Server Functionality Affected By IRPStackSize

Occasionally, you may try to connect to a server, and get a mysterious error message

Not enough server storage is available to process this command.

Checking memory utilisation, you find no problem. Likewise, disk storage is no problem. Now what?

What you should be checking is the server; that is, the computer that you are connecting to (not the computer displaying the error). Neither the disk storage, nor memory utilisation, is the limited resource; you need to check the IRPStackSize. You'll be using the Registry Editor, and you'll be changing [HKEY_LOCAL_MACHINE\ System\ CurrentControlSet\ Services\ LanmanServer\ Parameters\ IRPStackSize].

Other symptoms which may lead you here are an "Error 1130" in a browstat log, and an "Event ID 2021" in the System Event log.

These symptoms are generally caused by Norton AntiVirus, or a similar product, being installed on your server, and using resources. Articles by Microsoft: (KB177078): Antivirus software may cause Event ID 2011, and by Symantec: How to change the IRPStackSize registry value explain the situation best, and outline the resolution process.

(Note 1): As stated in both articles, if the registry value IRPStackSize doesn't exist, please follow instructions and add it, with an initial value of 18. And be persistent in trying new values. Some readers of this website have reported setting the value as high as 48, for success.

(Note 2): Please note the case and spelling of IRPStackSize. And the Value must have data type of REG_DWORD. Both case, spelling, and data type are critical.

(Note 3): The terminology here may take getting used to. The string (with spaces added to enhance readability)
HKEY_LOCAL_MACHINE\ System\ CurrentControlSet\ Services\ LanmanServer\ Parameters
is called the Registry Key. The string
is called the Value name. And the string
15, 18, or whatever (entered as a DWord)
is called the Value data. My sympathy to you, as you try to absorb this. I don't find it too instinctive either.

(Note 4): You are interested here in
[HKEY_LOCAL_MACHINE\ System\ CurrentControlSet\ Services\ LanmanServer\ Parameters\ IRPStackSize]

You have no interest in
HKEY_LOCAL_MACHINE\ System\ ControlSet001\ Services\ LanmanServer\ Parameters

or any similar alias. If
[HKEY_LOCAL_MACHINE\ System\ CurrentControlSet\ Services\ LanmanServer\ Parameters\ IRPStackSize]

doesn't exist, you have to create it.

(Update 2010/11): It appears that this condition continues, under Windows 7, with slightly different wording.

>> Top


John Overman said...

What services do I need to restart after the change? I would like to be able to avoid an entire system restart to fix this.

Nitecruzr said...

If I was going to do a services restart, rather than a server restart, I'd restart the Server service, and every up / down dependency service. Your guess is as good as mine if you can do this, and whether it will work though.
Make a list, go through it 3 times and check it against BlackViper, then execute. Remember, that's the Server that gets bounced, not your client workstation.

Roger said...

Thanks for the tip. I was having trouble connecting to a 500 GByte drive although connecting to smaller drives on the same server was not a problem. I found the IRPStackSize was missing on the server. I added it, set its value to 18 decimal, and then restarted the Server service. No need to reboot the server.