0

I have a 2008 Remote Desktop server that was recently hit with Cryptolocker. The server itself was never infected, but rather a workstation with a mapped network drive to it.

The infection was cleaned and files restored so no issues there, but it seems like since then we've had the following problem.

A user logs in remotely and copies files to the server.
Another user on the server's LAN tries to access those files through a mapped network drive, but they don't show up. I've logged in and replicated this behavior.

I'm wondering if anyone has heard of this issue, has a fix, and/or has suggestions.

Thanks again for any assistance.

2
  • Have you checked to see if they're hidden? Nov 19, 2013 at 19:33
  • Can the uploading user see the files after the fact? Does it matter what computer the uploader or subsequent users are using? If the file seems to disappear, try running procmon on the server/workstation. Does it affect all combinations of users (uploaders/subsequent users) or only some? What does the ACL look like on the share/directory? Jan 9, 2014 at 4:37

1 Answer 1

0

I was experiencing a similar problem and, eventually, I found the cause of this issue. The specific problem is the SMB2 Directory Cache, which is one of the SMB2 Client Redirector cache components:

This is a cache of recent directory enumerations performed by the client. Subsequent enumeration requests made by client applications as well as metadata queries for files in the directory can be satisfied from the cache. The client also uses the directory cache to determine the presence or absence of a file in the directory and uses that information to prevent clients from repeatedly attempting to open files which are known not to exist on the server. This cache is likely to affect distributed applications running on multiple computers accessing a set of files on a server – where the applications use an out of band mechanism to signal each other about modification/addition/deletion of files on the server.

The default value for this wonderful little cache is 10 seconds, which is producing the behavior you're seeing. When your code asks the system about that directory/file it's getting the cached result, which is 10 seconds old, so it says the file does not exist. Setting HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters\DirectoryCacheLifetime (DWORD) to a value of 0 will disable the cache and resolve the file doesn't exist issue. Surprisingly this change does not require a restart of the client machine! This will also allow you to keep SMB2 enabled, which should be better for a number of reasons vs. forcing SMB1. With SMB 3 out now we really don't want to disable it.

I got this from someone elses post, don't want to take credit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .