Microsoft KB Archive/923360

= You may experience various problems when you work with files over the network on a Windows Server 2003-based or Windows 2000 Server-based computer =

Article ID: 923360

Article Last Modified on 9/20/2006

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server

-



SYMPTOMS
On a Microsoft Windows Server 2003-based or Microsoft Windows 2000 Server-based computer, you may experience one or more of the following symptoms when you work with files over the network:  A Windows-based file server that is configured as a file and print server stops responding. Then, the file and print server functionality temporarily stops. You experience a long delay when you open, save, close, delete, or print files that are located on a shared resource. You experience a temporary decrease in performance when you use a program over the network. Typically, performance is slow for approximately 40 to 45 seconds. However, some delays may last up to 5 minutes. You experience a delay when you copy a file copy or when you perform backup operations. When you connect to a shared resource, Windows Explorer either stops responding or you see a red X on the connected network drive. A program stops responding that either uses remote procedure call (RPC) or that uses named pipes to connect to a file server.  The server temporarily stops responding and one or more event ID messages that resemble the following messages appear in the System log on the file server: Event ID: 2022 Source: Srv Type: Error Description: Server was unable to find a free connection times in the last seconds. <pre class="fixed_text">Event ID: 2021 Source: Srv Type: Error Description: Server was unable to create a work item times in the last seconds. <pre class="fixed_text">Event ID: 2020 Source: Srv Type: Error Description: The server was unable to allocate from the system paged pool because the pool was empty. <pre class="fixed_text">Event ID: 2019 Source: Srv Type: Error Description: The server was unable to allocate from the system nonpaged pool because the pool was empty. <pre class="fixed_text">Event ID: 2510 Source: Server Event Type: Error Description: The server service was unable to map error code 1722. Additionally, the following event may appear in the System log on the client computer: <pre class="fixed_text">Event ID: 3013 Event Type: Error Event Source: MrxSmb / Rdr Description: The redirector has timed out a request to <ComputerName>. </li> You receive one of the following error messages when you try to connect to a shared resource:

System error 53. The network path was not found. (ERROR_BAD_NETPATH)

System error 64. The specified network name is no longer available. (ERROR_NETNAME_DELETED)

</li> You are intermittently disconnected from network resources, and you cannot reconnect to the network resources on the file server. However, you can ping the server, and you can use a Terminal Services session to connect to the server.</li> If multiple users try to access Microsoft Office documents on the server, the File is locked for editing dialog box does not always appear when the second user opens the file.</li> A network trace indicates that there is a 30 to 40 second delay between a server message block (SMB) Service client command and a response from the file server.</li> In Windows Server 2003 and Windows 2000 Service Pack 4 (SP4), the server may stop responding arbitrarily.</li> When you try to open a Microsoft Access 2.0 database file (.mdb) in Microsoft Access 97, Access 2000, or Access 2002, you may receive an error message that resembles the following:

Disk or network error.

</li> When you open Microsoft Excel, you may receive the following error message:

file has not been saved.

</li> When you open Windows Explorer, you may receive the following error message:

Cannot access .The session was canceled.

</li> When you open a Microsoft Word file, Word may fail. Then, you may receive the following error message:

Word failed reading from this file. Please restore the network connection or replace the floppy disk and retry.

Additionally, after you restore the network connection and you click OK, you receive the following error message:

Word has lost data because of a bad network connection or missing floppy. Documents relying on this data will be saved and then closed.

</li></ul>

<div class="cause_section">

CAUSE
These problems may occur when one of the following conditions is true:
 * The version of Symantec Event Handler driver (Symevent.sys) is outdated. Therefore, two or more threads are deadlocked in the Symevent.sys driver in the Symevent_GetSubTask function.
 * There is a Computer Associates (CA) INO_FLTR.SYS OpLock interoperability problem with the Srv.sys file.

<div class="resolution_section">

RESOLUTION
To resolve these problems, update the third-party antivirus file system filter driver. For example, if you have the Symantec Event Handler driver (SymEvent.sys) installed on the computer, update to version 11.6.4.1 or a later version. To obtain an updated version of the Symevent.sys file or to find help with the reconfiguration, visit the following Symantec Web site:

http://www.symantec.com

Note The SymEvent.sys file version 11.6.4.2 has a bug that can make some servers restart arbitrarily. For information about how to contact Symantec, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and software vendor contact information, A-K

60781 Hardware and software vendor contact information, L-P

60782 Hardware and software vendor contact information, Q-Z

<div class="moreinformation_section">

MORE INFORMATION
All the error messages that are mentioned in the &quot;Symptoms&quot; section point to failing SMB connections. These failing connections can be network related. Or the failing connections can occur when the server stops responding arbitrarily.

The following antivirus driver versions can also cause servers to stop responding: <ul> The problem is known to occur when the following driver versions are installed on the file server.

These versions that are installed with Symantec Antivirus 9.0.

The following Web page on the Symantec Web site (Symantec Document ID: 2005062909055948 ) describes how to update the Symevent files:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/1998092408260848?Open&src=&docid=2005081909325748&nsf=ent-security.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=&seg=

</li> The problem is known to occur when the following CA eTrust Antivirus/InoculateIT File System Filter Driver versions are installed on the file server.

The following Web page on the Computer Associates Web site references the problem:

http://supportconnectw.ca.com/premium/antivirus/downloads/nt/4.5/DriverFix.asp

</li></ul>

If you investigate network traces, you may find that the file server does not answer SMB requests. For example, after you perform a network track operation, you receive the following code: 15:28:14 client -> server SMB Read AndX Request, FID 0x0002 15:28:14  server -> client  TCP [ACK] After approximately 45 seconds, the client computer ends the TCP Session (FIN), and then the server sends a &quot;[FIN ACK].&quot; After you perform the network track operation, you receive the following code: 15:29:05 client  -> server TCP [FIN ACK] 15:29:05  server -> client  TCP [FIN ACK] In such traces, you can see that the server does not answer to the SMB request. However, the server still sends a TCP acknowledgement for the client computer request. This means that the server service on the Windows-based file server is unresponsive to SMB requests. This also means that network connectivity is not the cause of the problem.

<div class="references_section">