Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our production server (Win2K3 with IIS6) crashes every three or four days due to paged-pool depletion. I located the fault driver: ksecdd.sys with poolmon.exe from Microsoft.

But don't know what to do next, since ksecdd.sys is not some third party driver but Microsoft Windows Kernel Mode Security Support Provider. Here is a KB article about ksecdd.sys leaking paged-pool memory(http://support.microsoft.com/kb/953535):

This problem occurs because the Ksecdd.sys driver does not release the old SSL user context when renegotiation occurs. Each SSL user context uses some paged pool memory. Therefore, the system stops responding after the available paged pool memory is exhausted.

However, our server does not have too many SSL connections(750 established) hanging around. Except this KB, I can't find related information about ksecdd.sys. Does any one have similar experiences with this driver?

share|improve this question
I have no direct experience with this problem so I'm leaving this as a comment rather than an answer. It looks to me like it's a cumulative leak. Each new SSL connection appears to cause a leak. Having 750 established connections at any given moment means that you've probably had thousands of previously established and closed connections. Each one is probably leaking some memory. I'd install the hotfix. –  Evan Anderson Oct 30 '09 at 12:49
@Evan: We actually have six identical servers running IIS6 behind Netscaler using round robin load balancing. Only one of them experiences paged-pool depleting, so I first ruled out the possibility of SSL leaking because I can confirm there is no configuration differences among those servers. But your comment do remind me of one possibility: we updated our C# applications last week which included some authentication features of .Net framework(i.e System.Web.Security.FormsAuthentication class). I suspect that most http requests need those authentication features fall on the crash server. –  yanglei Oct 30 '09 at 14:08
What are you asking? Are you asking for a fix? The KB article you linked contains a hotfix. –  Ian Boyd Oct 30 '09 at 17:09
Ian, The KB Article refers to Server 2008 but yanglei is running Server 2003. Yanglei this sounds like it would be worth contacting Microsoft Support about since it is their driver. –  Sim Nov 1 '09 at 12:15
Maybe it's your NIC drivers? –  Bigbio2002 Jun 10 '12 at 0:05
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.