nothing changed after that. I've installed microsoft essentials, and uninstalled it after few days - nothing changed. I can search for new BIOS right now, and what firmware do You mean, to which device? BR Jerzy Dukaj

Hi Jerzy, It seems ping may be the cause. Sine the server is mainly used by software using ICMP packets to test reachability of network devices, please disable the ping test to see the result. Thanks, Kevin NiPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I figured out, that growth rate of NSI service memory usage depends on amount of ICMP requests echo packets send out from server per time. Disabling ICMP totally most propably will stop NSI service from consuming memory. BUT - main purpose of this server is sending ICMP packets and teting network devices rechability that way. Without that - server is useless to me. Please find a way to stop NSI service from growing without disabling ICMP packets. BR Jerzy Dukaj