SMB troubleshooting guidance

Article
03/16/2024

Try our Virtual Agent - It can help you quickly identify and fix common SMB issues.

This article is designed to help you troubleshoot Server Message Block (SMB) issues. Most users are able to resolve their issue by using the solutions that are provided here.

SMB terminology

Communicating correct terminology is a key aspect of quality SMB troubleshooting. Therefore, you should learn basic SMB terminology to ensure the accuracy of data collection and analysis.

SMB Server (SRV) (also known as the file server) is always the system that hosts the file system.
SMB Client (CLI) is always the system that tries to access the file system.

These terms are consistent regardless of the operating system version or edition. For example, if a Windows Server 2016-based computer tries to reach the SMB share \\MyWorkstation\Data on a Windows 10-based computer, Windows Server 2016 is the SMB Client and Windows 10 is the SMB Server.

Troubleshooting checklist

Check that the correct SMB network protocol is installed. The SMBv1 network protocol is no longer installed by default.
Disable SMBv1.
If SMBv1 is disabled on a device that supports only SMBv1, you can't access that device. In this situation, upgrade your system.
You can't disable SMBv2 or SMBv3 separately because these versions are part of the same driver.
Analyze the traffic: SMB is an application-level protocol that uses TCP/IP as the network transport protocol. Therefore, an SMB-related issue might indicate that there are underlying TCP/IP-related issues.
Analyze the protocol: To understand the exact commands and options that are used, look at the actual SMB protocol details in the network trace.
Update SMB-related system files: Keep the system files updated. Make sure that the latest update rollup is installed.

SMB file information

SMB Client binaries that are listed under %windir%\system32\Drivers:

RDBSS.sys
MRXSMB.sys
MRXSMB10.sys
MRXSMB20.sys
MUP.sys
SMBdirect.sys

SMB Server binaries that are listed under %windir%\system32:

Srvsvc.dll

SMB Server binaries that are listed under %windir%\system32\Drivers:

SRVNET.sys
SRV.sys
SRV2.sys
SMBdirect.sys

We recommend that you update the following components before you troubleshoot SMB issues:

iSCSI: A file server requires file storage. If your storage has iSCSI components, update those components.
Network: Update the network components.
Windows Core: For better performance and stability, update Windows Core.

Disconnecting all shared resources from local computer

You can use the Net Use * /delete command to disconnect active or remembered shared resources on a local computer.

Note

You can use this command on remote computers, also. Run Net help use for more options.

Important

This section of this article is based on community content.

Community Solutions Content Disclaimer

Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.

Common issues and solutions

When you access a Scale-Out File Server, performance is limited

The client access network uses high-speed remote direct memory access (RDMA), but the cluster network doesn't. Because of this behavior, redirection occurs only on the cluster network. The cluster network typically connects to 1-GbE network adapters.

To troubleshoot this issue, you can configure the option to use the client access network for Cluster Shared Volumes (CSV). Or, upgrade to Windows Server 2012 R2 or a later version. That system automatically redirects clients to the cluster node that has the best access to the volume of the file share. For more information, see the following Blog Archive article: Automatic SMB Scale-Out Rebalancing in Windows Server 2012 R2.

SMB prefers the slower physical network adapter to the virtual network adapter

The virtual network adapter on the host isn't RSS-capable. The physical network adapter is RSS-capable. SMB always uses the RSS-capable network adapter instead of the non-RSS network adapter even if the RSS network adapter is slower.

To troubleshoot this issue, disable the RSS capability on the physical network adapter, or use SMB Multichannel constraints to restrict SMB communication to one or more defined network interfaces. For more information, see the New-SmbMultichannelConstraint SMB Share cmdlet in Windows PowerShell.

SMB reports the network adapter isn't RDMA-capable even though you believe that it is

This issue occurs because RDMA-capable network adapters that have older drivers or firmware might not correctly identify themselves as being RDMA-capable.

To troubleshoot this issue, update the network adapter firmware and driver from the manufacturer's website.

The required amount of network traffic before SMB Multichannel starts varies

The SMB Multichannel feature is used to discover the RSS and RDMA capabilities of network adapters. On server operating systems, SMB Multichannel starts when the initial read or write operation occurs. On client operating systems, SMB Multichannel doesn't start until a certain amount of network traffic occurs.

On server operating systems, SMB Multichannel starts quickly only one time per session. On client operating systems, you can configure a registry entry to start SMB Multichannel more quickly. For more information, see the following Blog Archive blog article: How much traffic needs to pass between the SMB Client and Server before Multichannel actually starts?.

SMB Multichannel doesn't aggregate multiple 10-GbE network adapters

An RSS-capable 10-GbE network adapter is sometimes identified as non-RSS-capable. When this issue occurs, SMB uses only one TCP connection. When SMB Multichannel uses both RSS-capable and non-RSS network adapters, it should use only the RSS-capable network adapters.

Server-class network adapters should appear as RSS-capable. If they don't, update the network adapter driver from the manufacturer's website, and then recheck the RSS settings.

You might have to disable RSS on both network adapters to aggregate throughput. For more information, see the following Blog Archive blog article: Windows Server 2012 File Server Tip: Make sure your network interfaces are RSS-capable.

The virtual network adapter on the host doesn't perform well

The virtual network adapter on the host isn't RSS-capable. Without an RSS-capable network adapter, SMB uses only one TCP connection. This behavior occurs when you use 10-GbE network adapters, RSS-capable network adapters, and NIC Teaming.

To troubleshoot this issue, use multiple virtual network adapters to make sure that you have multiple TCP connections. For more information, see the following Blog Archive blog article: Windows Server 2012 File Server Tip: Make sure your network interfaces are RSS-capable.

Windows Server 2012 R2 periodically logs SMBClient event ID 30818

Assume that a Windows Server 2012 R2-based computer uses an InfiniBand network adapter. This adapter uses the SMB Direct feature to support Remote Direct Memory Access (RDMA) communication between cluster nodes and Hyper-V hosts. After you restart a Hyper-V host, Windows might log event ID 30818 under the Applications and Services Logs/Microsoft/Windows/SmbClient path in Event Viewer. When this occurs, you might also experience performance issues.

On Windows Server 2012 R2, the LanmanServer service automatically starts the SmbDirect service. However, if the LanmanWorkstation service happens to start first and tries to open an RDMA connection before the SmbDirect service loads, Windows logs event ID 30818. When the client initially communicates with the server over TCP/IP, it uses the RDMA interface. Therefore, no user action is needed to recover.

Microsoft is considering providing a resolution for this issue in a future version of Windows Server.

Workaround

Important

This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For protection, back up the registry before you modify it so that you can restore it if a problem occurs. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows.

To work around this issue on Windows Server 2012 R2, configure the SmbDirect service to start automatically. To do this, follow these steps:

Open Registry Editor, and then navigate to the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\smbdirect
Right-click the Start registry entry, and then select Modify.
In the Value data box, change the value (the default value is 3, which means on-demand) to 2 (automatic).

After you make this change, you should be able to restart the computer without Windows logging event ID 30818 messages. If Windows continues to log these events, some other issue might be preventing the RDMA interface from initializing.

When you install Windows Server, Windows logs Event ID 1

When you install Windows Server 2019, Windows Server 2016, or Windows Server 2012 R2, Windows logs Event ID 1. The event information resembles the following:

Log Name: Microsoft-Windows-SMBWitnessClient/Admin
Source: Microsoft-Windows-SMBWitnessClient
Event ID:1
Level: Error
Description: Witness Client initialization failed with error (The system cannot find the file specified.)

If this is a fresh deployment of Windows Server that has no roles or features enabled, you can safely ignore this event.

SMB known issues

Data collection

Before you contact Microsoft Support, you can gather information about your issue.

Prerequisites

Run TSS in the security context of an account that has administrator privileges on the local system. The first time that you run it, accept the EULA. (After you accept the EULA, TSS won't prompt you again.)
We recommend that you use the RemoteSigned PowerShell execution policy at the LocalMachine scope.