2008R2 Firewall causes delays on My Documents and browsing UNC paths

[morganw]

I've got a weird problem on a brand new 2008R2 domain with Windows XP clients. I've just noticed that when saving a file in Office2003, when clicking 'My Documents' I would get a 15 second-ish delay before the contents were shown. The same delay is also present while trying to access a server by the UNC path, e.g. typing \\SERVER\ into the run box. It also seems to only delay on the first try, so a subsequent attempt to do the same thing will not be delayed

 

The problem seems to be related to the Windows firewall on Server 2008R2, if I turn the firewall off the delay disappears.

 

Since this a brand new install I really wanted to start with all of the server firewalls turned on, I've got the exception in for 'File and Printer Sharing' for the domain.

 

I found someone with exactly the same problem on experts-exchange, they just ended up turning their firewall off.

My Documents Properties responding slow after Redirection Change from Group Policy

 

Anyone know what is going on with this?

[jsnetman]

Maybe I am wrong but have never enabled any firewalls on an internal lan clients or servers. Instead I have relied on firewalls at the edge of the network to protect the entire lan. Of course if you get an attack from within your network the external firewall won't stop that. Fair enough if you have a server which is open to access from a public facing IP a firewall is a must. It would be interesting to hear from other people what they do with firewalls on clients and servers in a protected lan envionment on 2003 or 2008.

[morganw]

I was thinking of more internal attacks, viruses and other non-internet type things. It's been pointed out to me that the ports that are open for the network to function are the ones which are most likely to be used in such attacks but I'd still rather have them on.

 

As an example, the SIMS Docstorage and SQL backups will be rsynced to a backup server overnight, there is a complex encrypted password involved in doing this but running with the firewall up allows me to also specify which IP addresses are allowed to connect to the rsync port. It will probably never matter but it lets me sleep a little easier at night.

 

I think i've found the problem for the slow unc access, I've disabled the webclient service on the clients and now the delay is gone. Apparently this service will attempt to connect on port 80 on the server when the UNC path isn't immediately valid.

 

Info here:

A long delay occurs when you try to open a network share by entering a path in the Run box on a Windows Vista-based or Windows Server 2008-based computer

[lefty8680]

I've setup my VPN cisco connection to a windows 2008 server. Works perfectly even though i thought it would be a headache but then i realised something strange:

 

I did a transition from Server 2003 to Server 2008 recently and moved across all the data (network shares, emails etc).

 

Now, the issue is, that i noticed when i VPN from home, i map 2 drives: my home network share (H Drive) and another Common Staff Folder (M Drive). Althought i realise that the upload/download speed depends on my connection from home, i found out that when i am browsing through the M drive, it goes smooth (back and forth through the folders, subfolders, etc), however, when i start browsing my home H drive, it takes 5 to 6 seconds. Then i went into work and realised it takes 2 to 3 seconds on the LAN to browse through the H Drive. Again, M drive is smooth.

 

After literary reading hours of articles and playing around, i came to notice that actually only when i go back to the documents (which is now redirected so staff can access their H drive through My Documents or by going to My Computer and then H Drive) or browse through other redirected folders such as My Pictures, My Music, My Videos, that browsing through these and their sufolders takes 2 to 3 seconds each time, however, if i am browsing folders i created and their subfolders, there is no issue!!!! Everybody uses Windows XP SP3 at work with Windows Server 2008 R2...if anyone can shed any light on how to fix this i would be most grateful!

 

Thank you!!

[morganw]

If it's ok on folders that you've created then maybe the delay is a problem translating the security identifiers on the folders. I had a similiar thing a couple of days ago when I had a switch with a duplicate IP address and the primary domain controller seemed a little unresponsive. I was getting a 2 -3 second delay trying to view security settings. Just a guess.

[lefty8680]

so you reckon i should go through the network equipment (Switches, firewalls, etc)?

[cookie_monster]

We have the Windows firewall enabled on all systems here, XP SP2/SP3 boxes and 2008 SP2 servers and we don't seem to have any issues. Defence in layers as they say it's there so use it, (unless of course you're having issues with it ). This saved our bacon when someone bought conficker onsite as only a few test PC's and Windows 2000 boxes became infected.

 

 

Do you have all of the necessary ports for DNS open and are they the same on all DNS servers, could it be waiting on one DNS server timing out then moving to another that's configured correctly?

 

 

EDIT: Reading the link posted above KB958970 that makes sence as we have the WebClient service dissabled on all PC's/

Edited August 5, 2010 by cookie_monster

[morganw]

so you reckon i should go through the network equipment (Switches, firewalls, etc)?

 

Maybe as a last resort, for a physical pc you could try disabling the WebClient service although you can test if that is an issue by turning the firewalls off on the servers - the delay should then disappear.

 

Does your VPN go straight to the server which contains the files you are browsing or are you connected to some kind of gateway which then links to the fileservers?

[morganw]

We have the Windows firewall enabled on all systems here, XP SP2/SP3 boxes and 2008 SP2 servers and we don't seem to have any issues. Defence in layers as they say it's there so use it, (unless of course you're having issues with it ). This saved our bacon when someone bought conficker onsite as only a few test PC's and Windows 2000 boxes became infected.

 

That is my thinking and I'd rather go for extra layers of protection. The only server that I can't use the firewall on at the moment is the SIMS server, the SIMS application fails to login with reason '0'. I've opened the default SQL port but it still doesn't connect. Don't suppose you know which ports should be open? Everyone else I speak to normally has the firewalls off.

[cookie_monster]

Ha interesting that you should ask that, our SIMS box is still on 2003 and I don't have the firewall on that. As soon as we move to 2008 (soon) i'll be turning it on and sorting the pirts out.

[lefty8680]

mogranw: as i said, VPN is fine - this entire situation i am talking within the actual LAN, ie, when a client sitting in his office is trying to connect to the server which is 1 floor below him...i read about the web client thing - should that really help me out? Is it a valid solution? Would i have to tweak each invididual user pc?

[lefty8680]

just tried disabling firewall, symantec antivirus, but nothing and like i said earlier, all shared folders and shared drives (like the mapped staff common drive) open fine no issues - only problem with My Documents, My Videos, My Pictures - redirected folders problem only!

[morganw]

Is the My Documents redirection done with environment variables or are you using a DNS name of a server?

[lefty8680]

in the group policy, i selected redirect folder, documents, basic redirection and at the bottom redirect to user profile. Then when i map the drives, i use ip address or name of server - is this what you mean?

[morganw]

Yes, if you do it that way then the My Documents redirection should be based on %HOMESHARE%%HOMEPATH%. If you log in and type echo %HOMESHARE% and then echo %HOMEPATH%, if you join those two together that should show what the system trys to resolve when using the redirection. You shoulnd't have to map the homedrive, i'm not sure whether you meant you map it or you were talking about map drives to other shares, but whatever is set in AD on the 'profile' tab should get mapped automatically and that is where the %HOMESHARE% value should be read from. That is my understanding anyway.

[lefty8680]

Interesting - this might actually sort it out - makes sense what you talk about in terms of %homeshare%%homepath%, etc - where can I check what it actually is? On the client machine or on the server and if so, whereabout? Thanks.

[morganw]

To check the redirection value on the server side you can look at a group policy settings report on the GPO that does your redirection. That's pretty much guaranteed to be correct and should have "%HOMESHARE%%HOMEPATH%" as the direction value.

 

To check that it isn't doing anything bizare you would need to be on a client, then just echo the variables from within a command window.

 

So for a network account, you should get:

 

echo %HOMESHARE% --> "\\SERVER\Sharename$" (assuming you use one share per user)

echo %HOMEPATH% --> "\"

 

so the redirection points to "\\SERVER\Sharename$\"

 

I think that what is happening is that you have something which makes a delay while resolving this path, similar to mine caused by the WebClient service. I don't think that a mapped drive would be affected as the address of mapping would only be resolved once as the drive was actually mapped, from then on the system is only resolving drive letters so there would be no delay.

 

If you did want to try disabling the WebClient service you can do this through the service management of Group Policy Preferences so you wouldn't have to physically go to every PC.

[lefty8680]

OK so i've done:

 

echo %HOMESHARE% on one of the computers (lets say logged in by John smith) and I got \\server\home\j.smith

echo %HOMEPATH% produced as you put it a back-slash "\"

 

Doing group policy results test to the computer now

 

I've noticed two other things - installed comodo firewall and every time i open the network share, the ports contacted are 53 and 389.

 

Also, i found that some guy used this to sort out this issue with homeshare / homepath - but don't think it was the delay issues but in general:

 

http://www.edugeek.net/forums/windows/685-problem-homepath-homeshare-variables.html

 

getting a bit desperate here for a solution - this is really annoying!

[morganw]

389 is LDAP, the internet tells me that 53 is DNS. If you checked the name lookup of the domain controllers and fileserver (probably use nslookup servername) then that would suggest it's a delay in the LDAP query. That was what I had when I had a duplicate IP address although that gradually got worse through the day and ended up with delays of minutes not seconds.

 

If you access the share directly by typing \\server\home\j.smith into the run box do you get any delays?

[lefty8680]

Yes, same thing - if i type it into run command, like 2 to 3 seconds before it opens...

[morganw]

Is the delay once per logon session, or if you typed it again do you get the delay again?

[lefty8680]

each time i type it there is a delay - same as when i am browsing through the My Videos, or My Music, or My Documents, or My Pictures down through the subfolders and back up - always the delay

[morganw]

Do you also get the same delay when you login (time between pressing enter and the logon screen disappearing)?

What kind of profile are you using, if it's mandatory or roaming try letting a local profile build instead. If the permissions are wrong on a mandatory profile then I think that would cause a delay while navigating folders as the folder redirection changes will try to write back to the profile, although again I think that is for a longer delay than 2 to 3 seconds.

[lefty8680]

no, am using local profiles - never fancied mandatory or roaming. The first time i open it after logging in it's kind of faster by a second, but after that always the same - 2 to 4 seconds delay...

[morganw]

Hmmm. i'm running out of ideas.

Do your DHCP and DNS run inside the domain or are they external?

You could also try disabling SMB v2.0 on your server as XP won't use it anyway, not entirely sure how to do it though - you have to go do it in the registry. XP will negotiate down to the older SMB protocol so mayeb this is somehow going wrong. You could set up another fileserver and see if you get the same delay, or try a Vista/W7 client and see if you get the same delay.