[RESOLVED] Buffer error

[smandel]

Good morning,

Following the deployment of WAPT across our entire network, we have noticed that many workstations are experiencing an error when logging in:

Code: Select all

Le système a détecté la saturation de la mémoire tampon dans cette application.
Cette saturation pourrait permettre à un utilisateur mal intentionné de prendre le contrôle de cette application

In some cases it only appears once, in others it is impossible to open a session with a black screen.

Should we increase the virtual memory of workstations?
Today this parameter is managed by the system.

THANKS.

[dcardon]

Hello,

this is the first time I've seen this error in a wapt context. What RAM/pagefile.sys size do the machines in question have?

Denis

[smandel]

Hello,

virtual memory is managed by the system.
All PCs have a minimum of 4GB of RAM and are primarily used for office work.

Thank you.

[dcardon]

Do you have anything in the Event Viewer related to this? It would be helpful to know which executable generated this message.

Regards,

Denis

[smandel]

That's all I have in the events:

Code: Select all

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" /> 
  <EventID>26</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2022-07-18T06:41:07.6154840Z" /> 
  <EventRecordID>15566</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="1192" ThreadID="1208" /> 
  <Channel>System</Channel> 
  <Computer>XXXXXXXX</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Caption">dllhost.exe - Erreur système</Data> 
  <Data Name="Message">Le système a détecté la saturation de la mémoire tampon dans cette application. Cette saturation pourrait permettre à un utilisateur mal intentionné de prendre le contrôle de cette application.</Data> 
  </EventData>
  </Event>

[dcardon]

The WAPT agent isn't launching dllhost.exe, so it's not directly related to WAPT; it might be a side effect, but this is the first time we've heard of it. Could you try Windows troubleshooting tools like sfc /scannow or something similar?

Regards,

Denis

[smandel]

Hello,

I've already tried it on the affected machines without encountering any errors.
But the problem seems to occur only on Windows 11, and the message only appears once...
The message no longer appears on the machines that had the problem.
Something to keep an eye on.

Thanks anyway.

[dcardon]

Okay, thanks for the feedback, I'm marking the issue as resolved.

Denis