Endpoint Protection

Hello everyone,

Question about insufficient resouorce on file sharing.

I have been install the SEP 11.0 MR3 on Windows Server 2003 Ent. R2. I have a probelm about insufficient resource on file sharing. Our client pc did not see the file on the server. I checked the PerfMon and PoolMon on the server  then the MmSt tag increased the paged pool about 220MB. And 2nd highest pool was SaEe tag that use the paged pool about 80MB.

I found the Microsoft KB 948732 and Symantec Docid 2007102613484948. I think this problem rather like on our site. But the article wrote SEP 11.0 MR3 fixed on MR4 update. Another issue the srtsp.sys on MR3 have the file sharing problem with Windows Server 2008. This problem only occured Windows Server 2008?

If any people have a good solution, please let me know.

Thanks,
Shu

Can you go through this link and check if these are addressed..

Maintenance Release 4 Maintenance Pack 2 (MR4 MP2)

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid_p/2007121216360648



 

I was wrong.

Correction:
The Microsoft KB 948732 and Symantec Docid 2007102613484948 fixed on MR3. I am already use this version.

Thanks,
Shu

Hello Rafeeq,

Thanks for fast reply!
I found the suspicious issue on Fixed ID 1511152.  I will have a talk to my boss and I try to fixed it.

If it was fixed then I will report in-depth data here.

Thanks again,
Shu

upgrade to the latest version on one box and check the results.

will wait for an update

Hi Rafeeq,

We have been update the SEP MR3 to MR4 MP2. But this problem still occurred. I am re-search this problem again. Maybe it problem caused by hardware or another application. So we are double checking both components.

If we are any findings then report here.
Thanks


Reference Information:
[ Perfmon result ]


[ PoolMon result ]

No	TAG Name	Allocate Size	Free Size	Diff	Bytes	Per Allocate	Mapped Driver
1	MmSt	6902383	6804873	97510	220957448	2265	[nt!mm        - Mm section object prototype ptes]
2	SaEe	283515	282874	641	84483712	131799	Unknown Driver
3	Ntff	4656747	4601348	55399	45205584	816	[ntfs.sys     -     FCB_DATA]
4	NtfF	1026063	983215	42848	40105728	936	[ntfs.sys     -     FCB_INDEX]
5	IoNm	143262246	143228148	34098	8311152	243	[nt!io        - Io parsing names]

Seems like the problme is with autoprotect..

can u disable the autoprotect on your server and check if that goes down.

policies - antivirus and antispyware - uncheck file syatem autprotect

check if thats working..

Hi Rafeeq,

I have found the solution!! I checked the registry again then found mistake...

Server administrator modify the registry 'PoolUsageMaximum.' Microsoft provide the procedure of changing this registry but this procedure is wrong.
(See Microsoft  KB935649)

This registry have to be set 60 by 'decimal number' but if do what Microsoft told then set 96 by decimal number. Because they said 'Create DWORD key and in the Value data box, type 60, click Decimal, and then click OK.' So I fixed it then function well. I think in the first place, increased the pool caused by auto protect but this wrong registry was get worse.

I appreciate your kindness support!

Thank you.
Shu