2.0 KiB
name, description, metadata
| name | description | metadata | ||
|---|---|---|---|---|
| reference_syncro_agent_handle_leak | RDS "no available computers in the pool" (0x3/0x408) can really be a SyncroLive.Agent.Runner handle leak starving the box. How to spot + fix. |
|
Symptom chain that hid the real cause (IMC1 / Instrumental Music Center, 2026-06-25):
RemoteApp/RDP launch fails → "There are no available computers in the pool" (RDP error 0x3 / extended 0x408).
The RD Connection Broker Admin log (Microsoft-Windows-TerminalServices-SessionBroker/Admin,
Event 802) shows the truth: "RD Connection Broker failed to process the connection request …
Error: Insufficient system resources exist to complete the requested service." The
SessionBroker-Client log shows 1296 "Element not found" / 1306 redirect-failed. The collection +
session host are healthy (NewConnectionAllowed: Yes), so the broker isn't the bug — the box is
out of a kernel resource.
Root cause: the Syncro RMM agent SyncroLive.Agent.Runner was leaking HANDLES — 1,135,414
handles in one process (~80% of the box's 1.41M total). Handle/object exhaustion → broker can't
create the session.
Diagnose: Get-Process | Sort-Object Handles -Descending | Select -First 6 Name,Handles,Id and
(Get-Process | Measure-Object Handles -Sum).Sum. Memory looks fine (it's handles, not RAM/commit).
Services on the box: Syncro, SyncroLive, SyncroOvermind (SyncroRecovery).
Fix (no reboot needed): Stop-Process -Name 'SyncroLive.Agent.Runner' -Force — the Syncro
watchdog respawns it clean (dropped 1.41M → 280K handles, runner came back at ~900). Have the user
retry the RemoteApp immediately.
It recurs (leak accumulates over uptime) → schedule a periodic SyncroLive restart and/or update the
agent; likely fleet-wide — sweep other client servers for high-handle SyncroLive.Agent.Runner
(deferred 2026-06-25). IMC1 also had a separate pending reboot (wedged KB5075999) + expired RDS certs.
See reference_resource_map.