Server down : NTFS Shares

March 25, 2009 at 15:13:29
Specs: Windows 2003 Std, 2 GB
Since yesterday our file server (Windows 2k3 Std R2) has started playing up strangely, when users try to access their network drives from client (XP) computers using NTFS mapped shares \\servername\sharename\, after a while the whole share goes down and the client computer (explorer) times outs and crashes, at the same time if I log in to the server and try accessing those NTFS shares using local path (c:\folder name\file.file) the files open without any problem, looking at the windows sharing console you see a continuously increasing number of files being accessed by the same user. i.e., user1 has accessed \\server\share\user1\file.file has 25 sessions open. And they keep increasing. Looks like the XP computer continuously try accessing that file. There is no error entries in event manager.

This has been driving me nuts all day n night, and could be very simple or very complicated. Any clues ???


See More: Server down : NTFS Shares

Report •


#1
March 25, 2009 at 15:14:50
Better run AV software. Almost sounds like conflicker.

"Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10


Report •

#2
March 25, 2009 at 17:50:12
That;s already in place but I still haven;t been able to find the actual cause of the issue. In fact the server is healthy until some users start accessing the file shares and then after a shile the cleint PC's start crashing, once again; if I log on to the server via RDP I can browse to disks fine using local path. I have done disk Chk, Defrag, scan for visrus etc and there is no trace of any problem.

Report •

#3
March 25, 2009 at 18:16:22
Oh, guess you could re-check time settings.

Check that the lan/wan isn't really the issue.

See event logs.

"Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10


Report •

Related Solutions

#4
March 26, 2009 at 04:43:10
The servrer has Sophos Ent Security AV installed which is picking up some viruses (mainly Mal/Autoinf-A) which comes back even after you clean/delete it.

I am not happy the way sophos handles these viruses, do you guys recommend any application (antivirus, anti-spyware) to keep my server safe. Please note it's a Windows 2003 Std x86 file server + DC.


Report •

#5
March 26, 2009 at 08:00:22
If the virus keeps coming back that is not the fault of a AV company but of your local security setup. You need to ask yourself how your server is getting infected to start with.

How is internet/email coming in to you?

BTW there is no such thing as a ntfs share. You can share from any of the many MS supported file systems.


Report •

#6
March 26, 2009 at 14:04:09
You need to disable all lan traffic. Sweep each machine, each usb drive and everyone's flash.
See lsass.exe in users logon in documents and settings folder. Rename to lsass.exe old. Do that to all users. Regedit out all lsass.exe in users (be careful lsass.exe is real file only in users) Reboot.

See how to diable autorun in registry also.

On everyones flash drive make a hidden folder named autorun.inf and maybe start.exe or whatever other file is named in the bad autorun.inf file.

Might need to clean install all machines and update all hotfixes and service packs. Reload all av an malware

Then put back on line and hope best practices prevent this again.

"Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10


Report •


Ask Question