Server 2019 SMB Share EXE Files Slower Than Server 2008 – Solutions

windowswindows-server-2019

I am migrating a server from physical Server 2008 R2 over to a physical, scratch build Server 2019 Standard GUI.

Bottom line up front: EXE files are slow to run or checking the properties of the file when accessed through an UNC path or mapped drive. If it's moved to the workstation or ran locally on the server, it is not. I had all the stuff below typed up before realizing it only affected EXE files. I created a 0 KB text file on the share and opened the properties instantly. Renamed it from TXT to EXE and had a 5-6 second delay opening the properties.

We are running into an issue with a 3rd party application that connects to a Gupta SQL database specifically, but manifests itself with most any EXE file we run from a share path. Even viewing the properties of an EXE file can take 3-5 seconds to pop up on the new server while the old is near instant. PDF's and other document file types run relatively quickly.

The vendor for the 3rd party app tried everything they can think of and we are at a standstill.

Clients are Windows 7 Pro and Windows 10. No lingering updates on clients or server. SMB1 is disabled on both client and new server. Old server has SMB1 enabled but packet traces show SMB2 is being used.

New Server Specs:
Intel 2.1 Ghz (2×8 cores), RAM 32G, HDD: 744 GB 6Gbps SSD

Old Server Specs:
Intel 2.4 Ghz (2×8 cores), RAM 16G, HDD: 256 GB 6Gbps SATA

Both RAID 1-0

Things I've tried or noticed

  1. The SQL queries and actions within those screens is fast. I also
    noticed something as simple as opening the properties of the EXE
    file on the new server is 4-5 seconds longer than on the old server,
    which is near instant.

  2. Windows firewall is off on both client and server. Virus protection
    (MS Security Essentials, Defender) are off on both client and server
    to rule that out. I compared the advanced settings of the NIC cards
    on both servers and they match with the exception of Largesend and TCP/UDP Checksum offload. Those are disabled on the Server 2019 as there is apparently issues with those settings on Broadcom NIC's. They were enabled previously but disabled them for testing. UAC is all the way to the lowest setting on both client and servers.

  3. The file server part has already been migrated and SMB is fast
    compared to the old server. I am getting 10Mbps copying files from
    the new server to my desktop and 5 Mbps from the old server to the
    desktop.

  4. We have QuickBooks running locally on one workstation and pointing
    to a QB database on a share and it runs fast and smooth.

  5. The Resource Monitor shows a spike of about 1 Mbps on the network
    interface, but doesn't really move anything else.

  6. I've plugged my laptop directly into 2nd NIC on the server to
    eliminate layer 1/2 being the problem. Also used different network
    cables to make sure.
  7. I've checked the GPO and local policies about making sure things are
    signed, it is disabled. I've checked the various registry entries
    under HKLM/…/Lanman* for file server tuning and they don't exist.
  8. Wireshark shows some TCP retransmissions on the new server that I do
    not see on the older server when going through the normal network.
    Looking at the SMB2 statistics you can see the delay is almost a
    minute on the new server and old server, doing the same action. One thing I have noticed is the window size on the new
    server is
    really large compared to the old. The old is consistently 256 while
    the new is 4100+.
  9. Using the IP address to map the shares or access the UNC path to eliminate DNS being the issue.

SMB2 Trace
Old Server TCP Trace
New Server TCP Trace

Best Answer

It was MalwareBytes Cloud. Even with a whitelist entry for the path, EXE and local folder.