Really slow SMB transfers, event log full of EFS problems.

Hello,

Since a couple of days, my users and I have noticed a considerable slowdown
on SMB transfers. Event 6032 from EFS is logged around 40 times per minute.
The event is: EFS does not support encryption over network sessions
established using the NTLM protocol.

I have setup an ftp on my server to test if it was a network problem, and
the strangest thing happened. If I download a 100MB file to my station using
SMB, it takes up to 8 min. If I download the same file using ftp it take 4
sec. If I download the file using SMB and at the same time I download it
using FTP, the SMB transfers burst during the FTP transfer and slows down
once I am done.

Some of my users are using EFS on their laptops but the problem is not
happening when trying to access encrypted files. No error message is
displayed on the client computers. No other event is logged on. I did not
change anything on my controlers.

We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
patched.

I find almost no reference to event id 6032 on google...

Thanks in advance for your help!

Etienne

I had a similar problem once that was solved by turning off QoS on my NIC. I'd
also fire up a sniffer (Wireshark) and find out what exactly is going on.

"Etienne Ringuet" <Etienne (E-Mail Removed)> wrote in message
news:7708DB26-8163-42FE-A9E0-(E-Mail Removed)...
> Hello,
>
> Since a couple of days, my users and I have noticed a considerable slowdown
> on SMB transfers. Event 6032 from EFS is logged around 40 times per minute.
> The event is: EFS does not support encryption over network sessions
> established using the NTLM protocol.
>
> I have setup an ftp on my server to test if it was a network problem, and
> the strangest thing happened. If I download a 100MB file to my station using
> SMB, it takes up to 8 min. If I download the same file using ftp it take 4
> sec. If I download the file using SMB and at the same time I download it
> using FTP, the SMB transfers burst during the FTP transfer and slows down
> once I am done.
>
> Some of my users are using EFS on their laptops but the problem is not
> happening when trying to access encrypted files. No error message is
> displayed on the client computers. No other event is logged on. I did not
> change anything on my controlers.
>
> We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
> patched.
>
> I find almost no reference to event id 6032 on google...
>
> Thanks in advance for your help!
>
> Etienne
>
>

thanks for your answer but I don't think this is related.

Etienne

"Mike Lowery" wrote:

> I had a similar problem once that was solved by turning off QoS on my NIC. I'd
> also fire up a sniffer (Wireshark) and find out what exactly is going on.
>
> "Etienne Ringuet" <Etienne (E-Mail Removed)> wrote in message
> news:7708DB26-8163-42FE-A9E0-(E-Mail Removed)...
> > Hello,
> >
> > Since a couple of days, my users and I have noticed a considerable slowdown
> > on SMB transfers. Event 6032 from EFS is logged around 40 times per minute.
> > The event is: EFS does not support encryption over network sessions
> > established using the NTLM protocol.
> >
> > I have setup an ftp on my server to test if it was a network problem, and
> > the strangest thing happened. If I download a 100MB file to my station using
> > SMB, it takes up to 8 min. If I download the same file using ftp it take 4
> > sec. If I download the file using SMB and at the same time I download it
> > using FTP, the SMB transfers burst during the FTP transfer and slows down
> > once I am done.
> >
> > Some of my users are using EFS on their laptops but the problem is not
> > happening when trying to access encrypted files. No error message is
> > displayed on the client computers. No other event is logged on. I did not
> > change anything on my controlers.
> >
> > We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
> > patched.
> >
> > I find almost no reference to event id 6032 on google...
> >
> > Thanks in advance for your help!
> >
> > Etienne
> >
> >
>
>
>

Mike: I wonder if using a sniffer on the interface can be done while the
system is in production?

Etienne

"Etienne Ringuet" wrote:

> thanks for your answer but I don't think this is related.
>
> Etienne
>
> "Mike Lowery" wrote:
>
> > I had a similar problem once that was solved by turning off QoS on my NIC. I'd
> > also fire up a sniffer (Wireshark) and find out what exactly is going on.
> >
> > "Etienne Ringuet" <Etienne (E-Mail Removed)> wrote in message
> > news:7708DB26-8163-42FE-A9E0-(E-Mail Removed)...
> > > Hello,
> > >
> > > Since a couple of days, my users and I have noticed a considerable slowdown
> > > on SMB transfers. Event 6032 from EFS is logged around 40 times per minute.
> > > The event is: EFS does not support encryption over network sessions
> > > established using the NTLM protocol.
> > >
> > > I have setup an ftp on my server to test if it was a network problem, and
> > > the strangest thing happened. If I download a 100MB file to my station using
> > > SMB, it takes up to 8 min. If I download the same file using ftp it take 4
> > > sec. If I download the file using SMB and at the same time I download it
> > > using FTP, the SMB transfers burst during the FTP transfer and slows down
> > > once I am done.
> > >
> > > Some of my users are using EFS on their laptops but the problem is not
> > > happening when trying to access encrypted files. No error message is
> > > displayed on the client computers. No other event is logged on. I did not
> > > change anything on my controlers.
> > >
> > > We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
> > > patched.
> > >
> > > I find almost no reference to event id 6032 on google...
> > >
> > > Thanks in advance for your help!
> > >
> > > Etienne
> > >
> > >
> >
> >
> >

Yes it can. Better yet, use another PC on the LAN to do the sniffing with.

"Etienne Ringuet" <(E-Mail Removed)> wrote in message
news:1E0C0CE3-7948-400A-ACCC-(E-Mail Removed)...
>
> Mike: I wonder if using a sniffer on the interface can be done while the
> system is in production?
>
> Etienne
>
> "Etienne Ringuet" wrote:
>
>> thanks for your answer but I don't think this is related.
>>
>> Etienne
>>
>> "Mike Lowery" wrote:
>>
>> > I had a similar problem once that was solved by turning off QoS on my NIC.
>> > I'd
>> > also fire up a sniffer (Wireshark) and find out what exactly is going on.
>> >
>> > "Etienne Ringuet" <Etienne (E-Mail Removed)> wrote in
>> > message
>> > news:7708DB26-8163-42FE-A9E0-(E-Mail Removed)...
>> > > Hello,
>> > >
>> > > Since a couple of days, my users and I have noticed a considerable
>> > > slowdown
>> > > on SMB transfers. Event 6032 from EFS is logged around 40 times per
>> > > minute.
>> > > The event is: EFS does not support encryption over network sessions
>> > > established using the NTLM protocol.
>> > >
>> > > I have setup an ftp on my server to test if it was a network problem, and
>> > > the strangest thing happened. If I download a 100MB file to my station
>> > > using
>> > > SMB, it takes up to 8 min. If I download the same file using ftp it take
>> > > 4
>> > > sec. If I download the file using SMB and at the same time I download it
>> > > using FTP, the SMB transfers burst during the FTP transfer and slows down
>> > > once I am done.
>> > >
>> > > Some of my users are using EFS on their laptops but the problem is not
>> > > happening when trying to access encrypted files. No error message is
>> > > displayed on the client computers. No other event is logged on. I did not
>> > > change anything on my controlers.
>> > >
>> > > We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
>> > > patched.
>> > >
>> > > I find almost no reference to event id 6032 on google...
>> > >
>> > > Thanks in advance for your help!
>> > >
>> > > Etienne
>> > >
>> > >
>> >
>> >
>> >

I finally fixed the problem.

I also had event 1517 from userenv in my application log. It is common on
workstations but from what I've learn it is rare on servers.

Anyway, I finally found this article:

http://support.microsoft.com/kb/900613

I contacted Microsoft to get the hotfix, made my backups and tried it. Now
my logs are clean and the performance is back.

YAY.

Etienne

"Mike Lowery" wrote:

> Yes it can. Better yet, use another PC on the LAN to do the sniffing with.
>
> "Etienne Ringuet" <(E-Mail Removed)> wrote in message
> news:1E0C0CE3-7948-400A-ACCC-(E-Mail Removed)...
> >
> > Mike: I wonder if using a sniffer on the interface can be done while the
> > system is in production?
> >
> > Etienne
> >
> > "Etienne Ringuet" wrote:
> >
> >> thanks for your answer but I don't think this is related.
> >>
> >> Etienne
> >>
> >> "Mike Lowery" wrote:
> >>
> >> > I had a similar problem once that was solved by turning off QoS on my NIC.
> >> > I'd
> >> > also fire up a sniffer (Wireshark) and find out what exactly is going on.
> >> >
> >> > "Etienne Ringuet" <Etienne (E-Mail Removed)> wrote in
> >> > message
> >> > news:7708DB26-8163-42FE-A9E0-(E-Mail Removed)...
> >> > > Hello,
> >> > >
> >> > > Since a couple of days, my users and I have noticed a considerable
> >> > > slowdown
> >> > > on SMB transfers. Event 6032 from EFS is logged around 40 times per
> >> > > minute.
> >> > > The event is: EFS does not support encryption over network sessions
> >> > > established using the NTLM protocol.
> >> > >
> >> > > I have setup an ftp on my server to test if it was a network problem, and
> >> > > the strangest thing happened. If I download a 100MB file to my station
> >> > > using
> >> > > SMB, it takes up to 8 min. If I download the same file using ftp it take
> >> > > 4
> >> > > sec. If I download the file using SMB and at the same time I download it
> >> > > using FTP, the SMB transfers burst during the FTP transfer and slows down
> >> > > once I am done.
> >> > >
> >> > > Some of my users are using EFS on their laptops but the problem is not
> >> > > happening when trying to access encrypted files. No error message is
> >> > > displayed on the client computers. No other event is logged on. I did not
> >> > > change anything on my controlers.
> >> > >
> >> > > We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
> >> > > patched.
> >> > >
> >> > > I find almost no reference to event id 6032 on google...
> >> > >
> >> > > Thanks in advance for your help!
> >> > >
> >> > > Etienne
> >> > >
> >> > >
> >> >
> >> >
> >> >
>
>
>

Well, my problem isn't solved. It's back after two days working.

I am still clueless.

Any help would be appreciated.

Etienne

"Etienne Ringuet" wrote:

> I finally fixed the problem.
>
> I also had event 1517 from userenv in my application log. It is common on
> workstations but from what I've learn it is rare on servers.
>
> Anyway, I finally found this article:
>
> http://support.microsoft.com/kb/900613
>
> I contacted Microsoft to get the hotfix, made my backups and tried it. Now
> my logs are clean and the performance is back.
>
> YAY.
>
> Etienne
>
> "Mike Lowery" wrote:
>
> > Yes it can. Better yet, use another PC on the LAN to do the sniffing with.
> >
> > "Etienne Ringuet" <(E-Mail Removed)> wrote in message
> > news:1E0C0CE3-7948-400A-ACCC-(E-Mail Removed)...
> > >
> > > Mike: I wonder if using a sniffer on the interface can be done while the
> > > system is in production?
> > >
> > > Etienne
> > >
> > > "Etienne Ringuet" wrote:
> > >
> > >> thanks for your answer but I don't think this is related.
> > >>
> > >> Etienne
> > >>
> > >> "Mike Lowery" wrote:
> > >>
> > >> > I had a similar problem once that was solved by turning off QoS on my NIC.
> > >> > I'd
> > >> > also fire up a sniffer (Wireshark) and find out what exactly is going on.
> > >> >
> > >> > "Etienne Ringuet" <Etienne (E-Mail Removed)> wrote in
> > >> > message
> > >> > news:7708DB26-8163-42FE-A9E0-(E-Mail Removed)...
> > >> > > Hello,
> > >> > >
> > >> > > Since a couple of days, my users and I have noticed a considerable
> > >> > > slowdown
> > >> > > on SMB transfers. Event 6032 from EFS is logged around 40 times per
> > >> > > minute.
> > >> > > The event is: EFS does not support encryption over network sessions
> > >> > > established using the NTLM protocol.
> > >> > >
> > >> > > I have setup an ftp on my server to test if it was a network problem, and
> > >> > > the strangest thing happened. If I download a 100MB file to my station
> > >> > > using
> > >> > > SMB, it takes up to 8 min. If I download the same file using ftp it take
> > >> > > 4
> > >> > > sec. If I download the file using SMB and at the same time I download it
> > >> > > using FTP, the SMB transfers burst during the FTP transfer and slows down
> > >> > > once I am done.
> > >> > >
> > >> > > Some of my users are using EFS on their laptops but the problem is not
> > >> > > happening when trying to access encrypted files. No error message is
> > >> > > displayed on the client computers. No other event is logged on. I did not
> > >> > > change anything on my controlers.
> > >> > >
> > >> > > We are using 1x SBS 2003 premium and 1x 2003 std, both systems are fully
> > >> > > patched.
> > >> > >
> > >> > > I find almost no reference to event id 6032 on google...
> > >> > >
> > >> > > Thanks in advance for your help!
> > >> > >
> > >> > > Etienne
> > >> > >
> > >> > >
> > >> >
> > >> >
> > >> >
> >
> >
> >