---
name: reference_syncro_agent_handle_leak
description: RDS "no available computers in the pool" (0x3/0x408) can really be a SyncroLive.Agent.Runner handle leak starving the box. How to spot + fix.
metadata:
  type: reference
---

**Symptom chain that hid the real cause (IMC1 / Instrumental Music Center, 2026-06-25):**
RemoteApp/RDP launch fails → *"There are no available computers in the pool"* (RDP **error 0x3 / extended 0x408**).
The RD Connection Broker **Admin** log (`Microsoft-Windows-TerminalServices-SessionBroker/Admin`,
**Event 802**) shows the truth: *"RD Connection Broker failed to process the connection request …
Error: **Insufficient system resources** exist to complete the requested service."* The
SessionBroker-Client log shows 1296 "Element not found" / 1306 redirect-failed. The collection +
session host are healthy (`NewConnectionAllowed: Yes`), so the broker isn't the bug — the **box is
out of a kernel resource**.

**Root cause:** the **Syncro RMM agent `SyncroLive.Agent.Runner` was leaking HANDLES** — 1,135,414
handles in one process (~80% of the box's 1.41M total). Handle/object exhaustion → broker can't
create the session.

**Diagnose:** `Get-Process | Sort-Object Handles -Descending | Select -First 6 Name,Handles,Id` and
`(Get-Process | Measure-Object Handles -Sum).Sum`. Memory looks fine (it's handles, not RAM/commit).
Services on the box: `Syncro`, `SyncroLive`, `SyncroOvermind` (SyncroRecovery).

**Fix (no reboot needed):** `Stop-Process -Name 'SyncroLive.Agent.Runner' -Force` — the Syncro
watchdog respawns it clean (dropped 1.41M → 280K handles, runner came back at ~900). Have the user
retry the RemoteApp immediately.

**It recurs** (leak accumulates over uptime) → schedule a periodic SyncroLive restart and/or update the
agent; **likely fleet-wide** — sweep other client servers for high-handle `SyncroLive.Agent.Runner`
(deferred 2026-06-25). IMC1 also had a separate pending reboot (wedged KB5075999) + expired RDS certs.
See [[reference_resource_map]].