Windows Explorer and SMB Traffic

Server Message Block (SMB) traffic is an application-level network protocol typically used for file and print sharing.  Microsoft implements SMB in Windows operating systems through the Workstation and Server services; the client and server components respectively.  Although our Networking team supports and troubleshoots issues dealing with SMB itself and the Server and Workstation services, we work with customers on many issues relating to the behavior of Windows Explorer and the Shell. 

By default, Windows Explorer generates a lot of SMB traffic - which can result in poor file server performance in some circumstances.  However, some of this traffic is superfluous and can be reduced - for example:

• Searches for Desktop.ini files used for folder customization
• Periodic refreshes of folder contents
• Searches for supporting library (.dll) files
• Individual file details and attributes pulled for each file
• Thumbnail extraction

There are some registry changes you can implement to optimize the SMB traffic being generated.  Import the settings below on client machines.  Terminal Servers running in Application Mode should be considered client machines in this scenario.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"UseDesktopIniCache"=dword:00000001
"NoRemoteRecursiveEvents"=dword:00000001
"NoRemoteChangeNotify"=dword:00000001
"StartRunNoHOMEPATH"=dword:00000001
"NoRecentDocsNetHood"=dword:00000001
"NoDetailsThumbnailOnNetwork"=dword:00000001
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MRXSmb\Parameters]
"InfoCacheLevel"=dword:00000010
[HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\CryptoSignMenu]
"SuppressionPolicy"=dword:00100000
[HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32}]
"SuppressionPolicy"=dword:00100000
[HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\{883373C3-BF89-11D1-BE35-080036B11A03}]
"SuppressionPolicy"=dword:00100000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SCAPI]
"Flags"=dword:00100c02
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"SafeDllSearchMode"=dword:00000001
"SafeProcessSearchMode"=dword:00000001

• If you use DFS in the environment, Windows XP and Windows Server 2003 clients should be updated with the Hotfix from KB 915377 to prevent excessive "Get_DFS_Referrals" traffic.
• If you use Trend Micro Antivirus software on your client machines, and you notice an unusual amount of SMB traffic to your file server that is causing high CPU utilization and possibly a high handle count in the System process, you should review the information in KB Article 941756

As an aside, there is a major revision of the SMB protocol implemented in Windows Vista.  This revision is identified as SMB 2.0.  Some of the key enhancements of SMB 2.0 include the following:

• Support for an arbitrary, extensible way to compound operations to reduce round trips.  This makes the protocol less "chatty" when compared to SMB 1.0.
• Support for much larger buffer sizes
• Greater scalability
• Increase in the number of concurrent open file handles
• Durable handles that can withstand short network "glitches"
• Support for Symbolic Links

There's a more detailed post about SMB 2.0 over at the ChkDsk Blog.

That brings us to the end of this post.  As always, there are additional resources below and as you can see there are quite a few KB Articles regarding SMB and Windows Explorer ...

Additional Resources:

• KB 908590: A program may run slowly if the network connection to your home folder is slow
• KB 889588: How to optimize Office Access and Jet database engine network performance
• KB 885189: Slow performance when you use a mapped drive to copy files to a remote server
• KB 840309: Browsing the "My Documents" folder on Windows XP than in earlier versions of Windows
• KB 831129: Folder tree flickers when you view a mapped network driver in Explorer
• KB 830903: A file in a network folder opens as read-only or returns an error message
• KB 829700: Slow Network Performance when you open a file located on a shared network folder
• KB 819108: Settings for minimizing periodic WAN Traffic
• KB 816375: Windows XP Explorer Pane flickers on mapped network drives
• KB 330929: Windows XP may cause extra SMB Notify Change Traffic
• KB 328170: Program opens a file as read-only or returns a sharing violation or "access denied" message when opening from or saving to a network folder
• KB 321126: The "Look In" and "Save" As" Boxes in Common Dialog boxes are slow
• KB 306850: Programs start slowly / Slow logon if the network connection to your home folder is slow
• KB 265396: Slow network performance occurs when you select a file on a share that uses NTFS
• KB 264061: Home Folder is searched first when you try to run a program
• KB 242578: How to Prevent Network Share shortcuts from being added to My Network Places

- Aaron Maxwell

UPDATE:

8/23/08: Updated article with new Hotfix Request process