Hi, I am facing an issue with Windows 2008 x64 Server (any edition). It frequenlty crashes due to lack of Physical Memory and when we check no other programs uses so much Physical Memory to create the issue. After some investigation with RAMMAP utility, we noticed that Processes (any windows executable) which are terminated does not release some part of Physical Memory (4KB under Private Bytes and 16KB under Page table). So any process terminates, does not release 20K of Physical Memory and gradually, server crashes when complete Memory chews up. We did some more investigation and noticed this issue Started after installation of one particular application on the server and issue stops after uninstalling this software. We had created a call with the Application Vendor and they confirmed that it is not an issue with their application, it is a Windows issue. Their view "This Application is not running as any Service and will be executed only when Someone starts the Application. As the issue exists, without executing the application it is not application problem. Also, not only their application exe, all windows executable leaves 20K of Physical Memory and as, Windows is responsible for Memory Management it is an issue with Operating System. Would someone help me to identify why this OS misbehaviour is happening. Thanks

You might try to scan system files to see if the application changed some files. Run a cmd prompt as administrator and run "sfc /scannow" you can also add the /"verifyonly" if you dont what it to replace files Process Explorer can also give a better overview of your memory http://technet.microsoft.com/nb-no/sysinternals/bb795535 /Olav

Hi Olav, Thanks for your response. I tried with sfc /verifyonly and it did not show any issues (all files are OK). Process explorer is not showing this part of unused (or leaking) Physical Memory. In Task Manager Physical Memory usage is 1.6GB, but sum of WorkingSet size of all processes is only 950MB. Above image shows the Mem usage of Terminated processes. All these PIDs does not exist (not running on the machine), but still uses Memory. Thanks

Any program will leave 20K of physical memory with or without the application is running, but the issue will not occur if remove the application. Is this correct? If this is correct, then the application should cause something like a conflition, specifically it occurs on any edition of Windows 2008 x64 server as you mentioned. What kind of application it is? Please provide more information about it so we can check if any one have a similar issue. Also I would like to confirm, if we reboot the server, without running the appliction, whether the same issue occurs if we start any program such as Notepad, Office program etc? And if we disable any security program, backup program etc and reboot, without running the appliction, whether the issue still exists?TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.

Yes, you are correct. Exactly the same issue. Problematic application is Netapp Single Mailbox Recovery. I have identified the driver creating the issue. With the help of Procmon, noticed that it installs two drivers during SMBR installation. Drivers are Aksdf.sys and Hardlock.sys, both are drivers from Aladdin Knowledge Systems. This driver was loaded through CurrentControlset->Services, after stopping Aksdf.sys, issue stopped. This is a filter driver from Aladdin, used for USB Dongle licensing. I also tried to update the driver to the latest version from Aladdin on a test server, that also resolves the issue. I am planning to uninstall this driver, as I am not using USB licensing key for the application. I am interested to know what this driver was doing internally on the OS to create the issue. If you have any info to find this out, please share. Thanks for the support.

Sorry to revive an old thread, but I have exactly the same problem but on Windows 7 Prof SP1 64bit and I do not have the Netapp Single Mailbox Recovery installed. Every terminated process leaves a 20k footprint in memory, slowly killing the system. Any ideas beyond the application you mentioned? Help would be really appreciated.

Hi Ulchuchu, Are you still facing the issue ? Thanks, Baiju