Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2017 Source: Srv

The server was unable to allocate from the system nonpaged pool because the server reached the configured limit for nonpaged pool allocations.
In my case, this error occurs on a shared Windows 7 pc. XP workstations after a period of time are disconnected to Windows 7 shares. Errors on the Windows 7 system logs occur at the same time as the problem.

I solved this by changing registry settings:

Changed: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\LargeSystemCache - Set it to 1  (was 0)

Changed: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size - Set it to 3  (was 1)

See Also ME232271.
From a support forum: "After changing the NIC and going through a bunch of registry settings, I finally found the solution. It appears that Vista uses SMB2 for networking and its obviously buggy in certain circumstances. Disabling it and forcing SMB1 (pre vista networking) fixes the problem and finally all my machines are able to connect to the Vista shares even after days of use. The Bug in SMB2 reports the event id 2017 into your event logs, complaining that there is not enough nonpaged pool memory left, however this is not the case as taskmanager shows there is easily enough and also that no process's on the host machine are leaking any nonpaged pool memory at any point.

Open regedit goto HKEY_LOCAL_MACHINE ->SYSTEM ->CurrentControlSet ->Services ->LanmanServer -> Parameters. Then click createkey and create a DWORD with the name SMB2. The value should automatically be set as 0, which is correct to turn it off. Restart computer and fixed.

To remove the fix and re-enabled SMB2 simply remove the DWORD from the place above in the registry.

The above fix worked for me on a simple network system - one I wasn't concerned about moving back to SMB1"
My experience with this one is it is due to MaxNonPagedMemoryUsage being set too low on a Windows XP Workstation. This is a registry value under “HKLM\System\CurrentControlSet\Services\LanManServer\Parameters”. It may not be there (I had to add it), and by default appears to be set at 1MB (0x1000000). Increase the value slowly and the problem should go away.
See the link to "EventID 2017 from source NCP Server" for details on this event.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.