| Event Id | 2011 |
| Source | Srv |
| Description | The servers configuration parameter "irpstacksize" is too small for the server to use a local device. Please increase the value of this parameter. |
| Event Information | Explanation : The server is configured with too many file system filter drivers (for example, Quota and anti-virus) and/or too many devices, or the irpstacksize parameter is set to less than the default of 15 stack frames. The irpstacksize represents the number of kernel modules that can store information in the input/output (I/O) Request Packet (IRP). The IRP is used to track I/O requests in the kernel. User Action : The irpstacksize parameter can be increased by changing the registry value. To change the registry value Using Regedit, open the following registry key: HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters\IrpStackSize In the Value data box, type 15. The default size is 15 stack frames. Each stack frame is 50 bytes. If the value is less than 15, advanced users can safely set it back to 15. If 15 is too small, try increasing the number by increments of 5 until this event is no longer logged. Changing this registry key requires a restart of the Server service. |
| Reference Links | Antivirus software may cause Event ID 2011 Event ID 2011 IRPStackSize too small |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.