Network Slow Down

I have a windows 2003 domain. Recently my users have been reporting decreased performance inside of Windows on their desktops.

Especially when using word and excel to navigate through shares on our file server. Even changing the drive the applications look in from C to P (P being a mapped share) or vice versa can take up anywhere from 5-10 seconds. It randomly hangs when when trying to open folders within those drives, it eventually opens but there is a major delay. It is something I have seen replicated on several workstations now and am not sure what to attribute it to. The file server is not under any kind of load. I've used perfmon to monitor the performance of it and it seems fine. Any suggestions would be much appreciated.

All workstations are configured to automatically search for network devices and shares and office apps have been optimized for accessing files from the network. Could this be active directory related?
J CAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

1) Check for a bad switch
2) check event logs on the servers and 1 workstation that has issues
3) Use wireshark to do a packet trace to see if there are any retries or delays
4) Check that the server hardware is ok, maybe a drive is dying or other issues on the server

I hope this helps !
Syed Mutahir AliTechnology ConsultantCommented:
What AV do you have on your file server ?
I have seen this behaviour with a ESET AV installed on a Fileserver ; eset installed a tdi driver which basically does inspection on your LAN NIC too.

Let us know which AV and you can also try uninstalling AV (for a few hours) to test .
J CAuthor Commented:
No antivirus software is running on the file server currently. I don't see any issues being reported on any of my switches such as duplex mismatches, nothing is running in half duplex on the network. I did think it could be a switch when this started occurring and was obviously affecting multiple users but the network connections seem solid otherwise. Checked the user's logs and am not seeing anything there. I will use wireshark to take a closer look at what's happening behind the scenes and post back. Thanks for the responses.
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

J CAuthor Commented:
What kind of filter can I place so that when I am capturing traffic via wireshark I see what is relevant for this particular issue?
J CAuthor Commented:
This is what I am seeing with wireshark. I am filtering by protocol SMB and believe I am seeing a few errors.

Here it is:

10      0.642348      SMB      134      Trans2 Request, QUERY_PATH_INFO, Query File Basic Info, Path:

Header checksum: 0x0000 [incorrect, should be 0x4c95 (maybe caused by "IP checksum offload"?)]

Expert Info (Error/Checksum): Bad checksum

I see several of these.
J CAuthor Commented: is the machine I am accessing the file server from. is the destination
J CAuthor Commented:
Could the above error be causing my problems?
Frank MayerTechnical Voip SupportCommented:
Hi when looking at the protocol:
make an actual request for a word and excel sheet and watch the time it takes before the answer comes.
Is it really a server problem or is the answer coming fast and the client waiting for something.
On the server look for the logfiles to see unusual messages.
J CAuthor Commented:
Could this be a master browser issue? I forcefully removed a windows 2000 DC from the domain after it crashed.  It could not be dcpromo'd down. It will only boot into directory services restore mode/safe mode. The interesting thing is, with the server powered on (which it has not been while this issue crept up) we don't experience the slowness. Before forcefully removing the server from the domain, I made sure the FSMO roles were transferred to a functional DC. Part of why I had to forcefully remove the DC and more quickly then I would prefer is because I was rolling out Exchange 2010 which requires a Domain Functional Level of 2003. Any feedback is appreciated.
Have you checked the dns setting for the workstation and serve to make sure they are not searching outside the network then coming back in?

Rob WilliamsCommented:
#1 Cause of poor network performance is poorly installed network cabling. Poor terminations or improperly run cabling results in cross talk and lost packets. Constant retransmissions result in a significant performnace loss.  Assuming that is not the case, since this seems to be something that changed:

Slow browsing for files is often related to Windows searching for old links that no longer exist. This happens on a LAN as well, but it becomes much more obvious over a VPN. Finding these can sometimes be a bit time consuming. A few places to look:
-My computer. Look for mapped drives that are disconnected (no longer present)  
    You may want to run
   net use /persistent:no
   net use * /delete
   on a problematic machine to clear all drives, and then re-map
-Network places. Look for links/connections that no longer exist.
  (I prefer to also turn off "automatically search for network folders and printers". Locate by going to the menu bar of my computer | tools | folder options | View | fist item)
-Start menu "recent Documents". To clear; right click on task bar and choose properties | start menu tab | customize | advanced | clear list
-If the Word or Excel applications are slow opening the files from the menu, clear the recent document list within the application. To do so in Word; open the application | on the menu bar choose  tools | options | general | un-check "recently used file list | choose OK to apply | then you can go back in and re-enable. Excel is similar.
-make sure any NIC’s (PC & Server) are configured the same as the switch.  For example if the switch is set to 100 full duplex the NIC should be as well, but if auto-negotiate (as with most switches) the NIC’s must be auto-negotiate.  Mis-matches are a huge problem with performance
-On the explorer menu bar choose tools | folder options | view | un-check "show pop-up description for folder and desktop items"

I would also update NIC drivers, especially on the server.  Having said that there are some new features with NIC’s that are known to cause propmelms……

There are some known issues with newer advanced NIC properties such as "Task Offloading", and “Receive-Side Scaling” which drastically affect performance and stability of file share access if enabled and especially if you are running older drivers. The following outline  changing for the command line but I have found in some cases you have to do so within the advanced NIC properties for them to take effect. Any of these changes require a reboot to take effect.

To disable Receive-Side Scaling, at a command prompt, with elevated privileges, run the following command:
netsh int tcp set global rss=disabled

To disable Task Offload, at a command prompt, with elevated privileges, run the following command:
netsh int ip set global taskoffload=disabled

To disable Add-On Congestion Control Provider, at a command prompt, with elevated privileges, run the the following command:
netsh int tcp set global congestion=none

For more information Information about the TCP Chimney Offload, Receive Side Scaling, and Network Direct Memory Access features in Windows Server 2008

Related blog articles:
J CAuthor Commented:
Would you be willing to read my last post. When the forcefully removed dc comes online performance immediately improves. I'm just not sure how to become un-reliant on it at this poiint.

Rob WilliamsCommented:
Sorry I missed that.
I don't belive it would be a master browser issue, but could the PC's still be pointing, even as an alternate, to a decommisioned DNS server?  That would certainly cause slow logons and delays in accesing resources.

How is performance if you acces using the IP such as  \\\ShareName ?
If that is OK it at least rules out physical network issues.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
There is a windows update that causes this slowdown on mapped office documents. There's a lot of references to this on the internet.
J CAuthor Commented:
RobWill, I will test your theory and rule out DNS. That would make sense. Once I have tested I will update you. Thanks a lot for your input.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.