Solved

Slow file Access to Win2008 from Win2008

Posted on 2010-08-22
4
2,894 Views
Last Modified: 2012-05-10
Hi Guys
Have this odd issue with slow file access from a Windows 2008 server from a Windows 2008 server.
The source server is also a DC and has DFS installed.
I'm experience slow file browsing and access from a windows 2008 server. There are 4 almost identical servers that access this 2008 server 2x 2003 and 2x 2008. The 2003 servers are fine and never seem to have any issues, both of the 2008 servers have issues. It seems to be that once the 2008 servers have cached the dfs referral they will be fine until the cache has expired. The 2008 servers are both in the same subnet and there is no replica outside of the subnet currently.

The only information which shows what may be the problem was a network monitor trace which shows the following.
7027      8:54:36 a.m. 23/08/2010      44.4489435      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Nt Create Andx, FileName = \server\swcff1.ico      {SMB:863, SMBOverTCP:3, TCP:2, IPv4:1}
7028      8:54:36 a.m. 23/08/2010      44.4494444      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Nt Create Andx, FID = 0x0005 (\server\swcff1.ico@#7027)      {SMB:863, SMBOverTCP:3, TCP:2, IPv4:1}
7029      8:54:36 a.m. 23/08/2010      44.4498336      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Transact2, Query File Info, Query File Standard Info, FID = 0x0005 (\server\swcff1.ico@#7027)      {SMB:863, SMBOverTCP:3, TCP:2, IPv4:1}
7030      8:54:36 a.m. 23/08/2010      44.4501090      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Query File Info, Query File Standard Info, FID = 0x0005 (\server\swcff1.ico@#7027)      {SMB:863, SMBOverTCP:3, TCP:2, IPv4:1}
7031      8:54:36 a.m. 23/08/2010      44.4506007      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Close, FID = 0x0005 , FileName=\server\swcff1.ico@#7027       {SMB:863, SMBOverTCP:3, TCP:2, IPv4:1}
7032      8:54:36 a.m. 23/08/2010      44.4509175      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Close, FID = 0x0005 , FileName=\server\swcff1.ico@#7027       {SMB:863, SMBOverTCP:3, TCP:2, IPv4:1}
7033      8:54:36 a.m. 23/08/2010      44.4516156      System      192.168.4.20      192.168.4.44      DFSC      DFSC:Get DFS Referral Request, FileName: \server\Networkapps$, MaxReferralLevel: 4      {SMB:864, SMBOverTCP:3, TCP:2, IPv4:1}
7034      8:54:36 a.m. 23/08/2010      44.5125996      svchost.exe      172.16.1.159      192.168.4.20      RDP      RDP:Windows stub parser: Requires full Common parsers. See the "How Do I Change Parser Set Options(Version 3.3 or before) or Configure Parser Profile (Version 3.4)" help topic for tips on loading these parser sets.      {TCP:8, IPv4:7}
7035      8:54:36 a.m. 23/08/2010      44.5577786      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Get Dfs Referral - NT Status: System - Error, Code = (549) STATUS_NOT_FOUND      {SMB:864, SMBOverTCP:3, TCP:2, IPv4:1}
7036      8:54:36 a.m. 23/08/2010      44.5585591      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Transact2, Query Path Info, Query File Basic Info, Pattern = \server\swcff1.ico      {SMB:247, SMBOverTCP:3, TCP:2, IPv4:1}
7037      8:54:36 a.m. 23/08/2010      44.5590645      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Query Path Info, Query File Basic Info      {SMB:247, SMBOverTCP:3, TCP:2, IPv4:1}
7038      8:54:36 a.m. 23/08/2010      44.5593254      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Transact2, Query Path Info, Query File Standard Info, Pattern = \server\swcff1.ico      {SMB:865, SMBOverTCP:3, TCP:2, IPv4:1}
7039      8:54:36 a.m. 23/08/2010      44.5596685      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Query Path Info, Query File Standard Info      {SMB:865, SMBOverTCP:3, TCP:2, IPv4:1}
7040      8:54:36 a.m. 23/08/2010      44.5601769      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Transact2, Query Path Info, Query File Basic Info, Pattern = \server\swcff1.ico      {SMB:249, SMBOverTCP:3, TCP:2, IPv4:1}
7041      8:54:36 a.m. 23/08/2010      44.5605527      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Query Path Info, Query File Basic Info      {SMB:249, SMBOverTCP:3, TCP:2, IPv4:1}
7042      8:54:36 a.m. 23/08/2010      44.5612740      System      192.168.4.20      192.168.4.44      DFSC      DFSC:Get DFS Referral Request, FileName: \server\Networkapps$, MaxReferralLevel: 4      {SMB:866, SMBOverTCP:3, TCP:2, IPv4:1}
7043      8:54:36 a.m. 23/08/2010      44.6534561      svchost.exe      192.168.4.20      172.16.1.159      RDP      RDP:Windows stub parser: Requires full Common parsers. See the "How Do I Change Parser Set Options(Version 3.3 or before) or Configure Parser Profile (Version 3.4)" help topic for tips on loading these parser sets.      {TCP:8, IPv4:7}
7044      8:54:36 a.m. 23/08/2010      44.6699308      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Get Dfs Referral - NT Status: System - Error, Code = (549) STATUS_NOT_FOUND      {SMB:866, SMBOverTCP:3, TCP:2, IPv4:1}
7045      8:54:36 a.m. 23/08/2010      44.6705636      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Nt Create Andx, FileName = \server\swcff1.ico      {SMB:867, SMBOverTCP:3, TCP:2, IPv4:1}
7046      8:54:36 a.m. 23/08/2010      44.6711122      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Nt Create Andx, FID = 0x4003 (\server\swcff1.ico@#7045)      {SMB:867, SMBOverTCP:3, TCP:2, IPv4:1}
7047      8:54:36 a.m. 23/08/2010      44.6713944      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Transact2, Query File Info, Query File Basic Info, FID = 0x4003 (\server\swcff1.ico@#7045)      {SMB:867, SMBOverTCP:3, TCP:2, IPv4:1}
7048      8:54:36 a.m. 23/08/2010      44.6716584      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Query File Info, Query File Basic Info, FID = 0x4003 (\server\swcff1.ico@#7045)      {SMB:867, SMBOverTCP:3, TCP:2, IPv4:1}
7049      8:54:36 a.m. 23/08/2010      44.6718308      System      192.168.4.20      192.168.4.44      SMB      SMB:C; Transact2, Query File Info, Query File Standard Info, FID = 0x4003 (\server\swcff1.ico@#7045)      {SMB:867, SMBOverTCP:3, TCP:2, IPv4:1}
7050      8:54:36 a.m. 23/08/2010      44.6721280      System      192.168.4.44      192.168.4.20      SMB      SMB:R; Transact2, Query File Info, Query File Standard Info, FID = 0x4003 (\server\swcff1.ico@#7045)      {SMB:867, SMBOverTCP:3, TCP:2, IPv4:1}

When the servers are browsing correctly you don't see the get referral request or the status not found errors.

Things I've tried.
Disabling SMB2
Disabling server cert signing
Referencing the non dfs share
0
Comment
Question by:Revera_Experts
  • 2
  • 2
4 Comments
 
LVL 4

Expert Comment

by:evilsi
ID: 33501103
Hi,

This can be caused by SMB v2 and a stupid windows bug that still isnt fixed. Try this:
To disable SMB 2.0 on Windows Vista or Windows Server 2008 systems that are acting as the “server”, navigate to the registry key : HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters
Create a REG_DWORD value called Smb2.  Set the value to 0 to disable SMB 2.0 and 1 to enable SMB 2.0.
Reboot the server.

This can easily be reverted if required but has solved a few issues with file copy speed and enumeration faults.

To disable SMB v2 on a client you can run the following commands
sc config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc config mrxsmb10 start= disabled

Regards
Si.
0
 

Author Comment

by:Revera_Experts
ID: 33504798
Hi evilsi
I've already disabled smb2 on both servers but it didn't help this particular problem, thanks for the idea though.
0
 
LVL 4

Expert Comment

by:evilsi
ID: 33506858
Hi,

Have you tried temporarily disabling the firewall on the server 2008 reading the dfs share or when forcing a dfs update?

Regards
0
 

Accepted Solution

by:
Revera_Experts earned 0 total points
ID: 33563749
After a few days with MS support it was found to be the following.
dfs namespace link name was the same as the share name so when dfs fowarded the referral request it ended up back at the dfs namespace again instead of the computers share.
This issue was only found with 2008 as the dfs client works differently to 2003.
Solution is to either
recreate the dfs namespace links with different names
Change the share names and recreate dfs namespace links
add a second name to the share and recreate dfs namespace links <- this is the method I'm taking to minimize disruption
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Normally after a failure of Domain Controller, when promoting new DC the DC is renamed, we will discuss the options in Dcpromo to re-create the DC with the same name. Scenario: You are a small IT shop with two Domain Controllers (Domain Contr…
I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now