SAM context handle limits
The Windows security account manager (SAM) server component is a remote procedure call (RPC) server that is based on context handles. Every client creates a stateful connection to the SAM while the client requests a sequence of services from the SAM server. To help protect the server from memory exhaustion, SAM enforces limits on the number of concurrent open handles. This limit on the number of concurrent open handles is similar to the limits that TCP can have on the total number of connections.
The limit for Windows NT 4.0 and Windows 2000
In Windows NT 4.0 and Windows 2000, there is a maximum of 2048 handles. This limit holds regardless of the security identity of the client or network addresses. The clients and the network addresses may be local or remote. If you know what kind of handle was leaked, it may be easier to find the offender.
The limit for Windows Server 2003
Windows Server 2003 tracks context handles on the Security Identifier (SID) of the caller. (The SID of the caller is the result of the
RpcImpersonateClient function). You can have 1024 total number of individual clients, and each client can have 2048 active handles at the same time. There is no count of the total number of contexts.
Note The 838184 hotifx for Microsoft Windows Server 2003 raised the total number of indivudual clients from 1024 to 2048.
For additional information about how to obtain this hotfix, click the following article number to view the article in the Microsoft Knowledge Base:
838184
Error messages occur when you modify objects in Active Directory in Windows Server 2003
Troubleshooting
The SAM RPC connection uses the "named pipe" transport. Therefore, you can use the
net sess and the
net files commands to track connections. The following examples show sample output that was obtained from a domain controller by using these:
C:\>net files
ID Path User name # Locks
-----------------------------------------------------------------------
8 \PIPE\samr ADMINISTRATOR 0
10 \PIPE\samr ADMINISTRATOR 0
The command completed successfully.
C:\>net sess
Computer User name Client Type Opens Idle time
-----------------------------------------------------------------------
\\172.26.221.19 ADMINISTRATOR Windows 2002 2600 2 00:00:00
The command completed successfully.
These examples demonstrate that "Administrator" has two separate RPC context handles open at the same time. This information is helpful for the following reasons:
- You can run down the SAM RPC context by closing the \pipe\samr files. To do so, you can use the net files 8 /close command.
- The output shows the security context of users who have open handles. This example shows the client computer. However, it is not always easy to match the file ID to a computer. By design, Windows does not give this information to programs.
Note When the connection anonymous (also known as a null session), the user name field is blank for both commands.