Multiple redundant csrss.exe processes cause crash

Discussion in 'Windows 64bit' started by oscartheswede, Dec 5, 2007.

  1. Hello!

    Im trying to troubleshoot a problem on a Windows 64x 2003 Server running as
    a Terminal Server... Over the course of about two weeks enough redundant
    "ghost" csrss.exe processes from former logins remain, slowly building until
    the RAM/VRAM runs out resulting in an inevitable IRQL error, which causes the
    server to crash. As the csrss.exe is a system process I cannot terminate it
    as-it-comes, instead I am forced to schedule continual and repeated reboots
    to maintain the csrss.exe process buildup to a minimum...


    Ive understood that running 32 bit applications on a 64 bit terminal server
    is problematic at best, so I took the liberty of looking into the windows
    registry and found that two keys were registered under the Wow6432Node:
    An "alternate" registry key for both is maintained together with the rest of
    the 64 bit keys, and I am unsure of whether or not both the 32 bit keys are
    integral for running the 64 bit application as a whole (as i have heard that
    it is common for 64 bit applications to have small 32 bit processes
    integrated into their architecture)... Does this have anything to do with the
    redundant csrss.exe?

    Any help would be gratefully accepted, at the moment Im feeling pretty lost
    as too what to do :/... Im aware of the issues surrounding the use of
    Terminal Servers but it is the only relevent solution for our business needs.
    Ive done the works with chkdsk etc but havent been able to find the source of
    the bothersome 'csrss.exe' processes.
    oscartheswede, Dec 5, 2007
    1. Advertisements

  2. oscartheswede

    Mike Douglas Guest

    Hi There. I run 3 Windows 2003 R2 X64 Enterprise Edition with Service Pack 2
    servers. Never seen this issue you have. You fail to mention what service
    pack level you are at?

    Mike D
    Mike Douglas, Dec 5, 2007
    1. Advertisements

  3. oscartheswede

    Mike Douglas Guest

    I also forgot to mention I am running Terminal Services on these 3 Servers I
    got along with Citrix PS 4.0 X64 Edition.
    For every user logged into the server you are suppose to see an instance of
    csrss.exe. THis is because the csrss.exe file is part of the log on process.
    Now when a user logs off then this process will go away for that user. This
    is by design.
    Hence the reason why you do not see a lot of these instances of csrss.exe
    when no one is logged into the server.

    Mike D
    Mike Douglas, Dec 5, 2007
  4. oscartheswede


    Jun 4, 2008
    Likes Received:
    Hi oscartheswede,

    I got the same problem on windows x32 2003 R2 enterprise edition SP2,

    i'm running terminal server on five servers for almost 300 users.

    I had to go back to the windows x32 2003 std SP2 for the moment.

    The problem appears to be only during a user login, file servers or others no problem.

    This bug is known on the microsoft KB, see in my case it's exactly the problem.

    I ordered the patch from Microsoft but it doesn't install after SP2.

    For the moment they are investigating the case...

    If you find a solution, please mail me.

    Now i'm thinking about desinstalling Sp2 to apply KB837585 patch and then return to sp2. I'll try that as soon as possible.

    PS: My Servers : Hp Proliant Dl 360 G5 / 8gb Ram (in case of hardware problem ???)
    Last edited: Jun 4, 2008
    jcf, Jun 4, 2008
  5. oscartheswede


    Jun 4, 2008
    Likes Received:

    For me the problem is solved,

    it happears that there's an incompatibility between the integrated NIC (with TOE) and NLB (redirect tcp connections).

    I switched to an Intel NIC (no TOE inside) and the csrss program now runs well.
    It opens and closes with user logon wihtout problems.

    Things are back to "normal conditions".

    For information the integrated NIC on my servers are Broadcom one's with TOE integrated, i have tried to de-activate TOE in the drivers but it has done nothing. It has to be another NIC...

    Hope this Helps

    jcf, Jun 5, 2008
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.