System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.
On a Microsoft Windows Server 2003-based
or Microsoft Windows 2000 Server-based computer, you may experience one or more of the
following symptoms when you work with files over the network:
A Windows-based file server that is configured as a file
and print server stops responding. Then, the file and print server
functionality temporarily stops.
You experience a long delay when you open,
save, close, delete, or print files that are located on a shared
resource.
You experience a temporary decrease in performance when you
use a program over the network. Typically, performance is slow for
approximately 40 to 45 seconds. However, some delays may last up to 5
minutes.
You experience a delay when you copy a file copy or when you perform
backup operations.
When you connect to a shared resource, Windows Explorer
either stops responding or you see a red X on the connected network
drive.
A program stops responding that either uses remote
procedure call (RPC) or that uses named pipes to connect to a file
server.
The server temporarily stops responding and one or more
event ID messages that resemble the following messages appear in the System log
on the file server:
Event ID: 2022
Source: Srv
Type: Error
Description:
Server was unable to find a free connection <number> times in the last <number> seconds.
Event ID: 2021
Source: Srv
Type: Error
Description:
Server was unable to create a work item <number> times in the last <number> seconds.
Event ID: 2020
Source: Srv
Type: Error
Description:
The server was unable to allocate from the system paged pool because the pool was empty.
Event ID: 2019
Source: Srv
Type: Error
Description:
The server was unable to allocate from the system nonpaged pool because the pool was empty.
Event ID: 2510
Source: Server
Event Type: Error
Description:
The server service was unable to map error code 1722.
Additionally, the following event may appear in the System log on
the client computer:
Event ID: 3013
Event Type: Error
Event Source: MrxSmb / Rdr
Description:
The redirector has timed out a request to <ComputerName>.
You receive one of the following error messages when you
try to connect to a shared resource:
System error 53. The network path
was not found. (ERROR_BAD_NETPATH)
System error 64. The specified
network name is no longer available.
(ERROR_NETNAME_DELETED)
You are intermittently disconnected from network resources,
and you cannot reconnect to the network resources on the file server. However,
you can ping the server, and you can use a Terminal Services session to connect
to the server.
If multiple users try to access Microsoft Office documents
on the server, the File is locked for editing dialog box does
not always appear when the second user opens the file.
A network trace indicates that there is a 30 to 40 second delay between
a server message block (SMB) Service client command and a response from the
file server.
In Windows Server 2003 and Windows 2000 Service Pack 4
(SP4), the server may stop responding arbitrarily.
When you try to open a Microsoft Access 2.0 database file (.mdb) in
Microsoft Access 97, Access 2000, or Access 2002, you may receive an error
message that resembles the following:
Disk or network
error.
When you open Microsoft Excel, you may receive the
following error message:
file has not been
saved.
When you open Windows Explorer, you may receive the
following error message:
Cannot access <path and file
name> .The session was canceled.
When you open a Microsoft Word file, Word may fail. Then,
you may receive the following error message:
Word failed
reading from this file <file name>. Please restore the network connection
or replace the floppy disk and retry.
Additionally, after you restore the network
connection and you click OK, you receive the following error
message:
Word has lost data because of a bad network
connection or missing floppy. Documents relying on this data will be saved and
then closed.
These problems may occur when one of the following
conditions is true:
The version of Symantec Event Handler driver (Symevent.sys)
is outdated. Therefore, two or more threads are deadlocked in the Symevent.sys
driver in the Symevent_GetSubTask function.
There is a Computer Associates (CA) INO_FLTR.SYS OpLock
interoperability problem with the Srv.sys file.
To resolve these problems, update the third-party antivirus
file system filter driver. For example, if you have the Symantec Event Handler
driver (SymEvent.sys) installed on the computer, update to version 11.6.4.1 or
a later version. To obtain an updated version of the Symevent.sys file or to
find help with the reconfiguration, visit the following Symantec Web site:
Note The SymEvent.sys file version 11.6.4.2 has a bug that can make
some servers restart arbitrarily. For information about your hardware manufacturer, visit the following Web site:
All the error messages that are mentioned in the "Symptoms" section point to
failing SMB connections. These failing connections can be network related. Or
the failing connections can occur when the server stops
responding arbitrarily.
The following antivirus driver versions can also cause
servers to stop responding:
The problem is known to occur
when the following driver versions are installed on the file server.
Collapse this tableExpand this table
Name
Company
Version
Date
Description
Symevent.sys
Symantec
Corporation
11.4:0.6
05-Mar-2004
Symantec Event
Library
Symtdi.sys
Symantec Corporation
5.3:6.13
23-Dec-2004
Network Dispatch Driver
These versions that are installed with Symantec
Antivirus 9.0.
The following Web page on the Symantec Web site
(Symantec Document ID: 2005062909055948 ) describes how to update the Symevent
files:
If you investigate network traces, you may find that the file
server does not answer SMB requests. For example, after you perform a network
track operation, you receive the following code:
15:28:14 client -> server SMB Read AndX Request, FID 0x0002
15:28:14 server -> client TCP [ACK]
After approximately 45 seconds, the client computer ends the TCP Session
(FIN), and then the server sends a "[FIN ACK]." After you perform the network
track operation, you receive the following code:
15:29:05 client -> server TCP [FIN ACK]
15:29:05 server -> client TCP [FIN ACK]
In such traces, you can see that the server does not answer to the SMB
request. However, the server still sends a TCP acknowledgement for the client
computer request. This means that the server service on the Windows-based file
server is unresponsive to SMB requests. This also means that network
connectivity is not the cause of the problem.
For more information, click the following article numbers
to view the articles in the Microsoft Knowledge Base:
816071
(http://support.microsoft.com/kb/816071/
)
How to temporarily deactivate the kernel mode filter driver in Windows
240309
(http://support.microsoft.com/kb/240309/
)
How to
fully disable antivirus software from filtering files
822219
(http://support.microsoft.com/kb/822219/
)
You experience slow file server performance and delays occur when you work with files that are located on a file server
The third-party products that this
article discusses are manufactured by companies that are independent of
Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the
performance or reliability of these products.
Back to the top
