winlogon.exe on 2003 server using LOTS of memory?

[realized]

I have a box with 3 users logged in, no users accessing shared devices (printers, folders, etc), and these users have been gone since friday anyways.. Anyways...

My winlogin.exe according to taskmanager is using 400mb of ram which seems like a LOT.

Is this normal? I have 2GB ram, and running win2003 Standard, with MSDE, no iis or anything..

[jroc]

I'd say do some investigating....I use Server 2003 and 1.5g of ram..and winlogon.exe is only using 504K of Memory.

[cluberti]

Running perfmon and poolmon should tell you what is using all of that memory - sounds like a leak in something running in the winlogon.exe process. Do you perchance have Citrix or Symantec PC Anywhere installed?

The only reason I ask, is we only see winlogon leaks when a program has replaced the default gina with it's own (which both of the above do). There are others, but those are the ones I see the most.

Edited January 4, 2006 by cluberti

[Bleeder]

Probably a stupid question, but does this problem server have SP1 for Windows 2003 installed?

[realized]

Windows 2003 SBS (Service Pack NONE).

what is "poolmon" ?

I will do some research and report back asap.

[cluberti]

First, download Perfwiz:

http://www.microsoft.com/downloads/details...&displaylang=en

Use the wizard to start performance monitoring on your server, but make sure you select the "High CPU" option to capture thread information. Don't select the "Terminal Server" or "Exchange Server" options when prompted either, as these will skew the results.

Stop the logs after awhile and take a good look at the performance log file(s) that were created - you should get some indication as to what is using memory in the winlogon.exe process. If you need to dig deeper, let me know and I can give some more assistance.

[Bleeder]

Windows 2003 SBS (Service Pack NONE).

what is "poolmon" ?

I will do some research and report back asap.

Any reason you're not running SBS 2003 SP1? It's been available for at least 6 months now, and would probably be Microsoft's 1st recommendation if you called them.

Edited January 7, 2006 by Bleeder

[cluberti]

No, it wouldn't. We would suggest what I just suggested.

[fizban2]

How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks

http://support.microsoft.com/kb/q177415/

Poolmon will monitor memory tags and allocation of memory from the system paged and non page memory pools. this will help you find where the memory leak is taking place or point you in a better direction to look, check the article, very detailed

OverView of pool mon and what it does.

http://www.microsoft.com/technet/prodtechn...9ae75acfb5.mspx

Edited January 8, 2006 by fizban2

[cluberti]

Thanks - I didn't want to explain poolmon until the perfmon data was analyzed (you can usually see leaks in perfmon, which is easier for most people to read than raw pooltag data), but thanks for pointing out the links anyway .

It's always good to have too much data than not enough .

[fizban2]

i would agree with you, perfmon is much easier to read, having used poolmon only once though i know what you mean by the overwhelming of data.

realized - have run perfmon yet and gotten data back from that? no need to worry about poolmon until you have gotten the data back from perfmon.