Registry keys not being closed

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   We're having issues on a number of our servers where the system is continually getting event ID 2020 and 333 errors. After heavily researching the issue, I've found out the following:

Our PagedPool is filling up gradually over a number of days.  Running poolmon shows that the "Key" tag grows increasingly large, occupying a large majority of the Paged Pool. Unfortunately, this doesn't point to a third party app, but Windows itself.

Looking closer, I see that the System process in Task Manager occupies an increasingly large number of handles. After reboot, it will be a few thousand, then it grows and grows. Near the time where the server is about to hang, the System process may have 1.5 to 3 MILLION handles.

Running "handle -s" I see that almost all of the open handles are of type "Key". So there are apparently lots of registry keys that are being left open.

Running a full dump using handle (handle -a) shows that there are a number of registry keys open, but the worst offender being "HKLM\SOFTWARE\Microsoft\Cryptography\RNG". (I'm not sure the problem is limited to this key, but it's a good example.)

So I run regmon. If I filter on "RNG", I see only the key specified above. I notice that the usually pattern is:
OpenKey
QueryKey
SetKey

A number of different applications access the key in the same manner.

If I logon to a machine that is not having the issue, I see a different pattern:

Open Key (by application.exe)
QueryKey (by application.exe)
CloseKey (by System)
SetKey (by application.exe)

So it appears as if the affected servers are not doing their job in closing the key after it is being used.

Does anyone have any ideas on how I could fix this? How do I tell Windows to clean up after itself and why are some servers doing it while others are not?

Any help at all would be greatly appreciated. Thanks!