Files Saved on Network Share Freezing - Can Only Hard Shutdown to Close

Greetings,

Sometime around early May Employees at our company started experience issues where mostly Excel files saved on a network share would freeze and go "not responding" to the point where we couldn't end the Excel process to close it and Windows would hang if we tried shutting down or restarting.  The only way out of it is a hard shutdown.  We've found this happen with Word files as well but mostly Excel files.  Everything works fine locally on the machine it's only when opening and saving Excel files on a network share.  We're all on Windows 7 Enterprise and our servers are a mix between 2003 R2 through 2012.  The network share is on Server 2003 R2.  We've had a number of changes in our environment lately making it hard to pinpoint the cause.  Around the time this problem started we began rolling out Kaspersky Endpoint Security for our anti-virus and Lync 2013.  We're all using Microsoft Office 2010 along with Lync 2013 which is giving us Office 2013 updates.  We've tried several things on local computer like repair/reinstall Office, adjusted certain Excel settings, new Windows profiles and we also restarted the server containing the network share.  One of the users who had this issue we're having test Office 2013 and they haven't had the issue since.  Another we removed Kaspersky and they haven't had an issue since which is still making finding the problem difficult.  Most users having the problem were consistently getting the application logs below regarding Excel application hung.  It's possible there were more changes in our environment around this time and I have more information but I'll start with this.  Any idea's here on what could be causing the problems?  I didn't find much with the logs below.  I haven't tried any old Windows updates that relate to this issue since it just started I didn't thing an update from years ago would help but I'm open for any suggestions.

Log Name:      Application
Source:        Application Hang
Date:          6/5/2015 11:01:59 AM
Event ID:      1002
Task Category: (101)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      removed
Description:
The program EXCEL.EXE version 14.0.7149.5000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 Process ID: 2350
 Start Time: 01d09fa50e1cc684
 Termination Time: 60000
 Application Path: C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
 Report Id: eb95d2b7-0b98-11e5-becb-ecf4bb691a89

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Hang" />
    <EventID Qualifiers="0">1002</EventID>
    <Level>2</Level>
    <Task>101</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-06-05T16:01:59.000000000Z" />
    <EventRecordID>13472</EventRecordID>
    <Channel>Application</Channel>
    <Computer>removedbyMatt</Computer>
    <Security />
  </System>
  <EventData>
    <Data>EXCEL.EXE</Data>
    <Data>14.0.7149.5000</Data>
    <Data>2350</Data>
    <Data>01d09fa50e1cc684</Data>
    <Data>60000</Data>
    <Data>C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE</Data>
    <Data>eb95d2b7-0b98-11e5-becb-ecf4bb691a89</Data>
    <Binary>55006E006B006E006F0077006E0000000000</Binary>
  </EventData>
</Event>


Log Name:      Application
Source:        Windows Error Reporting
Date:          6/5/2015 11:00:52 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      removed
Description:
Fault bucket , type 0
Event Name: AppHangB1
Response: Not available
Cab Id: 0

Problem signature:
P1: EXCEL.EXE
P2: 14.0.7149.5000
P3: 552dcfc6
P4: 4f78
P5: 0
P6:
P7:
P8:
P9:
P10:

Attached files:

These files may be available here:
C:\Users\removed\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_EXCEL.EXE_f9584e6b7b304f2e99ae46bb422cfa0e5e5be14_205ed143

Analysis symbol:
Rechecking for solution: 0
Report Id: eb95d2b7-0b98-11e5-becb-ecf4bb691a89
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-06-05T16:00:52.000000000Z" />
    <EventRecordID>13471</EventRecordID>
    <Channel>Application</Channel>
    <Computer>removed</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>AppHangB1</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>EXCEL.EXE</Data>
    <Data>14.0.7149.5000</Data>
    <Data>552dcfc6</Data>
    <Data>4f78</Data>
    <Data>0</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>C:\Users\removed\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_EXCEL.EXE_f9584e6b7b304f2e99ae46bb422cfa0e5e5be14_205ed143</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>eb95d2b7-0b98-11e5-becb-ecf4bb691a89</Data>
    <Data>0</Data>
  </EventData>
</Event>
Matt DonkAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lionel MMSmall Business IT ConsultantCommented:
My initial guess is hardware but if it is happening to "everyone" who uses a share on a 2003 server then the problem should be isolated to that server and not the Win7 systems--that should not be making them become non-responsive. Even if it is a network switch or router that all these systems are connected to it should not make the PC hang. So it may be an issue with the 2003 server trying to to send data to the Win7 PCs across a bad cable or network card and sending junk data and flooding the Win7 systems with data causing them to crash. Can you move the share to a different server and test it or swap the cable and/or network card. It may also be that the files they are trying to open are infected.
MicrosoftSavvyCommented:
what is the speed of the network?
how many users and machines?
what av are you using?
Davis McCarnOwnerCommented:
The Microsoft Office File Validation which is one of the updates installed after Office has caused horrendous problems with files located on network shares.  At one of my clients, it literally changed the time to open an Excel spreadsheet to 15+ minutes from less than a second.  Add Kaspersky into the mix and I can easily see a nightmare.

You would need to change the 11.0 to the correct version of Office for your PC's; but here is the text from a reg file I used to disable it:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0\Excel\Security\FileValidation]
"EnableOnLoad"=dword:00000000
SolarWinds® IP Control Bundle (IPCB)

Combines SolarWinds IP Address Manager and User Device Tracker to help detect IP conflicts, quickly identify affected systems, and help your team take near instantaneous action. Help improve visibility and enhance reliability with SolarWinds IP Control Bundle.

Matt DonkAuthor Commented:
Thanks for the replies.  We have over 1000 employees but not everyone is using files on the K drive that often.  It's a random intermittent issue that I've been able to replicate at times and unable to at other times.  I can't necessarily say it happens to everyone who works on these files on the K drive but I'm sure some haven't had the issue yet.  It's doesn't seem to be the files themselves it's happen to several.  It happened to me on a new file recently created.  I'll have to check on the speed of the network.  Several users and computers having the issue I don't have an exact number as not everyone is reporting the issue either.  Some have it everyday and others only once or twice in a matter of weeks.  Kaspersky Endpoint Security 10 is the AV were pushing out now and everyone having the issue has it.

We are exploring moving to a newer server.  The server now is Windows 2003 but it's a virtual server on a VMware host.

I'm having issues finding this File Validation registry path, it's not matching up with what I have.  I did a search for "filevalidation" and it didn't find anything.

Thanks for your time!
Davis McCarnOwnerCommented:
Try HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\14.0\Excel\Security
Iain MacMillanIT Regional Manager - UKCommented:
As Davis says, it could very well be an issue with OFV -- one update i have refused twice on our WSUS, once for Office 2010 and once for Office 2013 (we're in the middle of rolling it out).  First step is to remove the update, or better yet if you have an WSUS server (you should do), decline the update and try to remove it from a  few test systems.  As you have over 1000 systems, you might want to look at updating your Office 2010 policy files as well for the main apps, if i recall under Options>Security>Trust Center>Protected View, you can allow all files to be opened and edited, which may negate some issues with the update.  Each app should have this policy, obviously update Word and Excel ones first, and use GPUPDATE /force to get your test systems updated right away.

Also if you have 2003 servers (esp. File servers), with Win 7 clients, you may wish to disable SMB2 on the client systems, as this will also be part of the issue, plenty posts have been made on EE about that, usually alongside Autotune and Heuristics.  2003 and XP only support SMB1, so the Win 7 systems 'talk' to these systems much slower as they by default like to use SMB2.

Once you have no requirement for 2003 servers, then you can re-enable (again this is something i am going through, except there are some legacy 2003 server VM's i can't ditch).

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Office

From novice to tech pro — start learning today.