Windows Explorer constantly searching on network drives

[tom84]

Hi guys

Getting this on a mapped network drive (on server 2003), on every client (windows XP).

Basically if you try to create a new file/folder it won't appear and it'll state "searching for items" in the status bar. It'll show up after 20-30 seconds, but sometimes it'll look like it's crashed out. It ONLY occurs in the root of the mapped drive. If I go to a sub folder it's fine.

I've tried disabled "automatically search for folders and files" on the XP machines, i've also tried the registry fix as seen here:

http://www.experts-exchange.com/OS/Microso...Q_21917152.html

I've tried adding an additional share, mapping it to another letter and unsharing / resharing the folder with no luck.

Any ideas?

[tom84]

To add, if I open a network drive without an issue I get very little network traffic.

When I'm opening the network drive with an issue I'm getting about 100kB/s both ways constantly....

[tom84]

To add, getting LOADS of these in wireshark:

3975 70.694431 192.168.1.3 192.168.1.69 SMB Trans2 Response, QUERY_PATH_INFO, Error: STATUS_OBJECT_NAME_INVALID

.69 being my workstation and 1.3 being the DC with the file share.

I've also noticed the ntfs perms are way off, alot of files were copied over from DC to DC yesterday, there are duplicates of the same ACLs with with inherited / non inherited status.

Looks like NTFS perms are to blame?

[Syclone0044]

Hi Tom,

I've dealt with this problem and it can be a REAL b***h. Try this, search your user profile for "Recent" folder, and it should have a giant list of hundreds or thousands of Shortcuts to programs and documents you've ran.

If you see any that are from a network drive, you've found your culprit!!! DELETE them! But be sure they are just shortcuts (<1KB) and not the actual files, of course.

The problem is that these stupid recent shortcuts cause Windows Explorer's shell to try and find/resolve the network location every single time you hit a File browse dialog. Unbelieveably bad design by Microsoft, to be sure.

[cluberti]

Basically if you try to create a new file/folder it won't appear and it'll state "searching for items" in the status bar. It'll show up after 20-30 seconds, but sometimes it'll look like it's crashed out. It ONLY occurs in the root of the mapped drive. If I go to a sub folder it's fine.

I've tried disabled "automatically search for folders and files" on the XP machines, i've also tried the registry fix as seen here:

http://www.experts-exchange.com/OS/Microso...Q_21917152.html

That reg entry only affects sub folders, so if it only happens in the root and not subfolders then you've actually done nothing to help yourself.

To add, getting LOADS of these in wireshark:

3975 70.694431 192.168.1.3 192.168.1.69 SMB Trans2 Response, QUERY_PATH_INFO, Error: STATUS_OBJECT_NAME_INVALID

Well, yes, but technically it's not a permissions issue causing the delay, it's the fact that the number of requests is so large - the permissions issues don't help, but they're not gonna make it a heck of a lot faster if you fix them either. The problem is the client is requesting tons of data over SMB, and SMB is not an efficient protocol. Instead of messing with permissions on your server (unless you're sure they're incorrect or problematic), I would instead suggest making the following changes on your XPSP3 machines (XPSP2 require hotfixes that are included in SP3, so if you're running SP3 you don't need some of the specific hotfixes you'd need on SP2 to allow these reg values to work) to reduce the amount of SMB traffic and lookups required to do regular tasks:

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value: UseDesktopIniCache
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value: NoRemoteRecursiveEvents
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value: NoRemoteChangeNotify
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value: StartRunNoHOMEPATH
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value: NoRecentDocsNetHood
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value: NoDetailsThumbnailOnNetwork
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MRXSmb\Parameters
Value: InfoCacheLevel
Type:  REG_DWORD
Data:  00000010 (hexadecimal)

Key:   HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\CryptoSignMenu
Value: SuppressionPolicy
Type:  REG_DWORD
Data:  00100000 (hexadecimal)

Key:   HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32}
Value: SuppressionPolicy
Type:  REG_DWORD
Data:  00100000 (hexadecimal)

Key:   HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\{883373C3-BF89-11D1-BE35-080036B11A03}
Value: SuppressionPolicy
Type:  REG_DWORD
Data:  00100000 (hexadecimal)

Key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SCAPI
Value: Flags
Type:  REG_DWORD
Data:  00100c02

Key:   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Value: SafeDllSearchMode
Type:  REG_DWORD
Data:  1

Key:   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Value: SafeProcessSearchMode
Type:  REG_DWORD
Data:  1

You should also consider making the following change on the file server or servers as well:

Key:   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MRXSmb\Parameters
Value: InfoCacheLevel
Type:  REG_DWORD
Data:  00000010 (hexadecimal)

Once any machine that has the changes above made to it is rebooted, you should see a performance increase and a reduction of SMB traffic on your LAN or WAN. You can roll some of these back if you find you need the features you've disabled (for example, NoRemoteChangeNotify being set to 1 will disable automatic refresh of remote SMB shares, so a user won't see a change made to the share if it is currently open on that user's workstation unless the user explicitly refreshes the view or closes and re-opens the share - it reduces traffic to disable, but if shares change frequently while users are actively browsing them this may have side-effects you may not want).