Unexpected Network Errors on SMB Connections with Windows 2000 Clients (311563)

SYMPTOMS

When you try to gain access to a file on a network share from your Windows 2000-based client that is connected to a Windows 2000-based server, you may receive one of the following error messages:

ERROR_INVALID_HANDLE

0xC0000008 STATUS_INVALID_HANDLE

The preceding error messages that are returned to the program are Microsoft Windows NT error 6 or Windows NT status code 8, which both map to "Invalid File Handle." For example, in a Network Monitor (Netmon.exe) trace you can see " SMB: R transact2 - NT error, System, Error, Code = (8) STATUS_INVALID_HANDLE" or one of the following error messages:

SMB: R logoff & X - Server Error, (91) Invalid user identifier

- STATUS_UNEXPECTED_NETWORK_ERROR (0xc00000c4 hexadecimal)
- ERROR_UNEXP_NET_ERR (error 59 in decimal or 0x3b in hexadecimal)
- STATUS_CONNECTION_DISCONNECTED (0xc000020c hexadecimal)
- ERROR_NETNAME_DELETED (error 64 in decimal or 0x40 in hexadecimal)

CAUSE

This problem may occur when a Windows 2000 client tries to establish a new SMB session to a Windows 2000 server (by using NetBIOS Port 139 or Direct Hosting Port 445 by using VC 0) while an old session (by using NetBIOS Port 139 or Direct Hosting Port 445) is still active. This causes the old session to be reset by the server.

In Netmon.exe you can see that a RESET for an existing TCP and SMB session is initiated from the Windows 2000 server immediately after a new SMB session setup within a new TCP session is initiated by the Windows 2000 client

SMB: C session setup & X

with:

SMB: VC number = 0

You can see the VC number only in the session_setup_and_X frame.

In the new TCP session, you can then see one of the error messages that is listed in the "Symptoms" section of this article occurs as soon as you try to gain access to an open file that has been opened in the previous reset session.

The old session is reset by the Windows 2000 server only as soon as the client uses SMB VC = 0 in a new SMB connection.

New SMB connections to the same Windows 2000 server may be intentionally made by the user, or for any of the following reasons:

To run a DFS discovery every 15 minutes, the TCP session is opened only for DFS Referrals.For additional information about related behavior, click the article number below to view the article in the Microsoft Knowledge Base:
265395 Windows 2000 Member Runs Discovery Every 15 Minutes with Possible High Dial-on-Demand Line Costs
To check changes in Group Policy settings (in intervals of about 1.5 hours). For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
291377 Policy to Control the Frequency of Windows XP Client DFS Queries
Browser list exchange traffic (every 12 minutes).