azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from GURU-5070 at 2026-06-25 12:35:22

Browse Source 
Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-25 12:35:22
This commit is contained in:
Mike Swanson
2026-06-25 12:36:24 -07:00
parent 0f803c2d9c
commit e61b39b5c8
4 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
.claude/memory/reference_syncro_agent_handle_leak.md Normal file
View File

@@ -0,0 +1,32 @@
---
name: reference_syncro_agent_handle_leak
description: RDS "no available computers in the pool" (0x3/0x408) can really be a SyncroLive.Agent.Runner handle leak starving the box. How to spot + fix.
metadata:
type: reference
---
**Symptom chain that hid the real cause (IMC1 / Instrumental Music Center, 2026-06-25):**
RemoteApp/RDP launch fails → *"There are no available computers in the pool"* (RDP **error 0x3 / extended 0x408**).
The RD Connection Broker **Admin** log (`Microsoft-Windows-TerminalServices-SessionBroker/Admin`,
**Event 802**) shows the truth: *"RD Connection Broker failed to process the connection request …
Error: **Insufficient system resources** exist to complete the requested service."* The
SessionBroker-Client log shows 1296 "Element not found" / 1306 redirect-failed. The collection +
session host are healthy (`NewConnectionAllowed: Yes`), so the broker isn't the bug — the **box is
out of a kernel resource**.
**Root cause:** the **Syncro RMM agent `SyncroLive.Agent.Runner` was leaking HANDLES** — 1,135,414
handles in one process (~80% of the box's 1.41M total). Handle/object exhaustion → broker can't
create the session.
**Diagnose:** `Get-Process | Sort-Object Handles -Descending | Select -First 6 Name,Handles,Id` and
`(Get-Process | Measure-Object Handles -Sum).Sum`. Memory looks fine (it's handles, not RAM/commit).
Services on the box: `Syncro`, `SyncroLive`, `SyncroOvermind` (SyncroRecovery).
**Fix (no reboot needed):** `Stop-Process -Name 'SyncroLive.Agent.Runner' -Force` — the Syncro
watchdog respawns it clean (dropped 1.41M → 280K handles, runner came back at ~900). Have the user
retry the RemoteApp immediately.
**It recurs** (leak accumulates over uptime) → schedule a periodic SyncroLive restart and/or update the
agent; **likely fleet-wide** — sweep other client servers for high-handle `SyncroLive.Agent.Runner`
(deferred 2026-06-25). IMC1 also had a separate pending reboot (wedged KB5075999) + expired RDS certs.
See [[reference_resource_map]].