Video Screencast Help

Network connectivity loss on server with Symantec Endpoint Protection acting as Group Update Provider

Created: 04 Dec 2012 | 10 comments
cus000's picture

Any idea why is this suddenly happening? GUP SEP is at RU6 MP3 .....

Error as below:

Windows cannot determine the user or computer name. (Not enough storage is available to complete this operation. ). Group Policy processing aborted.

Comments 10 CommentsJump to latest comment

cus000's picture

Hi Pete,

Not very sure... OS is Win 2003 - 32 bit.

This is very sudden actually, never had this kind of issue at GUP machine....

pete_4u2002's picture

does the solution in article fixes the issue?

it looks like the connections are more compared to the limit that has been set.

MaxUserPort and TcpTimedWaitDelay values can be optimized. "netstat -n" command allow to see number of connections opened and to set appropriate value to MaxUserPort.

Possible values for MaxUserPort are from 5000 to 65534 (the default value is 5000 when this key does not exist). More details available here:

cus000's picture

I've applied the fix to one of the GUP, its under monitoring until end of this week.

What puzzle me is that the default TCP/IP being said in Microsoft article is about 4000, i doubt the GUP is having more than that numbers.....

Maybe 100 at very max.... 

Anybody have experience this before? Would like to understand more.

pete_4u2002's picture

its just not GUP connections, it will also include fileshare,rpc or any traffic that has been established.

do update us on the onitoring part after this week,

Mithun Sanghavi's picture


I agree with Pete's Comment above.

Check this Article:

Network connectivity loss on server with Symantec Endpoint Protection acting as Group Update Provider 


Migrate to the Latest Version of SEP 11.0.RU7 MP3

Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

cus000's picture

Understood, but i still doubt it will reach 4000-5000.

The server is just serving about 20 clients...unless i missed anything.. its possible for these number of clients to reach 4000 connections?

Also the GUP is already on RU6 MP3...

cus000's picture

I've captured Windows 'handle' usage using Mark Russinov tool... i can see the 'System' is using most handles

Also 'netstat' capture did not show anything significant... i mean it's only about 20-30 connections....

Any idea what else to check?

pete_4u2002's picture

does upgrading the client helps?

open a support ticket, you may be asked to run debug and SST logs to understand the issue.

cus000's picture

Thanks for suggestion, i was considering this earlier... but if possible need to somehow confirm if it's due to Symantec issue first...

(you know the drills....if it's SQL or other apps then we'll pass to customer team that handle those...)

The GUP itself is already longtime on RU6 MP3.... SEPM is on RU6 MP2... seems no difference

Only the registry changes fix this....