Slow SMB performance when you copy files from Windows XP to a Windows 2000 domain controller (321169)

Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

You may notice slow copy performance when you copy files from a Windows XP-based client computer to a Windows 2000-based domain controller (when you use the Server Message Block [SMB] protocol). This slow performance occurs only when you copy files from a Windows XP-based client to a Windows 2000-based domain controller (push mode) and not when you copy files from the domain controller to the client (get mode).

CAUSE

The slow SMB performance may occur if a delayed TCP/IP acknowledgement (also known as a TCP ACK) occurs in a "SMB: C NT transact - Notify Change" packet. Typically, this issue occurs if you use Windows Explorer to copy the files to a domain controller. However, this issue may also occur if you use a command prompt to copy files or if the focus is on the destination folder in Windows Explorer (when the Change notification is involved). This issue occurs as soon as you perform an SMB copy procedure (from any program) to a remote target folder that has been also invoked by a "change notification" request (from any program).

By default, this behavior occurs as soon as SMB is using security signatures. If security signatures are configured, SMB must be processed synchronously by the redirector. The redirector has to wait until the current SMB command is fully processed before it continues with the next one. The redirector waits until it receives the TCP/IP acknowledgement from server.

RESOLUTION

To work around this issue, use either of the workarounds that are described in this section.

Workaround 1

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\System\Current ControlSet\Services\LanmanServer\Parameters
Double-click the RequireSecuritySignature value, type 0 in the Value data box, and then click OK.
Double-click the EnableSecuritySignature value, type 0 in the Value data box, and then click OK.
Quit Registry Editor.

By default, the EnableSecuritySignature value is set to 1 (ON) on a domain controller and is set to 0 (OFF) on a non-domain controller. As a result, slow SMB copy performance only occurs when you copy items to a domain controller.

Workaround 2

Note This workaround is not supported on Windows XP-based and Windows Server 2003-based computers.

Toggle the TCP delayed ACK timer (TcpDelAckTicks) to a lower value. When you do so, the server acknowledges items more frequently but at shorter intervals. You can use hotfix that is described in the following Microsoft Knowledge Base article to specify a custom delayed ACK value:

311833 The TcpDelAckTicks Registry Value Has No Effects on Ack Timeouts

If you set the TcpDelAckTicks value to 0, you turn the timer off completely. When the timer is turned off, TCP reverts to pre-Request for Comments (RFC) 1122 behavior; it acknowledges each packet. This workaround solves the SMB copy performance issue. However, on a high latency network (highly saturated segment), this behavior increases the number of acknowledgements from the domain controller and puts additional strain on the network.

MORE INFORMATION

To see how the slow performance is related to TCP/IP acknowledgement of some SMB frames ("SMB: C NT transact - Notify Change"), perform a network trace. If you do so, you see that the redirector does not continue with the rest of the copy operations when the "SMB: C NT Transact - Notify Change" frame is not acknowledged by the server at the TCP transport level. The TCP/IP acknowledgement is only delayed (for about 0.2 seconds) when the server is a Windows 2000-based domain controller.

On a Windows XP-based client or on a Microsoft Windows Server 2003-based client, there is a new registry key named TcpAckFrequency that controls TCP ACKs before the delayed ACK timer is reached.

For more information about this problem, click the following article numbers to view the articles in the Microsoft Knowledge Base:

321098 Slow network performance occurs if you copy files to a domain controller that is running Windows 2000 or Windows Server 2003

328890 New Registry Entry for Controlling the TCP Acknowledgment (ACK) Behavior in Windows XP and in Windows Server 2003