Troubleshooting
Problem
Windows Server crashed and rebooted without any apparent reason.
Symptom
The Windows Server began running slowly and then unexpectedly crashed and rebooted.
Cause
Memory exhaustion / memory outage.
Root Cause Summary
The crash was caused by a memory shortage, which prevented the operating system from allocating required pages. This may occur due to:
- Insufficient physical RAM
- Excessive nonpaged pool or paged pool consumption
- A driver leaking memory
- Memory pressure caused by high workloads
- Paging file too small
- Improper system tuning
Environment
Microsoft Windows Server (all supported versions)
Diagnosing The Problem
When troubleshooting a server crash, the following data is most critical:
Required Logs
- Windows Event Logs
- System
- Application
- Security
- Crash dump file (memory.dmp)
Tools to Collect Logs
Use the TSS Toolset to collect all logs in a consistent format:
Search for (Introduction to TroubleShootingScript toolset (TSS))
Tools to Analyze the Dump File
Use the Windows Debugger (WinDbg):
Search for (Install the Windows debugger)
After launching WinDbg and opening the crash dump, run the following command to get an overview of the crash:
!analyze -v
This command provides detailed information about the faulting component and potential root cause.
Troubleshooting Findings
Bugcheck: NO PAGES AVAILABLE (0x4D)
This indicates no memory was available, often caused by RAM exhaustion or an over‑consumed paging file.
STATUS_NO_MEMORY (0xC0000017)
Decoded meaning:
STATUS_NO_MEMORY
{Not Enough Quota}
Not enough virtual memory or paging file quota is available to complete the operation.
# for hex 0xc0000017 /
decimal -1073741801
ISCSI_ERR_ISCSI_PDU_ERROR
iscsilog.h
# Target sent an invalid iSCSI PDU. Dump data contains the
# entire iSCSI header.
STATUS_NO_MEMORY
ntstatus.h
# {Not Enough Quota}
# Not enough virtual memory or
paging file quota is available
# to complete the specified
operation.
# as an HRESULT: Severity: FAILURE (1), FACILITY_NULL (0x0),
Code 0x17
# for hex 0x17 / decimal 23
ERROR_CRC
winerror.h
# Data error (cyclic redundancy check).
# 3 matches found for "c0000017"
Additional notes:
- The error may also be referenced alongside ERROR_CRC (0x17) in some logs, but 0xC0000017 is the relevant memory-related NTSTATUS code.
- WinDbg may also show iSCSI PDU errors if components fail due to low memory conditions — these are often secondary symptoms, not root causes.
Resolving The Problem
Recommended Actions
- Add additional physical memory (RAM)
If the workload has increased or the server is undersized, this is the most direct fix. - Identify the component consuming the most memory
- Use WinDbg with commands like:
- !vm
- !poolused 2
- Or in the live OS, use:
- Task Manager
- Resource Monitor
- Performance Monitor
- Poolmon (for driver-related pool leaks)
- Check and adjust paging file configuration
- Ensure the paging file is system-managed or sized appropriately.
- Check for driver updates
- Outdated drivers may leak nonpaged pool memory.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
11 February 2026
UID
ibm17179918