Windows Event ID 2019 – Srv: Server Service Connection Limit Exceeded

Start by examining current server connections to understand usage patterns and identify potential connection leaks.

1. Open Event Viewer and navigate to Windows Logs → System to view the Event ID 2019 details.

2. Use PowerShell to check current server sessions:

Get-SmbSession | Select-Object ClientComputerName, ClientUserName, SessionId, NumOpens
Get-SmbOpenFile | Group-Object ClientComputerName | Sort-Object Count -Descending

3. Review active connections using the built-in net command:

net session
net use

4. Check for connection patterns in the event details, noting timestamps and frequency of occurrence.

5. Monitor connection usage over time using Performance Monitor with the Server\Sessions Errored Out and Server\Sessions Timed Out counters.

Examine current connection limits and adjust them based on system capacity and licensing.

1. Check current connection limits in the registry:

Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxWorkItems"
Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxMpxCt"

2. For Windows Server editions, verify licensing allows for increased connections:

Get-WindowsFeature | Where-Object {$_.Name -like "*licensing*"}
Get-WmiObject -Class Win32_ServerFeature

3. Increase MaxWorkItems if system resources allow (default is typically 1024):

Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxWorkItems" -Value 2048 -Type DWord

4. Adjust MaxMpxCt for multiplexed connections (default 125):

Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxMpxCt" -Value 250 -Type DWord

5. Restart the Server service to apply changes:

Restart-Service -Name "lanmanserver" -Force

Deploy automated monitoring and cleanup procedures to prevent connection exhaustion.

1. Create a PowerShell script to monitor and log connection usage:

$LogPath = "C:\Logs\ConnectionMonitor.log"
$Connections = Get-SmbSession
$Count = $Connections.Count
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
Add-Content -Path $LogPath -Value "$Timestamp - Active Connections: $Count"

2. Set up a scheduled task to run connection monitoring every 15 minutes:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\ConnectionMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
Register-ScheduledTask -TaskName "ConnectionMonitor" -Action $Action -Trigger $Trigger

3. Implement automatic cleanup of stale connections:

Get-SmbSession | Where-Object {$_.SecondsIdle -gt 3600} | Close-SmbSession -Force

4. Configure session timeout values in the registry:

Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "autodisconnect" -Value 30 -Type DWord

5. Enable detailed logging for the Server service to track connection patterns:

wevtutil sl Microsoft-Windows-SMBServer/Audit /e:true
wevtutil sl Microsoft-Windows-SMBServer/Connectivity /e:true

Address underlying performance issues that may contribute to connection exhaustion.

1. Analyze system resource usage during peak connection periods:

Get-Counter "\Memory\Available MBytes", "\Processor(_Total)\% Processor Time", "\Server\Pool Paged Bytes", "\Server\Pool Nonpaged Bytes"

2. Check for memory pressure affecting the Server service:

Get-WmiObject -Class Win32_PerfRawData_PerfOS_Memory | Select-Object PoolPagedBytes, PoolNonpagedBytes, AvailableBytes

3. Optimize server work item allocation based on system memory:

$TotalRAM = (Get-WmiObject -Class Win32_ComputerSystem).TotalPhysicalMemory / 1GB
$OptimalWorkItems = [Math]::Min(8192, [Math]::Max(1024, $TotalRAM * 256))
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxWorkItems" -Value $OptimalWorkItems -Type DWord

4. Configure additional server optimization parameters:

Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxThreadsPerQueue" -Value 20 -Type DWord
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" -Name "MaxFreeConnections" -Value 100 -Type DWord

5. Enable large system cache if the server is dedicated to file services:

Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "LargeSystemCache" -Value 1 -Type DWord

Perform deep analysis of network patterns and potential security issues causing connection exhaustion.

1. Enable advanced SMB logging to capture detailed connection information:

Set-SmbServerConfiguration -AuditSmb1Access $true
Set-SmbServerConfiguration -EnableSMB1Protocol $false
wevtutil sl Microsoft-Windows-SMBServer/Security /e:true /ms:104857600

2. Use network packet capture to analyze connection patterns:

netsh trace start capture=yes provider=Microsoft-Windows-SMBServer level=4 keywords=0xFFFFFFFF tracefile=C:\Temp\smb_trace.etl maxsize=500

3. Analyze Event Tracing for Windows (ETW) logs for detailed server activity:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-SMBServer/Connectivity'; StartTime=(Get-Date).AddHours(-1)} | Select-Object TimeCreated, Id, LevelDisplayName, Message

4. Check for potential security issues or unauthorized access attempts:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625,4648,4771} -MaxEvents 100 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2)}

5. Implement connection rate limiting using Windows Firewall with Advanced Security:

New-NetFirewallRule -DisplayName "SMB Connection Rate Limit" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -DynamicTarget Any -EdgeTraversalPolicy Block

6. Create custom performance counters to track connection exhaustion events:

$CounterPath = "\\$env:COMPUTERNAME\Server\Sessions Errored Out"
$Counter = Get-Counter -Counter $CounterPath -SampleInterval 5 -MaxSamples 12
$Counter.CounterSamples | Export-Csv -Path "C:\Logs\ServerConnections.csv" -NoTypeInformation