Files that are copied into replicated file shares may not be replicated for an unexpectedly long time when antivirus software is installed on the originating server

Article translations Article translations
Article ID: 956123 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

New files that are copied into replicated file shares on Windows Server 2003 R2-based or on Windows Server 2008-based computers may not be replicated for an unexpectedly long time. This issue may occur when antivirus software is installed on the originating server.

CAUSE

During an originating write to the NTFS file system, such as when a new file is created, Ntfs.sys must update its NTFS change journal. The File Replication Service (FRS) and the Distributed File System Replication (DFSR) service are responsible for synchronizing replicated folders. FRS and DFSR use this NTFS change journal to determine when items have changed, and when such items require replication.

When a kernel-mode application, such as an antivirus application, opens a read-only section while another application uses a read/write section (For example, an application uses a read/write section when a new file is created.), the NTFS change journal may not be updated. In this scenario, a new file is not replicated when an external activity opens the file again. Then, the journal will be updated.

RESOLUTION

To resolve this issue, apply the hotfix package that is described in the Microsoft Knowledge Base article 953325. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
953325 A Windows Server 2003-based computer becomes unresponsive because the paged pool memory is exhausted when an application calls the GetFileAttributesEx and MoveFileEx functions on lots of files

MORE INFORMATION

In a typical scenario where this problem occurs, DFSR or FRS together with Microsoft Forefront Client Security are installed on the same computer. Other antivirus applications may also have this problem, depending on the APIs that they use.

Properties

Article ID: 956123 - Last Review: January 20, 2011 - Revision: 2.0
APPLIES TO
  • Windows Server 2008 Datacenter without Hyper-V
  • Windows Server 2008 Enterprise without Hyper-V
  • Windows Server 2008 for Itanium-Based Systems
  • Windows Server 2008 Standard without Hyper-V
  • Windows Server 2008 Datacenter
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Standard
  • Microsoft Windows Server 2003 R2 Datacenter Edition (32-Bit x86)
  • Microsoft Windows Server 2003 R2 Datacenter x64 Edition
  • Microsoft Windows Server 2003 R2 Enterprise Edition (32-Bit x86)
  • Microsoft Windows Server 2003 R2 Enterprise x64 Edition
  • Microsoft Windows Server 2003 R2 Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003 R2 Standard x64 Edition
  • Microsoft Forefront Client Security
Keywords: 
kbtshoot kbexpertiseinter kbprb fep2010swept KB956123

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com