Consider the following scenario:

• You install one or more Transport Driver Interface (TDI) filter drivers on a computer that is running Windows Server 2008 or Windows Vista.
  Note: Some antivirus and some firewall applications may install one or more TDI filter drivers.
• An application calls one or more of the following Winsock API functions together with the TF_REUSE_SOCKET flag:
  • TransmitFile
  • TransmitPackets
  • DisconnectEx

In this scenario, the handle count of the application keeps increasing. When the system resources are exhausted, the computer stops responding. Additionally, you have to restart the computer to recover from this issue.

You have a computer that is running Windows Vista or Windows Server 2008.You use Windows Internet Explorer 7 or Windows Internet Explorer 8 to try to browse an Arabic Web site that uses the Uniscribe API to process Arabic scripts. In this situation, Internet Explorer stops responding.

You have a computer that is running Windows Vista or Windows Server 2008.You use Windows Internet Explorer 7 or Windows Internet Explorer 8 to try to browse an Arabic Web site that uses the Uniscribe API to process Arabic scripts. In this situation, Internet Explorer stops responding.

Consider the following scenario:

• You open or create a file by calling a function and setting the FILE_FLAG_DELETE_ON_CLOSE flag on a computer that is running Windows Server 2003, Windows Vista, or Windows Server 2003.
• You create a file mapping object for the file and then create a mapped view object for the file mapping object.
• You close the file before the mapped view is unmapped.
• You try to lock the volume that stores the file by calling the DeviceIoControl function together with a FSCTL_LOCK_VOLUME control code.

In this scenario, the DeviceIoControl function fails and an ERROR_ACCESS_DENIED error is returned.

This problem affects applications that use the DeviceIoControl function to lock a volume. For example, some backup applications may crash or raise exceptions unexpectedly.

Applications may stop responding or may encounter other function failures if these applications call the LCMapString function on a computer that is running Windows Server 2008 or Windows Vista. For example, because of this problem, Exchange Server 2007 may stop responding or may encounter index corruption.

You develop an application that subscribes to ISensLogon interface events. However, when you run the application in Windows Vista or in Windows Server 2008, the application stops receiving logon or logoff event notifications after you log off the operating system.

Consider the following scenario:

• An application or a service calls the WTSQuerySessionInformation function to query some terminal server session related information.
• The second parameter is 0 and the third parameter is WTSInitialProgram or WTSApplicationName.

In this scenario, under heavy stress conditions, the memory usage of the application or the service keeps increasing.
Further investigation indicates that the WTSQuerySessionInformation function leaks memory. Additionally, the GetLastError function returns an incorrect error code.

Consider the following scenario:

• You have a computer that is running a 64-bit version of Windows Server 2008 or Windows Vista.
• On this computer, a process calls the CreateProcessWithTokenW function to create a child process that runs under Windows 32-bit on Windows 64-bit (WOW64).
• The WOW64 child process is created to redirect standard input (STDIN), standard output (STDOUT), and standard error (STDERR).

In this scenario, the redirections do not work in the WOW64 child process. Therefore, any applications or services that depend on the redirection feature do not work.

You develop an application by using the WTSWaitSystemEvent function in Windows Vista or Windows Server 2008. You set the value of the EventMask parameter to WTS_EVENT_FLUSH in the WTSWaitSystemEvent function. The WTS_Event_Flush value enables you to receive all pending WTSWaitSystemEvent function calls on the specified terminal server handle. However, when the application runs in Windows Vista or Windows Server 2008 and the target server runs Windows XP, pending calls to the WTSWaitSystemEvent function do not return as expected.

When this problem occurs, the application that uses the WTSWaitSystemEvent function will crash. Therefore, you must end the corresponding process in Task Manager. This recovers the application.

Notes

• In Windows Vista RTM, a function fails when the target server is a local computer, or when it is a remote computer that is running Windows XP. However, hotfix 941561 resolves this problem. After you apply hotfix 941561, the function works both locally and remotely.
• In Windows Vista Service Pack 1 (SP1) or in Windows Server 2008, the function works locally. However, it fails if the target server is running Windows XP.

In a network environment, you run an application to monitor a computer that runs Windows Vista or Windows Server 2008. The application, such as Microsoft Operations Manager (MOM) 2005, SQL Server Management Studio, or .NET, uses an event log API in legacy Windows. However, the application does not receive event information in a readable format.

The affected event logs include the following:

• Descriptions of Application log events from the Microsoft-Windows-RestartManager source.
• Descriptions of Application log events from the Microsoft-Windows-ApplicationExperienceInfrastructure source.
• Descriptions of System log events from the Service Control Manager source.
• Descriptions of System log events from the Microsoft-Windows-TBS source.

Note: The hotfix that is mentioned in Knowledge Base article 961099 addresses the event sources that are related to Security event log. These event sources include the following:

• Microsoft-Windows-Security-Auditing
• Microsoft-Windows-Eventlog