WMI Call to Win32_NetworkLoginProfile Leaks SAMR Pipes on Windows NT 4 SP6a (818189)

SYMPTOMS

You may experience performance problems on your domain controllers. The domain controllers stop responding or experience system failures or console freezes.

Domain controller clients may receive the following error messages:

Semaphore timeout period has expired

-or-

Network path cannot be found.

-or-

Insufficient system resources.

The command NET FILES run on the domain controller will show SAMR handle references similar to the following:

9999 \PIPE\samr UserName 0

CAUSE

This behavior may occur when Windows Management Instrumentation (WMI) calls to the Win32_NetworkLoginProfile class from a logon script. This WMI function caches the SAMR pipe for reuse later. This function runs under the WinMgnmt service. Therefore, the function will continue to run for the lifetime of the system while the pipe is left open. There is a limit of 2,048 open SAMR pipes on a Windows NT 4 domain controller. For additional information about SAMR pipes usage with domain controllers, click the following article number to view the article in the Microsoft Knowledge Base:

189356 SAMR Pipes Cause Problems with Domain Controllers

RESOLUTION

A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version        Size     File name
   --------------------------------------------------------
   08-Apr-2003  06:13  4.0.1381.7215  256,272  Netapi32.dll

Note Due to file dependencies, this hotfix requires Microsoft Windows NT 4.0 Service Pack 6a.

WORKAROUND

There are two ways to work around this behavior:

Use Active Directory Service Interfaces (ADSI) instead of WMI.
Use script to enumerate net users.

Use ADSI to Enumerate Net Users

To use this procedure, you must have ADSI installed.

288358 HOW TO: Install the Active Directory Client Extension

The following script is an example of how to use ADSI to retrieve net user information:

Dim User 
 Set User = GetObject("WinNT://" & UserDomain & "/" & UserName & ",user") 
 User.GetInfo 
 wscript.echo "Full Name: " & User.Fullname 
 wscript.echo "User Name: " & User.Name

Use Script to Enumerate Net Users

The following example uses a simple script to enumerate net users on a domain.

Note The user and the computer must be in the same domain for the script to work correctly.

Dim oExec,sInput 
Dim wshell 

 set wshell = CreateObject("wscript.shell") 

 set oexec = wshell.Exec("net user %username% /domain") do while not oexec.stdout.atendofstream 
 sinput = oexec.stdout.readline 
 if Left(sInput,9)="Full Name" then 
 wscript.echo(mid(sinput,30,len(sinput)-29)) 
 end if 
 loop