SMB Signing question, SBS2k

Is the SMB signing issue with XP PRO sp1 and SBS2k still an issue?

I thought I had the SMB issue fixed until this week. At a client's site, XP
Pro PCs with SP1 were working great with SBS2k.

Until yesterday, several users complained that copying file to the server
was now extremely slow.

I had an open issue with MS and had two patches they gave me, 825760,
826722, that resolved some of my Office 2000 issues with SBS2k/Win2k SP4.
And copies were fast and Word was crashing less often.

Now, the copying is slow again. I went searching, found KB 329170. But
825760 and 826722 have later file dates than 329170.

Yesterday, It would take 20 seconds to copy 200k. Not even a megabyte. But
only from XP Pro PCS. Win2k PCs were fine.

I tried the usual things prior to making the SMB change:

1)checked for spyware, none. Used adaware, Spybot, and Spysweeper

2)checked for viruses - none found. Definitions are the latest.

3)checked for any odd startup files using msconfig

4 )sp1 installed

5)all critical patches installed

6)server is virus free

7)server event viewer is clear of errors

8)hard coded the speed of the NIC but this did not make a difference,

Actually, when I hard coded the NICs at 100/full or 100/half, the copying
was worse

9)Verified in the advanced settings of my network were ok

10)DNS settings were correct in ipconfig /all.

I ended up doing the following. But why of all a sudden was this necessary?

The following resolved the problem, solution from Microsoft.


I did this first.

WORKAROUND
To work around this problem, use Group Policy settings to turn off SMB
signing. To do so, set the Default Domain Controller policy settings to
Disabled:
Click Start, point to Programs, point to Administrative Tools, and then
click Active Directory Users and Computers.
Right-click the Domain Controllers organizational unit, and then click
Properties.
Click the Group Policies tab.
Click Default Domain Controllers Policy, and then click Edit.
Go to the following location:
Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options
If any of the following policy settings are set to Enabled, double click the
setting, click to select the Define this policy setting check box, click
Disabled, and then click OK.

NOTE: By default, only one setting is set to Enabled.
Digitally sign client communication (always)
Digitally sign client communication (when possible)
Digitally sign server communication (always)
Digitally sign server communication (when possible)

I looked at my LANMANSERVER and LANMANWORKSTATION registry settings and
enablesecuritysignature and requiresecuritysignature are both 0 for all.
Which they should be after making the SBS server change.


I did this second.

Also, in DNS, changed "allow secure updates only" to "allow dynamic
updates."

I restarted the server twice and all workstations once.

What happened?

The copies are now fast like they were before. I wonder if the last set of
critical updates made things worse?

Is the SMB Issue there with SBS2003?


Thanks, all.

John

Susan
Sat May 01 00:54:55 CDT 2004

I've adjusted off the SMB signing on the SBS2k and will probably again
on SBS2k3 for exactly the speed issue. The file locking should go away
with those KBs.

John wrote:
> Is the SMB signing issue with XP PRO sp1 and SBS2k still an issue?
>
> I thought I had the SMB issue fixed until this week. At a client's site, XP
> Pro PCs with SP1 were working great with SBS2k.
>
> Until yesterday, several users complained that copying file to the server
> was now extremely slow.
>
> I had an open issue with MS and had two patches they gave me, 825760,
> 826722, that resolved some of my Office 2000 issues with SBS2k/Win2k SP4.
> And copies were fast and Word was crashing less often.
>
> Now, the copying is slow again. I went searching, found KB 329170. But
> 825760 and 826722 have later file dates than 329170.
>
> Yesterday, It would take 20 seconds to copy 200k. Not even a megabyte. But
> only from XP Pro PCS. Win2k PCs were fine.
>
> I tried the usual things prior to making the SMB change:
>
> 1)checked for spyware, none. Used adaware, Spybot, and Spysweeper
>
> 2)checked for viruses - none found. Definitions are the latest.
>
> 3)checked for any odd startup files using msconfig
>
> 4 )sp1 installed
>
> 5)all critical patches installed
>
> 6)server is virus free
>
> 7)server event viewer is clear of errors
>
> 8)hard coded the speed of the NIC but this did not make a difference,
>
> Actually, when I hard coded the NICs at 100/full or 100/half, the copying
> was worse
>
> 9)Verified in the advanced settings of my network were ok
>
> 10)DNS settings were correct in ipconfig /all.
>
> I ended up doing the following. But why of all a sudden was this necessary?
>
> The following resolved the problem, solution from Microsoft.
>
>
> I did this first.
>
> WORKAROUND
> To work around this problem, use Group Policy settings to turn off SMB
> signing. To do so, set the Default Domain Controller policy settings to
> Disabled:
> Click Start, point to Programs, point to Administrative Tools, and then
> click Active Directory Users and Computers.
> Right-click the Domain Controllers organizational unit, and then click
> Properties.
> Click the Group Policies tab.
> Click Default Domain Controllers Policy, and then click Edit.
> Go to the following location:
> Computer Configuration\Windows Settings\Security Settings\Local
> Policies\Security Options
> If any of the following policy settings are set to Enabled, double click the
> setting, click to select the Define this policy setting check box, click
> Disabled, and then click OK.
>
> NOTE: By default, only one setting is set to Enabled.
> Digitally sign client communication (always)
> Digitally sign client communication (when possible)
> Digitally sign server communication (always)
> Digitally sign server communication (when possible)
>
> I looked at my LANMANSERVER and LANMANWORKSTATION registry settings and
> enablesecuritysignature and requiresecuritysignature are both 0 for all.
> Which they should be after making the SBS server change.
>
>
> I did this second.
>
> Also, in DNS, changed "allow secure updates only" to "allow dynamic
> updates."
>
> I restarted the server twice and all workstations once.
>
> What happened?
>
> The copies are now fast like they were before. I wonder if the last set of
> critical updates made things worse?
>
> Is the SMB Issue there with SBS2003?
>
>
> Thanks, all.
>
> John
>
>
>
>
>
>

JohnJ
Sat May 01 12:24:18 CDT 2004

Thx, Susan. So far copies are very fast after the SMB fix. Microsoft states
that I should not have to do this that I am lowering my security for the
server but I don't see how I have a choice. I would think the SMB issue only
affects unix/Mac clients connecting to the SBS2k server, which I don't have
any. 329170 was supposed to resolve but it does not. I hope Win2k SP5
resolves it.
Regards,
John
"Susan Bradley, CPA aka Ebitz SBS Rocks [MVP] " <sbradcpa@pacbell.net> wrote
in message news:%23Ud$aD0LEHA.2632@TK2MSFTNGP09.phx.gbl...
> I've adjusted off the SMB signing on the SBS2k and will probably again
> on SBS2k3 for exactly the speed issue. The file locking should go away
> with those KBs.
>
> John wrote:
> > Is the SMB signing issue with XP PRO sp1 and SBS2k still an issue?
> >
> > I thought I had the SMB issue fixed until this week. At a client's site,
XP
> > Pro PCs with SP1 were working great with SBS2k.
> >
> > Until yesterday, several users complained that copying file to the
server
> > was now extremely slow.
> >
> > I had an open issue with MS and had two patches they gave me, 825760,
> > 826722, that resolved some of my Office 2000 issues with SBS2k/Win2k
SP4.
> > And copies were fast and Word was crashing less often.
> >
> > Now, the copying is slow again. I went searching, found KB 329170. But
> > 825760 and 826722 have later file dates than 329170.
> >
> > Yesterday, It would take 20 seconds to copy 200k. Not even a megabyte.
But
> > only from XP Pro PCS. Win2k PCs were fine.
> >
> > I tried the usual things prior to making the SMB change:
> >
> > 1)checked for spyware, none. Used adaware, Spybot, and Spysweeper
> >
> > 2)checked for viruses - none found. Definitions are the latest.
> >
> > 3)checked for any odd startup files using msconfig
> >
> > 4 )sp1 installed
> >
> > 5)all critical patches installed
> >
> > 6)server is virus free
> >
> > 7)server event viewer is clear of errors
> >
> > 8)hard coded the speed of the NIC but this did not make a difference,
> >
> > Actually, when I hard coded the NICs at 100/full or 100/half, the
copying
> > was worse
> >
> > 9)Verified in the advanced settings of my network were ok
> >
> > 10)DNS settings were correct in ipconfig /all.
> >
> > I ended up doing the following. But why of all a sudden was this
necessary?
> >
> > The following resolved the problem, solution from Microsoft.
> >
> >
> > I did this first.
> >
> > WORKAROUND
> > To work around this problem, use Group Policy settings to turn off SMB
> > signing. To do so, set the Default Domain Controller policy settings to
> > Disabled:
> > Click Start, point to Programs, point to Administrative Tools, and then
> > click Active Directory Users and Computers.
> > Right-click the Domain Controllers organizational unit, and then click
> > Properties.
> > Click the Group Policies tab.
> > Click Default Domain Controllers Policy, and then click Edit.
> > Go to the following location:
> > Computer Configuration\Windows Settings\Security Settings\Local
> > Policies\Security Options
> > If any of the following policy settings are set to Enabled, double click
the
> > setting, click to select the Define this policy setting check box, click
> > Disabled, and then click OK.
> >
> > NOTE: By default, only one setting is set to Enabled.
> > Digitally sign client communication (always)
> > Digitally sign client communication (when possible)
> > Digitally sign server communication (always)
> > Digitally sign server communication (when possible)
> >
> > I looked at my LANMANSERVER and LANMANWORKSTATION registry settings and
> > enablesecuritysignature and requiresecuritysignature are both 0 for all.
> > Which they should be after making the SBS server change.
> >
> >
> > I did this second.
> >
> > Also, in DNS, changed "allow secure updates only" to "allow dynamic
> > updates."
> >
> > I restarted the server twice and all workstations once.
> >
> > What happened?
> >
> > The copies are now fast like they were before. I wonder if the last set
of
> > critical updates made things worse?
> >
> > Is the SMB Issue there with SBS2003?
> >
> >
> > Thanks, all.
> >
> > John
> >
> >
> >
> >
> >
> >
>

Kevin
Sat May 01 15:29:52 CDT 2004

it's still an issue with SBS2003, and you still need to do the changes that
you did - at least I had to.

--
Kevin Weilbacher [SBS-MVP]
"The days pass by so quickly now, the nights are seldom long"


"John" <john@dontreply.net> wrote in message
news:5IDkc.6913$k24.4438@fed1read01...
> Is the SMB signing issue with XP PRO sp1 and SBS2k still an issue?
>
> I thought I had the SMB issue fixed until this week. At a client's site,
XP
> Pro PCs with SP1 were working great with SBS2k.
>
> Until yesterday, several users complained that copying file to the server
> was now extremely slow.
>
> I had an open issue with MS and had two patches they gave me, 825760,
> 826722, that resolved some of my Office 2000 issues with SBS2k/Win2k SP4.
> And copies were fast and Word was crashing less often.
>
> Now, the copying is slow again. I went searching, found KB 329170. But
> 825760 and 826722 have later file dates than 329170.
>
> Yesterday, It would take 20 seconds to copy 200k. Not even a megabyte.
But
> only from XP Pro PCS. Win2k PCs were fine.
>
> I tried the usual things prior to making the SMB change:
>
> 1)checked for spyware, none. Used adaware, Spybot, and Spysweeper
>
> 2)checked for viruses - none found. Definitions are the latest.
>
> 3)checked for any odd startup files using msconfig
>
> 4 )sp1 installed
>
> 5)all critical patches installed
>
> 6)server is virus free
>
> 7)server event viewer is clear of errors
>
> 8)hard coded the speed of the NIC but this did not make a difference,
>
> Actually, when I hard coded the NICs at 100/full or 100/half, the copying
> was worse
>
> 9)Verified in the advanced settings of my network were ok
>
> 10)DNS settings were correct in ipconfig /all.
>
> I ended up doing the following. But why of all a sudden was this
necessary?
>
> The following resolved the problem, solution from Microsoft.
>
>
> I did this first.
>
> WORKAROUND
> To work around this problem, use Group Policy settings to turn off SMB
> signing. To do so, set the Default Domain Controller policy settings to
> Disabled:
> Click Start, point to Programs, point to Administrative Tools, and then
> click Active Directory Users and Computers.
> Right-click the Domain Controllers organizational unit, and then click
> Properties.
> Click the Group Policies tab.
> Click Default Domain Controllers Policy, and then click Edit.
> Go to the following location:
> Computer Configuration\Windows Settings\Security Settings\Local
> Policies\Security Options
> If any of the following policy settings are set to Enabled, double click
the
> setting, click to select the Define this policy setting check box, click
> Disabled, and then click OK.
>
> NOTE: By default, only one setting is set to Enabled.
> Digitally sign client communication (always)
> Digitally sign client communication (when possible)
> Digitally sign server communication (always)
> Digitally sign server communication (when possible)
>
> I looked at my LANMANSERVER and LANMANWORKSTATION registry settings and
> enablesecuritysignature and requiresecuritysignature are both 0 for all.
> Which they should be after making the SBS server change.
>
>
> I did this second.
>
> Also, in DNS, changed "allow secure updates only" to "allow dynamic
> updates."
>
> I restarted the server twice and all workstations once.
>
> What happened?
>
> The copies are now fast like they were before. I wonder if the last set of
> critical updates made things worse?
>
> Is the SMB Issue there with SBS2003?
>
>
> Thanks, all.
>
> John
>
>
>
>
>
>

John
Sun May 02 10:45:57 CDT 2004

Thanks.
John
"Kevin Weilbacher [SBS-MVP]" <kweilbacMVP@gte.net> wrote in message
news:%23pjW5q7LEHA.2456@TK2MSFTNGP12.phx.gbl...
> it's still an issue with SBS2003, and you still need to do the changes
that
> you did - at least I had to.
>
> --
> Kevin Weilbacher [SBS-MVP]
> "The days pass by so quickly now, the nights are seldom long"
>
>
> "John" <john@dontreply.net> wrote in message
> news:5IDkc.6913$k24.4438@fed1read01...
> > Is the SMB signing issue with XP PRO sp1 and SBS2k still an issue?
> >
> > I thought I had the SMB issue fixed until this week. At a client's site,
> XP
> > Pro PCs with SP1 were working great with SBS2k.
> >
> > Until yesterday, several users complained that copying file to the
server
> > was now extremely slow.
> >
> > I had an open issue with MS and had two patches they gave me, 825760,
> > 826722, that resolved some of my Office 2000 issues with SBS2k/Win2k
SP4.
> > And copies were fast and Word was crashing less often.
> >
> > Now, the copying is slow again. I went searching, found KB 329170. But
> > 825760 and 826722 have later file dates than 329170.
> >
> > Yesterday, It would take 20 seconds to copy 200k. Not even a megabyte.
> But
> > only from XP Pro PCS. Win2k PCs were fine.
> >
> > I tried the usual things prior to making the SMB change:
> >
> > 1)checked for spyware, none. Used adaware, Spybot, and Spysweeper
> >
> > 2)checked for viruses - none found. Definitions are the latest.
> >
> > 3)checked for any odd startup files using msconfig
> >
> > 4 )sp1 installed
> >
> > 5)all critical patches installed
> >
> > 6)server is virus free
> >
> > 7)server event viewer is clear of errors
> >
> > 8)hard coded the speed of the NIC but this did not make a difference,
> >
> > Actually, when I hard coded the NICs at 100/full or 100/half, the
copying
> > was worse
> >
> > 9)Verified in the advanced settings of my network were ok
> >
> > 10)DNS settings were correct in ipconfig /all.
> >
> > I ended up doing the following. But why of all a sudden was this
> necessary?
> >
> > The following resolved the problem, solution from Microsoft.
> >
> >
> > I did this first.
> >
> > WORKAROUND
> > To work around this problem, use Group Policy settings to turn off SMB
> > signing. To do so, set the Default Domain Controller policy settings to
> > Disabled:
> > Click Start, point to Programs, point to Administrative Tools, and then
> > click Active Directory Users and Computers.
> > Right-click the Domain Controllers organizational unit, and then click
> > Properties.
> > Click the Group Policies tab.
> > Click Default Domain Controllers Policy, and then click Edit.
> > Go to the following location:
> > Computer Configuration\Windows Settings\Security Settings\Local
> > Policies\Security Options
> > If any of the following policy settings are set to Enabled, double click
> the
> > setting, click to select the Define this policy setting check box, click
> > Disabled, and then click OK.
> >
> > NOTE: By default, only one setting is set to Enabled.
> > Digitally sign client communication (always)
> > Digitally sign client communication (when possible)
> > Digitally sign server communication (always)
> > Digitally sign server communication (when possible)
> >
> > I looked at my LANMANSERVER and LANMANWORKSTATION registry settings and
> > enablesecuritysignature and requiresecuritysignature are both 0 for all.
> > Which they should be after making the SBS server change.
> >
> >
> > I did this second.
> >
> > Also, in DNS, changed "allow secure updates only" to "allow dynamic
> > updates."
> >
> > I restarted the server twice and all workstations once.
> >
> > What happened?
> >
> > The copies are now fast like they were before. I wonder if the last set
of
> > critical updates made things worse?
> >
> > Is the SMB Issue there with SBS2003?
> >
> >
> > Thanks, all.
> >
> > John
> >
> >
> >
> >
> >
> >
>
>