Results 1 to 4 of 4
  1. #1
    New Lounger
    Join Date
    Apr 2013
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Exclamation What changed my pagefile settings?

    Hi everyone. First post, hoping someone can assist..

    Scenario:

    - I'm responsible for 20,000 Windows desktops (mixture of Windows 7 and Windows XP)
    - None of them are configured to let the system manage the pagefile size
    - They are all a fixed size of 3GB or larger depending on the config of the system
    - Recently, some systems have had their pagefile sizes changed to 500MB
    - We have no idea what has done this and are trying to track it down
    - Our environment is actually a few hundred thousand desktops, though I'm only responsible for 20,000 of them
    - Being a large enterprise, we have lots of things in the mix that we are investigating (GPO's, various software distribution tools, etc)


    Does anyone know of a way to track down who/what/when a pagefile setting was changed? It appears this isnt something thats captured in the Eventlog unless I've overlooked something. This is a bit of a head-scratcher...



    Thanks.

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    20,613
    Thanks
    2
    Thanked 625 Times in 558 Posts
    Welcome to the Lounge!!

    Is it repeating? If so, can you predict which machines will be affected? Do you have any restore points that might pinpoint a time?

    Do you allow any third party tools to be run? Can a user login as a local admin?

    Joe

  3. #3
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    20,613
    Thanks
    2
    Thanked 625 Times in 558 Posts
    If you can predict a machine you could run Process Monitor to see what is happening.

    Joe

  4. #4
    Bronze Lounger DrWho's Avatar
    Join Date
    Dec 2009
    Location
    Central Florida
    Posts
    1,232
    Thanks
    16
    Thanked 165 Times in 128 Posts
    Unless someone is going around making changes, which sounds very unlikely, then the only thing that should be able to make such a change would be a Registry Script, being run on those machines.
    Could such a script have been broadcast from a central server.??

    How many PC's are you talking about? Are they in the same location, or scattered across the network?
    Is there anyone who has access to those PC's.???

    I guess right now, it's all just questions and very few answers. Eh?

    So many questions,

    The Doctor
    Experience is truly the best teacher.

    Backup! Backup! Backup! GHOST Rocks!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •