Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3151
  • Last Modified:

SBS 2008 Performance Issues - Slow Directory browsing - High CPU utilization

Hi all you Experts out there!

I have a problem that has been kicking my butt lately.  I have a SBS 2008 Server that is running terribly slow. High CPU utilization with serveral processes peg out the CPU @ 100% often.  

For example, if I open COMPUTER and browse to the C: drive, it takes anywhere from 5 to 25 seconds to populate the folder/file list in the right hand pane.  If I branch out the folders in the left hand side where the folder tree is, this is instant.  When this delay happens, the CPU will spike on the Explorer Process.  I used Process Explorer and found that the threads  SHLWAPI.DLL and BROWSEUI.DLL seem to be the culprits.  However, I am not sure why.

Explorer is not the ony thing running slowly, but other things like GPMC is slow and often will hang when expanding areas like Security Options.  Often times The Start Menu becomes very slow.  Launching the Exchange Management console take alot longer than normal as well.

If I kill the BrowseUI.dll thread, it seems to let my processor get down to 5 to 15% until i do ANYTHING.  

I tested multiple user accounts on the server, so it does not appear to be profile specific.

Server is running GFI Mail Essentials and Kaspersky Antivirus. I have disabled both of these and it has not helped. I have also systematically disabled services and while the system would improve slightly, browsing the C: drive of the server is still very slow and caused the CPU to spike.  At one point I had all IIS, EXchange, GFI, Antivirus, and any other "non-essential service" that I could think of stopped and still have the problem.

Server is an HP ML 350 G5.
It has a single Dual Core processor @ 2.0 GHZ
12 GB of RAM
5 146GB 1500 RPM SAS drives in a RAID 5 configuration.  1 logical drive and 1 large C: drive volume.

I have run Check Disk and the disk Defragmenter, no improvement.

  • 5
  • 4
1 Solution
Have a look here:

About the 4th message down there is a fix that may work for you.
Here is a copy/paste of the info you need:

you have to

1) right click the Start button (the little window logo on the right bottom)

2) Click 'Properties'

3) 'Start Menu' - 'Customize'

4) scroll down and click 'Don't search for files' under 'Search Files' option
DarthGrafAuthor Commented:
Thanks for the reply!

To give you a feel for the problem as I was performing your suggestions, When I clicked the Customize button, it took nearly 30 seconds to load.  During this time, I was watching the Threads in the Explorer.exe process and the SHLWAPI.dll!Ordinal240+0x5c went to 50 % of the CPU and the Cycles Delta would jump to over 2 billiion (with a B).  When this was over, it dropped back down to approx. 1.5 mill cylces Delta.

I made the change you suggested.  I am still having the problem. I browsed to a folder on the C: drive. it took 22 seconds to load. I watched the same thread as above and it had the same behavior.

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Here are three odd solutions that have been helpful to me in past:

1. Go to http://www.online-tech-tips.com/computer-tips/windows-right-click-context-menu/ and remove anything unnecessary from the right click menu. Believe it or not, it does affect the performance of explorer

2. Check that you don't have any old offline printers installed

3. Download and install wireshark. Chances are that when you do things with explorer (including right clicking, etc) it is looking for a network address that no longer exists. Run wireshark, and replicate your problem, and see if any unusual entries appear. - Yes, this has been a solution for me in past, odd though it is.
DarthGrafAuthor Commented:
Thanks again for your suggestions.

Unfortunately, the problem still exists.  I only have 1 network printer on the server and it is functioning properly. Even so, I disabled the spooler service temporarily, that did not help.

My Context menu is all standard, with the exception of my antivirus application has a scan this folder feature.  I have disabled the Antivirus as well, no effect.

I am by no means a wireshark expert.  However, Nothing seemed out of the ordinary for a SBS 2008 server that I could see.  Take this statement for what its worth, but the processor is clearly pegged during these delays, and its not like there is no activity waiting for a network resource to respond. Just an observation.

Please keep the idea's coming, I will be happy to try almost anything at this point.
Try stopping all non-necessary services, and see if it's still a problem. In particular, stop DNS client and server.
run an ipconfig /flushdns
check that the hosts file is empty
disconnect all network drives, and remove any attached storage

See if it responds well now.
DarthGrafAuthor Commented:
Sorry, its taken me a while to test this. Crazy with the Holidays.  

Now, I didn't get a chance to stop ALL "non-necessary" services, but I did have everything off but the stuff to keep the AD, IIS, Exchange and the SQL services running.  I did disable DNS as you suggested with no luck.  I also performed the FLUSHDNS and that did not seem to make an impact. I worked with HP to make sure there is not a Hardware issue, and we've done every update we can think of and ran every test and the server comes back as fully healthy.  

I also made sure there were no mapped drives and removed everything but the internal SCSI LTO tape drive.

Also, from a client workstation, I can browse a share on that server with no issue, and its pretty fast.

Remote web workplace takes a while to load (20 - 30 ish seconds).  But anything I do from the console is just terribly slow, with or without Antivirus loaded.

Any other ideas?
DarthGrafAuthor Commented:
I have a second server that is used as a web server.  I just realized that the slow explorer issue is happening on that box as well. It is a 1U dell server, dual 2.4 Xeon's.  Running w2k3 32bit.  So its not a x64 thing, its doesn't appear to be a hardware thing, nor does it appear to be a windows 2008 issue.  I'm having a hard time finding the connection, but they both have the same exact symptoms.  

Any ideas anyone?
DarthGrafAuthor Commented:
Well, even though I was able to exit and turn of Kaspersky, I found out that simply having the antivirus on the system was causing my issue. When I disabled Kapsersky's default Windows server policy, the problem went away.  I am not sure, however, if it was something with the policy, because the same week I did this, Kaspersky released updates that fixed performance issues in desktops, and its possible a similar fix helped the performance on this server.

Anyways, problem solved, and it was definitely related to the anti-virus.
Not to pile on, but I was tracking the exact same issue with my SBS08 box.  Kaspersky did not appear to be using much of the systems resources as far as process explorer reported, however, until the product was completely uninstalled the server was non-responsive.  Attempting to launch anything ie. MyComputer etc was a 40-60 second delay.  Impossible to work with.   Contacting Kaspersky shortly to investigate their claims that the are indeed ready for SBS08.

This is a frustrating troubleshooting process given nothing conventional indicates its Kaspersky killing your server performance.  Removing the product was a last resort given I appeased every BPA issue and update every driver and BIOS of the server.  KAV is the only 3rd party software on this box.


Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now