MSDN - winlogon.exe memory usage

Author

winlogon.exe memory usage

Bobbus

2006-06-17, 8:03 am

I'm running Server 2003 Standard SP1 as a dedicated SQL Server machine. The
server has only been running 50 days since the last reboot, but for some
strange reason the winlogon.exe process has started to eat memory. It is now
at 600mb, and increasing by about 100mb per day.

Can anyone tell me why this process would start to use memory in such a way,
and how I can prevent this in the future. Also, is there any way other than
a reboot to 'restart' this process?

Thanks,

Rob.

Ronny Ong

2006-06-17, 8:03 am

This question belongs in an appropriate newsgroup like
microsoft.public.windows.server.general.

But since I'm already replying...You need to verify first that the
winlogon.exe you're seeing in task manager is the real winlogon.exe which
comes with Windows. There are several known viruses and trojans which try to
hide by naming themselves winlogon.exe. Several tools are readily available
for finding the full path of executing processes, such as Process Explorer
from sysinternals.com or CmdLine from diamondcs.com.au.

If malware isn't the problem, then you're probably suffering from a known
Terminal Services problem. To release the memory, you need to either log on
periodically at the physical console or connect to the console session via
Terminal Services. To connect to the console session via Terminal Services,
you must be using the version of Remote Desktop Connection which comes with
Server 2003. This version can be installed on Windows 9X/2000/XP but you
cannot use the version which comes with XP because it does not have the
capability of connecting to a console session. Once you have the correct
client, add /console at the end of the Computer field. For example, if you
normally connect to 192.168.111.222, you would use 192.168.111.222 /console
instead.

"Bobbus" <Bobbus@discussions.microsoft.com> wrote in message
news:05AC7092-C10E-4ED6-BBE0-8BD12197AD95@microsoft.com...
> I'm running Server 2003 Standard SP1 as a dedicated SQL Server machine.
> The
> server has only been running 50 days since the last reboot, but for some
> strange reason the winlogon.exe process has started to eat memory. It is
> now
> at 600mb, and increasing by about 100mb per day.
>
> Can anyone tell me why this process would start to use memory in such a
> way,
> and how I can prevent this in the future. Also, is there any way other
> than
> a reboot to 'restart' this process?

Ronny Ong

2006-06-17, 8:03 am

I forgot to tell you where to get the correct version of the RDP Client.
Here is the direct URL:
http://download.microsoft.com/downl...47/msrdpcli.exe
(This is not searchable anymore; if you try to search the Downloads for it,
you will only get the XPSP2 version.)

"Ronny Ong" wrote in message news:O93bFQZjGHA.1640@TK2MSFTNGP02.phx.gbl...
> you must be using the version of Remote Desktop Connection which comes
> with Server 2003. This version can be installed on Windows 9X/2000/XP but
> you cannot use the version which comes with XP because it does not have
> the capability of connecting to a console session. Once you have the
> correct

Ramón Sola [MVP Windows - Shell/User]

2006-06-17, 8:03 am

Your Windows Server 2003-based system might be affected by the issue
documented in this Microsoft Knowledge Base article:

You may experience a system memory leak of private bytes in the Winlogon.exe
process on a computer that is running Windows XP or Windows Server 2003
http://support.microsoft.com/kb/912354/en-us

A reboot is the only way to shutdown and restart Winlogon process
gracefully. Winlogon is a critical system process. If Winlogon terminates
abnormally, the Session Manager Subsystem (SMSS) process brings down the
system with a STOP 0xC000021A (STATUS_SYSTEM_PROCESS_TERMINATED).

HTH

--
Ramón Sola / MVP Windows - Shell/User

"Bobbus" wrote:

> I'm running Server 2003 Standard SP1 as a dedicated SQL Server machine. The
> server has only been running 50 days since the last reboot, but for some
> strange reason the winlogon.exe process has started to eat memory. It is now
> at 600mb, and increasing by about 100mb per day.
>
> Can anyone tell me why this process would start to use memory in such a way,
> and how I can prevent this in the future. Also, is there any way other than
> a reboot to 'restart' this process?
>
> Thanks,
>
> Rob.

Bobbus

2006-06-17, 8:03 am

Ramón,

Many thanks for your help. The hotfix did the job. Odd how I could not
find that KB when searching for it before...

Ronny,

Cheers for your suggestions. I'd agree that the post would have been better
suited elsewhere, but MSDN web newsgroups did not have a link to any suitable
newsgroups and I was limited to how I could post at the time.

Cheers,

Rob.

"Ramón Sola [MVP Windows - Shell/User]" wrote:

> Your Windows Server 2003-based system might be affected by the issue
> documented in this Microsoft Knowledge Base article:
>
> You may experience a system memory leak of private bytes in the Winlogon.exe
> process on a computer that is running Windows XP or Windows Server 2003
> http://support.microsoft.com/kb/912354/en-us
>
>
> A reboot is the only way to shutdown and restart Winlogon process
> gracefully. Winlogon is a critical system process. If Winlogon terminates
> abnormally, the Session Manager Subsystem (SMSS) process brings down the
> system with a STOP 0xC000021A (STATUS_SYSTEM_PROCESS_TERMINATED).
>
> HTH
>

Sponsored Links