The OfficeScan agent icon in the system tray started to appear red instead of blue. When you hover on the icon, it indicates that the Real-time Scan has stopped.
Manually starting the OfficeScan NT Real-Time Scan service fails and the System Event log records the following error:
Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7000 Date: 10/05/2010 Time: 12:09:34 PM User: N/A Computer: MACHINE NAME Description: The OfficeScan NT Real-Time Scan service failed to start due to the following error: Insufficient system resources exist to complete the requested service.
Uninstalling and reinstalling OfficeScan does not resolve the issue.
This is caused by a memory issue. To resolve this, administrator needs to extend the "PagedPoolMemory" key by doing the following:
- Open the Registry Editor.
Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
- Change the registry key with the following values:
key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
- Close the Registry Editor.
- Reboot the machine.
For more information about PagedPoolSize, visit the Microsoft article about PagedPoolSize.
If the issue persists, collect the CDT logs using the following procedure: