What Process Owns Non-Paged Pooltag HalB?

D

Dr. Doll

I have a Windows Server 2012 R2 where the non-paged pool suddenly jumps to 8+GB in size. Poolmon shows the tag HalB using most of that space, and typically having 2 million+ allocations and less than 100 frees. This happens intermittently. Much of the time the non-paged pool is around 200MB and seems to be properly managed. Once the pool balloons in size only a reboot clears it.

The usual find-string searches cannot identify a responsible driver. And in any case this tag also shows up on Windows 10 systems, so it's not a 3rd party driver problem because there are none. It seems to be part of the kernel, but is not listed in the available pooltag.txt files that I can find.

Does anyone know what process (or whatever) utilizes pooltag HalB?

Continue reading...
 

Similar threads

Back
Top Bottom