Consider the following scenario:

• You install one or more Transport Driver Interface (TDI) filter drivers on a computer that is running Windows Server 2008 or Windows Vista.
  Note: Some antivirus and some firewall applications may install one or more TDI filter drivers.
• An application calls one or more of the following Winsock API functions together with the TF_REUSE_SOCKET flag:
  • TransmitFile
  • TransmitPackets
  • DisconnectEx

In this scenario, the handle count of the application keeps increasing. When the system resources are exhausted, the computer stops responding. Additionally, you have to restart the computer to recover from this issue.

On a computer that is running Windows Vista or Windows Server 2008, a memory leak occurs in the Wmiprvse.exe process when you query either of the following iSCSI Windows Management Instrumentation (WMI) Classes:

• MSiSCSIInitiator_SendTargetPortalClass
• MSiSCSIInitiator_TargetClass

Additionally, the memory usage for the Wmiprvse.exe process continues to increase. In this scenario, memory runs out and the WMI query does not respond.

Consider the following scenario:

• You connect a universal serial bus (USB) camera to a computer that is running Windows Vista or Windows Server 2008.
• You plug in and then unplug the USB camera from the computer several times.

In this scenario, system performance is slow.

If you use the Driver Verifier (Verifier.exe) tool to verify the USB camera driver (Usbcamd2.sys), the computer crashes when you unplug the camera. Additionally, you receive the following Stop error message:

*** Fatal System Error: 0×000000C4 (parameter1, parameter2, parameter3, parameter4) DRIVER_VERIFIER_DETECTED_VIOLATION

An application or a service that uses the NTLM authentication runs on a computer that is running Windows Server 2008 or Windows Vista. In this scenario, the memory usage of the Lsass.exe process keeps increasing. If this issue lasts for a long time, the application or the service may stop responding or encounter an exception because the available memory is too low.

For example, this issue occurs when a Web server uses NTLM for outgoing authentication. After this issue occurs, the Web server stops responding, and you must restart the server to recover from the issue.

This article describes a new Memory Pressure Protection feature for TCP stack. This new feature is provided by security update 967723. The Memory Pressure Protection feature consists of three security settings. These settings include Memory Pressure Protection (MPP), Profiles, and Port Exemption.

Consider the following scenario:

• An application or a service calls the WTSQuerySessionInformation function to query some terminal server session related information.
• The second parameter is 0 and the third parameter is WTSInitialProgram or WTSApplicationName.

In this scenario, under heavy stress conditions, the memory usage of the application or the service keeps increasing.
Further investigation indicates that the WTSQuerySessionInformation function leaks memory. Additionally, the GetLastError function returns an incorrect error code.

On a computer that is running Windows Vista or Windows Server 2008, consider the following scenario:

• When the computer is offline, you change a file or a directory in the Client-Side Caching (CSC) folder in which the operating system stores offline files.
• You bring the computer back online and sync the offline files.

In this scenario, if you try to log off the system, the computer crashes and memory corruption may occur.

The same problem occurs on a portable computer that is running Windows Vista or Windows Server 2008. If you dock or undock the computer during the period when the computer is in hibernation, and then try to log off the system after the computer resumes, the computer crashes and memory corruption may occur.

Consider the following scenario:

• You monitor remotely a computer that is running Windows Server 2008 or Windows Vista from a computer that is running Windows Server 2003 or Windows XP.
• You use the WMI interface to monitor performance and to monitor remotely (the “perfmon /wmi” command).
• You open the Add counters dialog box on the computer that monitors remotely. In the Add counters dialog box, you continuously scroll up and down through the items in the Performance Objects list.

In this scenario, the memory usage of one wmiprvse.exe process keeps increasing. After some time, you cannot monitor remotely, and the data collection stops.

Your computer is running Windows Server 2008 or Windows Vista. You have an application that calls Performance Data Helper (PDH) APIs to add and delete V2 performance counters. However, in this scenario, the handle count and the memory usage of the application keep increasing.

Consider the following scenario:

• You have some high-performance storage devices that are installed on a computer that is running Windows Server 2008 or Windows Vista. For example, you have a host-based RAID or a fiber-channel adapter installed.
• Some applications or services, such as Microsoft iSCSI Software Target, frequently scan, mount, or unmount volumes on this computer.

In this scenario, the nonpaged pool memory leaks continuously. Therefore, the performance of the computer begins to decrease. Eventually, all nonpaged pool memory is used, and the computer may crash. Or, the computer may automatically restart with a Stop error code.