SBS 2008 Performance Issues - Slow Directory browsing - High CPU utilization

Posted on 2009-12-21
Last Modified: 2012-06-22
Hi all you Experts out there!

I have a problem that has been kicking my butt lately.  I have a SBS 2008 Server that is running terribly slow. High CPU utilization with serveral processes peg out the CPU @ 100% often.  

For example, if I open COMPUTER and browse to the C: drive, it takes anywhere from 5 to 25 seconds to populate the folder/file list in the right hand pane.  If I branch out the folders in the left hand side where the folder tree is, this is instant.  When this delay happens, the CPU will spike on the Explorer Process.  I used Process Explorer and found that the threads  SHLWAPI.DLL and BROWSEUI.DLL seem to be the culprits.  However, I am not sure why.

Explorer is not the ony thing running slowly, but other things like GPMC is slow and often will hang when expanding areas like Security Options.  Often times The Start Menu becomes very slow.  Launching the Exchange Management console take alot longer than normal as well.

If I kill the BrowseUI.dll thread, it seems to let my processor get down to 5 to 15% until i do ANYTHING.  

I tested multiple user accounts on the server, so it does not appear to be profile specific.

Server is running GFI Mail Essentials and Kaspersky Antivirus. I have disabled both of these and it has not helped. I have also systematically disabled services and while the system would improve slightly, browsing the C: drive of the server is still very slow and caused the CPU to spike.  At one point I had all IIS, EXchange, GFI, Antivirus, and any other "non-essential service" that I could think of stopped and still have the problem.

Server is an HP ML 350 G5.
It has a single Dual Core processor @ 2.0 GHZ
12 GB of RAM
5 146GB 1500 RPM SAS drives in a RAID 5 configuration.  1 logical drive and 1 large C: drive volume.

I have run Check Disk and the disk Defragmenter, no improvement.

Question by:DarthGraf
    LVL 2

    Expert Comment

    Have a look here:

    About the 4th message down there is a fix that may work for you.
    LVL 2

    Expert Comment

    Here is a copy/paste of the info you need:

    you have to

    1) right click the Start button (the little window logo on the right bottom)

    2) Click 'Properties'

    3) 'Start Menu' - 'Customize'

    4) scroll down and click 'Don't search for files' under 'Search Files' option

    Author Comment

    Thanks for the reply!

    To give you a feel for the problem as I was performing your suggestions, When I clicked the Customize button, it took nearly 30 seconds to load.  During this time, I was watching the Threads in the Explorer.exe process and the SHLWAPI.dll!Ordinal240+0x5c went to 50 % of the CPU and the Cycles Delta would jump to over 2 billiion (with a B).  When this was over, it dropped back down to approx. 1.5 mill cylces Delta.

    I made the change you suggested.  I am still having the problem. I browsed to a folder on the C: drive. it took 22 seconds to load. I watched the same thread as above and it had the same behavior.
    LVL 2

    Expert Comment

    Here are three odd solutions that have been helpful to me in past:

    1. Go to and remove anything unnecessary from the right click menu. Believe it or not, it does affect the performance of explorer

    2. Check that you don't have any old offline printers installed

    3. Download and install wireshark. Chances are that when you do things with explorer (including right clicking, etc) it is looking for a network address that no longer exists. Run wireshark, and replicate your problem, and see if any unusual entries appear. - Yes, this has been a solution for me in past, odd though it is.

    Author Comment

    Thanks again for your suggestions.

    Unfortunately, the problem still exists.  I only have 1 network printer on the server and it is functioning properly. Even so, I disabled the spooler service temporarily, that did not help.

    My Context menu is all standard, with the exception of my antivirus application has a scan this folder feature.  I have disabled the Antivirus as well, no effect.

    I am by no means a wireshark expert.  However, Nothing seemed out of the ordinary for a SBS 2008 server that I could see.  Take this statement for what its worth, but the processor is clearly pegged during these delays, and its not like there is no activity waiting for a network resource to respond. Just an observation.

    Please keep the idea's coming, I will be happy to try almost anything at this point.
    LVL 2

    Expert Comment

    Try stopping all non-necessary services, and see if it's still a problem. In particular, stop DNS client and server.
    run an ipconfig /flushdns
    check that the hosts file is empty
    disconnect all network drives, and remove any attached storage

    See if it responds well now.

    Author Comment

    Sorry, its taken me a while to test this. Crazy with the Holidays.  

    Now, I didn't get a chance to stop ALL "non-necessary" services, but I did have everything off but the stuff to keep the AD, IIS, Exchange and the SQL services running.  I did disable DNS as you suggested with no luck.  I also performed the FLUSHDNS and that did not seem to make an impact. I worked with HP to make sure there is not a Hardware issue, and we've done every update we can think of and ran every test and the server comes back as fully healthy.  

    I also made sure there were no mapped drives and removed everything but the internal SCSI LTO tape drive.

    Also, from a client workstation, I can browse a share on that server with no issue, and its pretty fast.

    Remote web workplace takes a while to load (20 - 30 ish seconds).  But anything I do from the console is just terribly slow, with or without Antivirus loaded.

    Any other ideas?

    Author Comment

    I have a second server that is used as a web server.  I just realized that the slow explorer issue is happening on that box as well. It is a 1U dell server, dual 2.4 Xeon's.  Running w2k3 32bit.  So its not a x64 thing, its doesn't appear to be a hardware thing, nor does it appear to be a windows 2008 issue.  I'm having a hard time finding the connection, but they both have the same exact symptoms.  

    Any ideas anyone?

    Accepted Solution

    Well, even though I was able to exit and turn of Kaspersky, I found out that simply having the antivirus on the system was causing my issue. When I disabled Kapsersky's default Windows server policy, the problem went away.  I am not sure, however, if it was something with the policy, because the same week I did this, Kaspersky released updates that fixed performance issues in desktops, and its possible a similar fix helped the performance on this server.

    Anyways, problem solved, and it was definitely related to the anti-virus.

    Expert Comment

    Not to pile on, but I was tracking the exact same issue with my SBS08 box.  Kaspersky did not appear to be using much of the systems resources as far as process explorer reported, however, until the product was completely uninstalled the server was non-responsive.  Attempting to launch anything ie. MyComputer etc was a 40-60 second delay.  Impossible to work with.   Contacting Kaspersky shortly to investigate their claims that the are indeed ready for SBS08.

    This is a frustrating troubleshooting process given nothing conventional indicates its Kaspersky killing your server performance.  Removing the product was a last resort given I appeased every BPA issue and update every driver and BIOS of the server.  KAV is the only 3rd party software on this box.


    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    I work for a company that primarily works with small businesses as their outsourced IT vendor. As such the majority of these customers utilize some version of Small Business Server. Due to the economics of running a small business, many of these cus…
    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now