Quick answer: Restart the server to free nonpaged pool memory. Then run PoolMon (poolmon.exe) to find which driver or tag is leaking. Update or replace that driver.
Why you're seeing this error
Windows uses two types of memory: paged pool (can go to disk) and nonpaged pool (stays in RAM). Nonpaged pool is for kernel stuff — drivers, file system operations, networking. When something hogs it, you get error 0X000005AB.
I've seen this most often on Windows Server 2019 and 2022 running Hyper-V or backup software. The trigger? A storage driver or antivirus filter driver forgets to release memory. One client had it crash every two weeks until we killed a faulty Broadcom NIC driver.
Fix steps
- Restart the server – This clears the pool and gets you back online. Temporary but buys you time.
- Check Event Viewer – Look in System log for Event ID 2019. That confirms a nonpaged pool leak and often points to a culprit tag.
- Install PoolMon – It's part of Windows Debugging Tools. On Windows Server 2022, grab the ADK installer and select only Debugging Tools. Run
poolmon.exe -p -bfrom an admin command prompt. Watch the Diff column grow. The tag with biggest increase is your leak. - Match the tag to a driver – Google the tag name or use
findstron .sys files in C:\Windows\System32\drivers. For example, tagMmStoften means a storage minifilter. - Update or remove the driver – If it's a third-party driver (like from a backup app or VPN), update it. If it's built-in, check for Windows updates. You can also disable the driver temporarily via
sc configor Device Manager to test. - Increase nonpaged pool limit (last resort) – Not recommended because it hides the leak. But if you're stuck, add a registry key:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\NonPagedPoolSizewith a DWORD value in megabytes. Reboot.
Alternative fix: Pool usage via Performance Monitor
If PoolMon is too geeky, open Performance Monitor (perfmon.msc). Add counter Memory \ Pool Nonpaged Bytes. Let it run for a few hours. If it climbs steadily over 200 MB, you've got a leak. You won't see exact tag, but it confirms the problem.
Prevention tip
Keep your driver and firmware updates current. I always set Windows Update to auto-install driver updates on servers (yes, I know it's controversial). Also, avoid running heavy third-party filter drivers on Hyper-V hosts — they're the top cause of leaks. If you use backup software like Veeam or Symantec, make sure it's the latest version. Older versions are notorious for pool leaks.
One more thing: if the server has less than 8 GB RAM, you're asking for this error. Nonpaged pool is capped by Windows at about 256 MB on 32-bit and up to 75% of RAM on 64-bit. Low-RAM servers run out fast. Add more RAM if you can.
Hope this saves you a headache. I've been there — waking up at 3 AM to a hung server is no fun. Stick to these steps and you'll have it sorted.