cluberti

You can download perfwiz from the Microsoft site to configure perfmon automatically. However, if you've got a leak in winlogon.exe, you need to tell us what kind of leak it is - is it a memory leak, a handle leak (and if so, is it a memory handle leak or a file handle leak), or is your monitoring software just too picky ? I would rather suggest to you, that when your monitoring software is complaining about a leak in winlogon.exe, that you instead do the following: First, install the "Debugging Tools for Windows" from: http://www.microsoft.com/whdc/devtools/deb...installx86.mspx Once these tools are installed, do the following: 1. Create a directory called c:\adplus 2. Open a command prompt and change to the directory where you installed the debugging tools. By default, this is "C:\Program Files\Debugging Tools for Windows" 3. Type the following command in the command prompt: cscript adplus.vbs -hang -pn winlogon.exe -o c:\adplus This should create a .dmp file in the C:\adplus folder - load that up in windbg or cdb and look and see what is actually running in the winlogon.exe process. If you need help with that, we've got some people here who are decent debuggers - PM me and I'll provide an upload location for you, and we can take a look.

I second Mr Snrub's question of "what does the application vendor say"? Anything opening a file of that size will definitely be a candidate for... issues... on a 32bit system. Have you ever considered Windows XP x64 for that application? That's a large file, and Mr Snrub is right - you could very well be running out of epheneral ports too .

When a machine boots fine in safe mode, but has issues booting normally, it's going to be a driver issue, or a startup service/startup item issue. Use msconfig when you are in safe mode to disable all non-Microsoft services and any and all startup items you can, and reboot normally and see what happens.

Are you getting any 2019s or 2020s in your system event log? Also, are you using the /3GB or /PAE options in your boot.ini file? As a quick relief, you can try the following settings to REALLY beef up the kernel pagedpool resource, but if you're getting 2019s (kernel nonpaged pool) you're probably SOL. Poolmon can be used to determine which tag is using up your resources in kernel, but the amount of RAM will have little to do with the error message you're getting. Key: HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters Value: PoolUsageMaximum Type: REG_DWORD Radix: Decimal Data: 20 Value: PagedPoolSize Type: REG_DWORD Radix: Hex Data: FFFFFFFF Value: SystemPages Type: REG_DWORD Radix: Hex Data: FFFFFFFF

The next time it crashes (if configured), the system will generate a complete memory dump. You then open that .dmp file with a debugger.

Well, considering that renaming DCs in NT4 is unsupported (because it breaks the trust between the server and the domain), I'm not surprised things are failing. DC renames are only supported in AD, and domain renames are only supported in 2003 AD. You're going to have to kill the old domain and create a new one before things start working properly again, I'm afraid.

Welcome to one of the most annoying group policy settings ever - wallpaper. I've found that using anything but a .bmp results in fun for all - not sure why it would fail with the recycle bin removed, but if you change the .jpg to a .bmp and use that in your GPO, does it work when also removing the recycle bin?

Assuming these things have PS/2 keyboards, and if attached to a KVM it doesn't capture the Scroll Lock key, do the following: 1. If you have a feature like Compaq's Automatic System Restart (ASR), please disable it. This setting is usually found in the BIOS. With this feature enabled, if the BIOS does not detect a heartbeat from the OS, it will restart the server. This will interrupt the dump process. 2. Create or set the following registry value: Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters Value: CrashOnCtrlScroll Type: REG_DWORD Data: 1 Refer to the following Knowledge Base article for more information on this registry key: 244139 Windows Feature Allows a Memory.dmp File to Be Generated with Keyboard http://support.microsoft.com/?id=244139 3. Right-Click on the "My Computer" icon on the desktop and select "Properties"; this will open the "System Properties" window. Go to the "Advanced" tab and click "Performance Options". Click "Change" under "Virtual Memory". Set the pagefile to be located on the partition where the OS is installed, and set it to be equal to Physical RAM + 50 MB. 4. Also in the "System Properties" window, click on the "Advanced" tab, then click "Startup and Recovery". Make sure "Complete Memory Dump" is selected (see 4a if this is not in the list). You can change the location of the memory dump file to a different local partition if you do not have enough room on the partition where the OS is installed. 4a. If the "Complete Memory Dump" option in step 4 is not available, you will need to manually set this registry value: Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl Value: CrashDumpEnabled Type: REG_DWORD Value: 1 5. You will need to reboot the server for these changes to take effect. The next time that the server is hung, you can go to the console and hold down the RIGHT CTRL key and press the SCROLL LOCK key twice to cause the server to bugcheck and create a memory.dmp file. This .dmp file will show what the server was (or wasn't) doing when it hung. Note that if you try this with a PS/2 keyboard and it doesn't work, you've got a hardware problem for sure .

Perhaps you could tell us which sound card you are using, and what driver version - portcls is one of the dll's XP uses to send sound from the system through to your sound card's drivers - perhaps you could configure your machine for a complete dump and we could have a look at the call stacks. It is very possible that portcls.dll is the victim here, and not the culprit, but you won't know for sure until the dump is analyzed.

use the %COMPUTERNAME% variable...

I would make sure you're configured for a complete dump, have the paging file on C: (and at least RAM + 50MB), and automatically reboot is checked as well. If these servers are Compaq/HPs especially, you also need to disable the ASR in the BIOS so the dump can be generated. So you don't see any SaveDump/1001 events (assuming Windows 2000/2003)?

For reference, it is actually easiest to set "Share" permissions to Everyone/Full Control, and then lock down the folders via NTFS permissions - you would set Administrators/Full Control and UserX/Change on each folder (where X is the user number), and then set UserX/Deny on the folder for the other user. This will allow access for the correct user and deny for any others. Then, on all folders up the tree from the two user folders, you can simply give the users Read permissions, and they won't be able to do anything but read. Share permissions are a bad way to secure a resource - use NTFS permissions instead whenever possible.

What about a domain controller? And, you really should have two (at least), even in a small environment - so you can have two GCs, and spread the FSMO roles...

If you're using it as a firewall and VPN server, then yes, 2GB of RAM would be goot, 4GB might be even better if you're servicing more than 50 VPN connections at one time.

2006 is still a beta, so unless you have no qualms about beta software in your org, go for 2004. And yes, that HP box would be appropriate.

DC = domain controller And Exchange requires lots of memory (and is poor at management of said memory), and DC's also require quite a bit of memory - therefore, it is STRONGLY suggested, if you want stable servers, to not run Exchange on a DC .

Oh, one other thing I failed to mention. If this is Outlook 2003 w/SP1, you should install the Post-SP1 rollup patch - 839629. There were some memory-leak related fixes in there, and this does fit the criteria. 839629: Description of the Outlook 2003 post-Service Pack 1 hotfix package: August 21, 2004 http://support.microsoft.com/default.aspx?...kb;EN-US;839629

Note the workaround patch will be disabled with the June updates, so don't rely on that. It's only to give devs time to update their code to work properly with the patch, not to fix the symptoms.

- just keep nodding...

Why don't you use ADAM and set up a separate AD for the SFTP/external users? You could set up a one-way trust as well, if necessary. This would keep your internal and external userbase separated.

On the client, check the following values: Key: HKLM\System\CurrentControlSet\Control\LSA Value: lmcompatibilitylevel Value: restrictanonymous You might try setting those to 0 and reboot, and see what happens.

If you're going to be safe, you'll be adding at least one server for each additional task. If your Exchange server is on a DC, you should be adding another server for a dedicated DC as well (never run Exchange on a DC, unless it's SBS!!!). So, I'd say you'd end up with 1 server for each of the following tasks: Exchange, DC (2x), File/Print, Database, ISA, Security System - 7 servers total.

How much kernel paged and kernel nonpaged pool memory do you have available on the machine? Also, are you using the /3GB and/or /PAE options in your boot.ini file, and if so, why? Also, how much desktop heap is available in the non-Interactive session where services.exe runs? One of these three resource pools is likely full, causing the error. I ask if you're using /3GB or /PAE, because these halve the available memory to the kernel on boot, thus reducing the size of each of these three pools by about 50%.

There are dedicated hardware devices that run ISA 2004, but any Windows 2003 server-class box should be able to run ISA 2004 just fine. If you plan on using it as a caching or VPN server as well, you'll need to beef processor and memory as appropriate - I prefer a dual proc box w/4GB of RAM and SCSI disks, but lesser hardware for a small environment should be fine. Note that if you plan on installing this in a large environment with multiple ISA servers, you'll need to acquire the enterprise edition.

Well, you need to explain it to him in terms "management" can understand, live with it, or find a new boss . Any boss that actively hindered me from doing my job in the past was no longer my boss.