Introduction
On Windows 10 (update 1703 or 1809), applications launched from a network drive crashes after period of 60 to 95 minutes. On Windows 7 applications runs flawlessly.
Behaviour has been under lab surveillance for several weeks, involving both several 32 bit and 16 bit applications.
Symptoms
- All attempts to launch applications from network drive succeed;
- All affected 32 bit applications EXE/DLL (Powerbuilder) logged an 0xc0000006 exception on Event Viewer.
- On 16 bit application (Foxpro 2.6 for MS-DOS), occurs error "Unable to process error" or simply breaks and exits.
- Once in a while "Fatal error 104 while attempting to report error 104" occured.
- Failure happens even during continuous usage (no significant inactivity period occurs);
- Failure only occured on Windows 10 32 bit/64 bit workstations either running Update 1703 or Update 1809. Windows 7 workstations were fine.
- Gathered analysis points to "safe" random period from 60 to 95 minutes between first launch and break occurs;
- Using Wireshark, error STATUS_NETWORK_SESSION_EXPIRED is consistently logged at failure ocurrs on some scenarios.
- When several instances were launched at different times, they all failed at the same second;
- A instance launch from a local drive runs fine, even after an eventual fail on network drive launched instances;
- All afected sites servers are running on Windows 2016 Server;
- Network drive seems functional after fails;
- Network connectivity never seems to fail (continuous PINGs) before, during or after application breaks;
Tested lab system configurations
- Windows Server 2016 Essentials (1607)
- Windows 10 32 bit / 64 bit (update 1703 / 1809)
- Windows 7 (32 bit only)
- Cable
- Switch
Server network configuration
Results of Powershell's Get-SMBServerConfiguration command:
AnnounceComment :
AnnounceServer : False
AsynchronousCredits : 512
AuditSmb1Access : False
AutoDisconnectTimeout : 999999
AutoShareServer : True
AutoShareWorkstation : True
CachedOpenLimit : 10
DurableHandleV2TimeoutInSeconds : 180
EnableAuthenticateUserSharing : False
EnableDownlevelTimewarp : False
EnableForcedLogoff : True
EnableLeasing : False
EnableMultiChannel : True
EnableOplocks : True
EnableSecuritySignature : True
EnableSMB1Protocol : True
EnableSMB2Protocol : True
EnableStrictNameChecking : True
EncryptData : False
IrpStackSize : 15
KeepAliveTime : 2
MaxChannelPerSession : 32
MaxMpxCount : 50
MaxSessionPerConnection : 16384
MaxThreadsPerQueue : 20
MaxWorkItems : 1
NullSessionPipes : netlogon,samr,lsarpc
NullSessionShares :
OplockBreakWait : 35
PendingClientTimeoutInSeconds : 120
RejectUnencryptedAccess : True
RequireSecuritySignature : True
ServerHidden : True
Smb2CreditsMax : 8192
Smb2CreditsMin : 512
SmbServerNameHardeningLevel : 0
TreatHostAsStableStorage : False
ValidateAliasNotCircular : True
ValidateShareScope : True
ValidateShareScopeNotAliased : True
ValidateTargetName : True
Workstation network configuration
Results of Powershell's Get-SMBClientConfiguration command:
ConnectionCountPerRssNetworkInterface : 4
DirectoryCacheEntriesMax : 16
DirectoryCacheEntrySizeMax : 65536
DirectoryCacheLifetime : 0
DormantFileLimit : 1023
EnableBandwidthThrottling : True
EnableByteRangeLockingOnReadOnlyFiles : True
EnableInsecureGuestLogons : True
EnableLargeMtu : True
EnableLoadBalanceScaleOut : True
EnableMultiChannel : True
EnableSecuritySignature : False
ExtendedSessionTimeout : 1000
FileInfoCacheEntriesMax : 64
FileInfoCacheLifetime : 0
FileNotFoundCacheEntriesMax : 128
FileNotFoundCacheLifetime : 5
KeepConn : 65535
MaxCmds : 50
MaximumConnectionCountPerServer : 32
OplocksDisabled : False
RequireSecuritySignature : False
SessionTimeout : 65535
UseOpportunisticLocking : False
WindowSizeThreshold : 8
What we had already done
- Checked Event Viewer, even on SMBCLIENT and SMBSERVER sub-events, but unable to find correlation between events and application failure.
- Tried setting SMB SessionTimeout setting to 65535 on workstation follow by reboot, as pointed by harryc;
- Tried setting SMB Keepcon setting to 65535 on workstation follow by reboot;
- Disabled autodisconnect (changing it to -1) followed by a reboot;
- Tried enabling SMB1 on both server/workstation followed by a reboot;
- Tried disabling antivirus (ESET) on both server/workstation followed by a reboot;
- Disabled powersaving network on card both server/workstation followed by a reboot;
- Tried disabling firewall on both server/workstation;
- Case has been under lab surveilance for weeks with no success.
Is there anyone else facing the symptons and able to provide alternative solutions?
Thanks for you attention
