Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a single file server in a single domain on our network. However, when department heads and the CEO try to save files from word and excel over their VPN connection, they are very slow. It is so slow the program comes up as not responding, and appears to crash. When we were test saving files on the file server we see the same problem with word and excel documents. We only see the problem when we save a document that has been updated, but not when saving a new document. When we follow the exact same steps on other servers we do not see any speed problems.

The only difference I have found between the servers is that the file server has an intel network team using the two onboard intel nics. Our other server that we tested with has a broadcom network team using two onboard broadcom nics. I do not have another server with an intel network team setup that I can use to test. One strange thing we have found is that running a packet sniffer while saving the files on the file server and the test server, the file server seems to be listing all of the files in several directories during the test of "open, modify, save."

File server and test server.
Windows 2003 server.
Domain member.
Symantec Antivirus corporate 10.

Until now, our network manager had been working on this, and I just got brought into it. To be honest, I do not even know where I should start looking for the actual cause of the problem.

share|improve this question
Where did you run the packet capture, was it from one of the clients having the issue? – Zoredache Oct 19 '09 at 20:30
Yes, packet capture was from the client having the problem. On the server with the problem, the tcp traffic was very very large amount of data. On the server without the slowness, there was almost nothing. – Adam Towne Oct 19 '09 at 20:35
We have not found a solution, but we switched to using Citrix to go around the problem. Thank you for the help, I am not sure what to do with this question, since I have no solution, but also don't need one at this time. – Adam Towne Nov 23 '09 at 16:04

Turn off any scanning of "network drives" that the Symantec Antivirus software on the client computer allows. I've had some situations where I've seen the SAV 10 client generates gratuitous traffic when talking to a file server that didn't have SAV installed, because the option to scan "network drives" when the server didn't have SAV installed was enabled.

Sniffing the traffic is probably your best place to start, at this point. You might want to run Process Monitor on the client, as well, to see what it "thinks" it's doing.

share|improve this answer
I believe all of our SAV10 clients are configured with the "scan network drives" disabled through the server management console. I am going to double check that though. I will also see about getting a process monitor log next time we go to test. – Adam Towne Oct 19 '09 at 20:34
I was wrong, network scanning was turned on, we are going to try turning that off on our test client and see if it makes a difference. – Adam Towne Oct 19 '09 at 20:58
We tried using a machine without the AV installed as a test and it had the same issue, so it looks like AV is probably not our cause. – Adam Towne Oct 20 '09 at 12:46
Darn. How about watching the client w/ "Process Monitor". Any major differences in behaviour there? – Evan Anderson Oct 20 '09 at 13:09
I have not been able to get that done yet, I have gotten some time on my schedule to test it this afternoon, I will let you know what I find. – Adam Towne Oct 20 '09 at 14:59

What are the file sizes of the changed documents? If this is specifically related to just Word and Excel I would think it's probably due to one of the Office functions such as change tracking which can add considerable overhead to the files.

Try creating a plain text file, modify and save it and see if you see the same symptoms.

I've also seen this kind of behavior with Word and Excel when they can't contact network printers and shares that they remember.

You might also be running into conflicts with SAV trying to scan more than you're expecting.

share|improve this answer
The file sizes are very small, about 20kb. We will try making a text document and then modifying it to see if it is the same. – Adam Towne Oct 19 '09 at 20:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.