Possible Guest Networking Issue with KB958644 out-of-band patch

[Gordon_Freeman]

Wanted to drop everyone a line about the following issue we recently experienced:

Windows 2003 Standard 32-bit SP2 guest VM running some IIS apps and another incident ticketing app. The server was patched with KB958644 and the following day experienced the following errors (similar to this thread: 😞

Event Type: Error

Event Source: NETLOGON

Event Category: None

Event ID: 5719

Date: 3/12/2008

Time: 12:51:09 PM

User: N/A

Computer: scrubxxx

Description:

This computer was not able to set up a secure session with a domain controller in domain SCRUBDomain due to the following:

Not enough storage is available to process this command.

This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1053

Date: 3/12/2008

Time: 12:45:03 PM

User: NT AUTHORITY\SYSTEM

Computer: scrubxxx

Description:

Windows cannot determine the user or computer name. (Not enough storage is available to complete this operation. ). Group Policy processing aborted.-----

Attempting to RDP to the server would get these error messages:

"The system cannot log you on due to the following error: The RPC server is unavailable."

"The system cannot log you on due to the following error: Access is denied."

After investigation, it was determined that all 5000 ports available to the OS were in a CLOSE_WAIT state and no further ports could be created. The faulting application was the ticketing system and disabing the services for the application restored the server. It is theorized that the ticketing app's code (possibly in relation to netapi.dll) was broken or otherwise disturbed by KB958644.

I would appreciat it if anyone else would post their experiences with KB958644 in guest VMs. Thank you.

[weinstein5]

Welcome to the Forums - Out of curiosity did you check this part of the error message out -

Not enough storage is available to process this command.

Do you have enough disk space available on you VM? I had a client who had used another consultant set up their VMs and left the virtual disk size at the default of 4 GB for the system drive of their Win2K3 VMs - needless to say after about 3 months they were out of disk space and having similar problems -

If you find this or any other answer useful please consider awarding points by marking the answer helpful or correct -

[Gordon_Freeman]

Thank you for your reply. Yes, storage was initial target of the investigation. The phrase "Not enough storage is available to process this command." is misleading because (from research) it appears to be related to memory "storage", not disk storage. But, yes, it was confirmed that there was enough disk space for the system partition. Memory resource issues were completely ruled out during the troubleshooting, too. The issue appears to be related to an application consuming all available TCP ports and holding them in a CLOSE_WAIT state. We were able to disable the services related to the application and restore service.

Note: It is possible to increase the default port count via MaxUserPort reg hack, but this can be non-trivial due to a DNS update which requires you to reserve all applications' listening ports above 1024.

[XIAOLEIHU]

I have encountered a similar problem recently. Your comments is helpful. Thank you, Gordon.