poolmon

[lovrov]

Hi,

I have a server where I need to use poolmon. I found that in nonpaged area tag file is that one which cause problems.

I would like to identified which process (service, driver, ...) is responsible for tag file.

Is there any idea?

Regards,
Lovro

 

[Empmark]

I recently had an issue with a Symantec upgrade which caused NtFC to leak. If you use /g and have the pooltag.txt file intstalled it will show you the mapped driver. Here is a link to some info on how to use it and poolmon. Hopefully it links ok but if you google pooltag.txt it is the first microsoft result.

http://www.microsoft.com/technet/pr...Ref/00dede78-030c-4d5b-bebf-f5f35f17949e.mspx

I hope it works for you. For me, NtFC mapped to ntfs.sys but in the end I had to call Microsoft to get a definitive mapping to the symantec upgrade. Good luck to you!