Slow SMB performance when you copy files from Windows XP to a Windows 2000 domain controller


You may notice slow copy performance when you copy files from a Windows XP-based client computer to a Windows 2000-based domain controller (when you use the Server Message Block [SMB] protocol). This slow performance occurs only when you copy files from a Windows XP-based client to a Windows 2000-based domain controller (push mode) and not when you copy files from the domain controller to the client (get mode).


The slow SMB performance may occur if a delayed TCP/IP acknowledgement (also known as a TCP ACK) occurs in a "SMB: C NT transact - Notify Change" packet. Typically, this issue occurs if you use Windows Explorer to copy the files to a domain controller. However, this issue may also occur if you use a command prompt to copy files or if the focus is on the destination folder in Windows Explorer (when the Change notification is involved). This issue occurs as soon as you perform an SMB copy procedure (from any program) to a remote target folder that has been also invoked by a "change notification" request (from any program).

By default, this behavior occurs as soon as SMB is using security signatures. If security signatures are configured, SMB must be processed synchronously by the redirector. The redirector has to wait until the current SMB command is fully processed before it continues with the next one. The redirector waits until it receives the TCP/IP acknowledgement from server.


To work around this issue, use either of the workarounds that are described in this section.

Workaround 1

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following key in the registry:
    HKEY_LOCAL_MACHINE\System\Current ControlSet\Services\LanmanServer\Parameters
  3. Double-click the RequireSecuritySignature value, type 0 in the Value data box, and then click OK.
  4. Double-click the EnableSecuritySignature value, type 0 in the Value data box, and then click OK.
  5. Quit Registry Editor.
By default, the EnableSecuritySignature value is set to 1 (ON) on a domain controller and is set to 0 (OFF) on a non-domain controller. As a result, slow SMB copy performance only occurs when you copy items to a domain controller.

Workaround 2

Note This workaround is not supported on Windows XP-based and Windows Server 2003-based computers.

Toggle the TCP delayed ACK timer (TcpDelAckTicks) to a lower value. When you do so, the server acknowledges items more frequently but at shorter intervals. You can use hotfix that is described in the following Microsoft Knowledge Base article to specify a custom delayed ACK value:

311833 The TcpDelAckTicks Registry Value Has No Effects on Ack Timeouts
If you set the TcpDelAckTicks value to 0, you turn the timer off completely. When the timer is turned off, TCP reverts to pre-Request for Comments (RFC) 1122 behavior; it acknowledges each packet. This workaround solves the SMB copy performance issue. However, on a high latency network (highly saturated segment), this behavior increases the number of acknowledgements from the domain controller and puts additional strain on the network.

More Information

To see how the slow performance is related to TCP/IP acknowledgement of some SMB frames ("SMB: C NT transact - Notify Change"), perform a network trace. If you do so, you see that the redirector does not continue with the rest of the copy operations when the "SMB: C NT Transact - Notify Change" frame is not acknowledged by the server at the TCP transport level. The TCP/IP acknowledgement is only delayed (for about 0.2 seconds) when the server is a Windows 2000-based domain controller.

On a Windows XP-based client or on a Microsoft Windows Server 2003-based client, there is a new registry key named TcpAckFrequency that controls TCP ACKs before the delayed ACK timer is reached.

For more information about this problem, click the following article numbers to view the articles in the Microsoft Knowledge Base:

321098 Slow network performance occurs if you copy files to a domain controller that is running Windows 2000 or Windows Server 2003

328890 New Registry Entry for Controlling the TCP Acknowledgment (ACK) Behavior in Windows XP and in Windows Server 2003


Article ID: 321169 - Last Review: Oct 21, 2008 - Revision: 1