System resource manager (WSRM) service memory leak

Hello,

The issue you’re seeing with wsrm.exe leaking nonpaged pool memory is a known limitation of Windows System Resource Manager (WSRM). Microsoft has deprecated WSRM since Windows Server 2012 R2, and it is no longer supported in newer builds. The STOP 0x0000009F bugcheck is directly tied to the driver-level resource exhaustion caused by the leak, so the only sustainable fix is to retire WSRM entirely and move to native Windows resource controls.

For terminal servers, the recommended transition path is to use Group Policy–based CPU quotas and process scheduling. You can configure this under Computer Configuration > Administrative Templates > System > Group Policy > Specify process CPU rate limit. This setting allows you to define CPU quotas per user or per process without relying on WSRM. The policy writes into the registry under HKLM\Software\Policies\Microsoft\Windows\System\CpuRateLimit and is enforced by the kernel scheduler, which avoids the nonpaged pool leak issue.

If you are also using WSRM for memory or I/O controls, those functions are not available in Group Policy. Microsoft’s guidance is to use Job Objects and Windows System Resource Control APIs for custom workloads, or migrate to Hyper-V with VM-level resource controls if isolation is required. For Remote Desktop Session Hosts specifically, CPU quotas via Group Policy are the supported replacement.

The immediate remediation is to disable the WSRM service (sc config wsrm start= disabled and sc stop wsrm) and remove any lingering policies. Then configure CPU quotas through Group Policy and validate enforcement with gpresult /h report.html and Resource Monitor. This will eliminate the nonpaged pool leak and stabilize your terminal servers.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.