2008R2 Firewall causes delays on My Documents and browsing UNC paths

[lefty8680]

looking around for redirection issues due to ldap...found this Slow LDAP query workaround - ASP.NET Forums also, quite old...but wow - this whole thing is just too weird...

[lefty8680]

DHCP and DNS are both on the same server as DC / AD / Network share / print server, etc...yes, SMB is another thing - i found an article how to get it done. Will also bring in a vista machine and try and see if it works.

[lefty8680]

still no solution...what a pain

[morganw]

I would get a spare PC and set that up set as a fileserver, then try pointing to that for the redirection. If that works then you know it's something to do with the configuration of the original server, if it doesn't work then it's probably something wrong with something global like group policy settings. It might help to narrow it down.

[lefty8680]

just been trying for past couple of days. did what you suggested, but on server - created new user, new policy for himi alone, put him in separate home share from other users and on my local computer even without being re-directed the my documents was slow (in the sense that i kept my documents on the local profile to be on C drive)...so it seems that it's my computer and perhaps the hard disk drive!! We bought these dell latitude e6400 as windows 7 machines which we downgraded to windows xp sp3. Now, im wondering if that is the problem?

[morganw]

Did you have to change any SATA drive controller settings in the BIOS in order to install Windows XP?

[lefty8680]

ya basically we had to install windows with extra sata drivers (cant remember the software name but basically we had to make CD with sada drivers and windows xp on it and then install)..

[mb2k01]

Interesting! I stumbled accross this thread when searching due to having the exact same problem - server2008r2 being used as a file server for user home directories.

Not that it's a fix, but I can comfirm turning the firewall off DOES resolve the issue.

 

If anyone does have a more secure fix I'd be interested in giving it a go.

[morganw]

Hi,

My problems disappeared if I disabled the webclient services on the clients.

Are you still on XP or are you on Windows 7 now?

[mb2k01]

Hi,

My problems disappeared if I disabled the webclient services on the clients.

Are you still on XP or are you on Windows 7 now?

 

I'm on site at one the the primaries today, so XP here sadly!

I will give that a go too (after googling to see exactly what it does lol!)

[morganw]

I think unless you are using some kind of WebDav service to achieve something you generally won't notice the difference.

[lefty8680]

Glad someone else actually looked into this - I actually upgraded all internet speeds - got 30 mbps dedicated internet connection at work, 24 mbps broadband at home, and now its 50% better but still would like to know proper solution.

 

On another note, speaking of access folders - i got this thing which concerns me - all users can find out the server ip address from doing ipconfig and then since all are administrators on their local computers, they can go to start - run - type in the ip address of the DC server where all the users folders are also, and then the server opens showing all the shared folders, whereas before on Server 2003, all of them still had to type in the username and password to do so - can i disable them see server files through group policy?

[dalsoth]

Just flicked through the thread so apologies if i am completely bonkers but perhaps the issue of delays when trying to browse those paths is a netbios issue rather than dns or firewall? Do you have default netbios over tcp/ip set in your clients? Do you run Wins? Is any of these things being blocked by a firewall or elsewhere?

[morganw]

Glad someone else actually looked into this - I actually upgraded all internet speeds - got 30 mbps dedicated internet connection at work, 24 mbps broadband at home, and now its 50% better but still would like to know proper solution.

 

If you can reduce the wait by increasing bandwidth it wouldn't appear to be the same issue that I had. Are you sure that you haven't changed anything else at the same time as upgrading your connection speeds?

 

On another note, speaking of access folders - i got this thing which concerns me - all users can find out the server ip address from doing ipconfig and then since all are administrators on their local computers, they can go to start - run - type in the ip address of the DC server where all the users folders are also, and then the server opens showing all the shared folders, whereas before on Server 2003, all of them still had to type in the username and password to do so - can i disable them see server files through group policy?

 

You could try disabling the computer browser service, but if you have services which depend on netbios lookups working (e.g. CC3 build process) then that will cause problems. I would think the behaviour you now have is correct, more surprised that it would ask for credentials on Server 2003.

 

A better bet would be looking at 'Access Based Enumeration' for the shares or as a last resort just put a $ on the share names to make them hidden. If you've got an Samba shares you can make them hidden without the $ by changing the config.

[vikpaw]

That is my thinking and I'd rather go for extra layers of protection. The only server that I can't use the firewall on at the moment is the SIMS server, the SIMS application fails to login with reason '0'. I've opened the default SQL port but it still doesn't connect. Don't suppose you know which ports should be open? Everyone else I speak to normally has the firewalls off.

 

I just had this issue, and eventually sussed it out with help from various places, none of the solutions on here or elsewhere worked.

 

Windows Server 2008 R2, with SQL 2008 R2:

 

Allowed 2 inbound rules through the firewall, specifically for application, rather than any particular port and all works fine:

 

%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.SIMS2008\MSSQL\Binn\sqlservr.exe

 

and

 

%ProgramFiles% (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

I'd tried the first exception but didn't see the location of sqlbrowser as it was in the (x86) folder, so was fiddling with other ports.

 

The browser service eliminates the need for specifying a particular port.

 

At least it works now with firewall enabled. In fact it works with only the second rule in place, but i haven't got time to test everything again, so leaving the first one in for now.

[morganw]

Thanks, I did actually get this working a couple of weeks ago with the help from our local sims support. I was missing the exception for the SQL browser executable as I couldn't find it anywhere. Thanks for the confirmation that this is the problem though.

[gshaw]

Was just about to make a thread about this as I'm experiencing similar delays... so far have noticed this...

 

- two UNC shares, one with ABE enabled one without

- on Windows 7 all shares open quickly

- on Windows XP SP3 there's a 10-20 second delay before the share opens

- if I send the UNC path in an email it opens quickly on both OS

 

As per some of the links I've seen so far, turned off the firewall on the 2008 R2 box et voila everything quick again.

 

The weird thing is that once you've accessed the share once it stays quick even after PC reboot so suggests something on the server side. Tried restarting the Server and Windows Firewall services (and then tried reboot) to see if that flushes anything out but the client stays quick.

 

At first I thought it might just be a first-time connection issue but one of our users testing the share has had it happen a couple of times so maybe it takes a while to time out?

 

This server goes live in the next week or so, would prefer to keep Firewall on but if it's causing problems I'll have to turn it off. Noticed something about disabling WebClient so may try that next. Any further input much appreciated...

 

Edit: looks like disabling WebClient on XP seems to bring everything back to a normal speed...

Edited December 13, 2011 by gshaw