What restrictions does WinRM/WinRS place on the processes that it runs?

Question

I'm using winrs to run a test client against some server software that I'm developing. I'm using the client to generate load on the server under test for profiling. Both the machine that I'm running the server software and winrs on and the machine that I'm running the test client on (using winrs on the first machine to run it) are Win7 boxes, x64, lots of memory. All processes are run as admin.

When I run the test client by hand it can generate 6000 concurrent connections and saturate a 100mb link (the machines in question have Gb networking so I'm only loading the link between them to around 10%) When I run it via winrs around half of the connections fail with what seems to be memory related errors in OpenSSL.

I'm sure there's something odd going on in my test client, BUT it would be useful to know what, if any, restrictions might be in place on processes that winrm runs on behalf of a request from winrs. I haven't been able to find any docs which suggest that there are restrictions, but I may not be looking hard enough.

Update: Having thought about this some more it seems that it's likely that the processes are being run under a job object with a memory limit in place, this kinda makes sense, but I would assume that if this were the case that it would be something that could be configured on the server side...

score 5 · Accepted Answer · answered Apr 23 '11 at 00:12

5

Yes, it is configurable. From the command line this would set the limit to 500MB

winrm set winrm/config/winrs @{MaxMemoryPerShellMB="500"}

search msdn docs on "winrm configuration" for more info.

answered Apr 23 '11 at 00:12

Elroy Flynn

520
1
6
8

Excellent.. will try this today – CraftyFella Jan 18 '13 at 11:16
Totally worked.. .legend +1 – CraftyFella Jan 18 '13 at 11:20
On PowerShell v3 or higher you'll also need to change the PowerShell plugin's memory limit. Use this command: Set-Item WSMan:\localhost\Plugin\Microsoft.PowerShell\Quotas\MaxMemoryPerShellMB 500 – EvilPettingZu42 Jul 22 '13 at 23:10

score 2 · Answer 2 · answered Nov 19 '10 at 16:00

Well, it seems that I'm right. Commands executed by Winrs are run inside of a job object and the job object is restricted.

Here's what a simple program to dump these job restrictions says about a process being executed on one of my Windows 7 boxes.

Job report for process: 10676
Process IS in a job
Flags: 0x2b08 - 
   JOB_OBJECT_LIMIT_ACTIVE_PROCESS
   JOB_OBJECT_LIMIT_PROCESS_MEMORY
   JOB_OBJECT_LIMIT_JOB_MEMORY
   JOB_OBJECT_LIMIT_BREAKAWAY_OK
   JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE

ActiveProcessLimit: 15
Affinity: 0x0
MaximumWorkingSetSize: 0
MinimumWorkingSetSize: 0
PerJobUserTimeLimit: 0
PerProcessUserTimeLimit: 0
PriorityClass: 32
SchedulingClass: 5
JobMemoryLimit: 157286400
ProcessMemoryLimit: 157286400

The limits that were causing me problems are the bottom two. The memory limits. I still don't know if these are configurable per machine or per user or at all...

The good news is that the job has JOB_OBJECT_LIMIT_BREAKAWAY_OK set which means that I can simply write a program launcher that I run via Winrs which itself runs the actual target command and launches the new process with the CREATE_BREAKAWAY_FROM_JOB flag. This causes my real target process to run outside of the WinRs job restrictions.

For what it's worth, I've just been working on this with a Windows 2008 server and Powershell 2, and the Job created for me has Flags set to 0x2308 - no `JOB_OBJECT_LIMIT_BREAKAWAY_OK`. If I try to call `CreateProcess` with `CREATE_BREAKAWAY_FROM_JOB` then I get Access Denied (error 5). — Simon Steele, Jan 14 '11 at 18:02
That's unfortunate. Now back to the question of 'are the limits configurable'? — Len Holgate, Jan 14 '11 at 18:55

What restrictions does WinRM/WinRS place on the processes that it runs?

2 Answers2