none
Delayed Write Failed - Windows 2003

    Question

  • Dear Folks,

    Windows XP client computers are occasionally receiving the following errors while writting and reading files to a Windows 2003 file share:

    --------------------------------------------------------
    Event Type: Warning
    Event Source: MRxSmb
    Event Category: None
    Event ID: 50
    Date:  06/07/2009
    Time:  16:49:39
    User:  N/A
    Computer: BRQNS01W12945XP
    Description:
    {Delayed Write Failed} Windows was unable to save all the data for the file \Device\LanmanRedirector. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00040004 00560002 00000000 80040032
    0010: 00000000 c000020c 00000000 00000000
    0020: 00000000 00000000 c000020c
    ------------------------------------------------------------------

    and...

    ----------------------------------------------------------------
    Event Type: Information
    Event Source: Application Popup
    Event Category: None
    Event ID: 26
    Date:  06/07/2009
    Time:  16:49:16
    User:  N/A
    Computer: BRQNS01W12945XP
    Description:
    Application popup: Windows - Delayed Write Failed : Windows was unable to save all the data for the file \\BRQNS01as01K3\TEng\lockfile.lck. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
    ----------------------------------------------------------------



    The server is:
    ---------------------------------
    Windows(R) Server 2003, Standard Edition
    Version 5.2.3790 Service Pack 2 Build 3790
    Hardware: Dell PowerEdge 2950
    ----------------------------------


    The clients are:
    ----------------------------
    Windows XP Professional SP2
    Version 5.1.2600
    Hardware: Dell Precision Workstation 490
    Application: Autodesk Inventor 2008
    -------------------------------


    1- This is not the "Write cache issue" described in KB330174 because first, the file operation occurs against a fileserver (not locally), and second because the files in question are not large, a few KBytes most of the times.

    2- This is not the "SMB Redirector issue" described at KB843515 because srv.sys version on this server is 5.2.3790.4425 (the hotfix delivers srv.sys version 5.2.3790.210).

    3- This is not the "3ware cache control" issue described at KB870894 , as computers do NOT have 3ware Raid controllers.

    4- This is not the "Wrong SMB signature" issue described at KB321733, because client computers are XP SP2. Besides, the error code is c000020c, not c0000022.

    5- This might be the issue described in KB890352. However, ntkrnlpa.exe is in version 5.2.3790.4478 , so the patch is irrelevant.

    6- This might be the issue described in KB822219. This server has ofant.sys filter driver installed as part of the Arcserve Backup. However, this driver is in the latest verison (20.0.0.4490).

    7- The server and clients have McAfee filter driver installed.

    8- I'm reluctant to deactivate OpLocks.




    Any ideas?


    Any help will be very much appreciated.


    Leonardo Fagundes
    Wednesday, July 08, 2009 12:18 PM

Answers

  • It turned out to be the McAfee OnAccess filter driver... (the latest version is in place).

    This is VirusScan Enterprise 8.5.0i patch 8.

    This AV has gave me enough problems...


    Thanks for your efforts anyway.
    Leonardo Fagundes
    Friday, July 24, 2009 2:17 PM

All replies

  • Hello Leonardo,

    Do you use Hewlett-Packard (HP) SecurePath on that Windows Server 2003 Service Pack 1 (SP1)? If yes, please refer to the following Microsoft KB article to try resolving the issue

    Event ID 50, 26, or 57 is logged when you use HP SecurePath on a computer that is running Windows Server 2003 Service Pack 1 (SP1) or an x64 edition of Windows
    http://support.microsoft.com/default.aspx/kb/912593

    Meanwhile, we recommend you download the hotfix that is mentioned in the following KB article and apply it onto the problematic Windows XP computer.

    File Lock or Access Denied Error Message When You Save Files Over the Network
    http://support.microsoft.com/default.aspx/kb/812937

    Hope this can be helpful.



    This posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, July 14, 2009 7:56 AM
  • Hey David, thanks for your answer.


    "Do you use Hewlett-Packard (HP) SecurePath on that Windows Server 2003 Service Pack 1 (SP1)? "

    No, I don't. Driver Raidisk.sys is not present.

    "we recommend you download the hotfix that is mentioned in the following KB article 812937"

    Client computers are in Windows XP SP2. This hotfix is irrelevant. Client computers have these versions:

    mrxsmb.sys 5.1.2600.3467
    rdbss.sys  5.1.2600.2541



    Any thoughts?
    Leonardo Fagundes
    Tuesday, July 14, 2009 7:35 PM
  • Hello guys,

    Any other idea?


    Please help!
    Leonardo Fagundes
    Monday, July 20, 2009 1:40 PM
  • Leonardo,

    Are you running shadow copies on your Win 2003 server?

    -Justin
    Tuesday, July 21, 2009 3:29 PM
  • Hey Justin!


    Nope, no shadow copies.
    Leonardo Fagundes
    Tuesday, July 21, 2009 3:38 PM
  • Have you tried updating your network drivers?  We've had the issue you describe due to the following three issues:

    ShadowCopies corrupting the PagedPool
    Old Nic Drivers
    Latency issues with storage (we have a SAN, but I would think it could happen with a NAS or DAS as well).

    Think any of those things could be an issue?

    Tuesday, July 21, 2009 6:38 PM
  • It turned out to be the McAfee OnAccess filter driver... (the latest version is in place).

    This is VirusScan Enterprise 8.5.0i patch 8.

    This AV has gave me enough problems...


    Thanks for your efforts anyway.
    Leonardo Fagundes
    Friday, July 24, 2009 2:17 PM
  • Please check the version of ntfs.sys as per :

    http://support.microsoft.com/kb/973886

    Try updating the file verion .
    Tuesday, February 09, 2010 9:33 AM
  • Having the exact same issue here.  I have 2 identical HP servers, both running Windows 2003 server with RAID 5 and 300+ client laptops running XP with SP3.  I am receiving the Windows Delayed Write error when saving files over 7 megs to server 1, but no issue saving the exact same file to server 2.  This is happening with all laptops that have NIC's set to Auto.   Saving to server 2 is successful whether the client NIC is set to Auto or 100 Full, but saving to server 1 only works when client NIC is set to 100 Full.  Both servers have exact same setup and configuration.  Changing the switch port speed to Auto instead of 100 Full also seems to work.  I'm perplexed as to why this is only happening on one server when everything is going through exact same switches, same port speeds and same hardware.  I've tried every possible fix listed on this issue, but still no success.  I'm receiving an error that the disk is full....even though there is almost a TB of free space on that server.  Event Viewer list same message as indicated initially in this thread.  Changed cables, ports...no luck.
    Wednesday, June 30, 2010 12:06 PM
  • I know I asked Leonardo earlier - but are you using shadow copies on any of the drives on those servers?

     

    -Justin

    Wednesday, June 30, 2010 5:50 PM
  • Hi Leonardo,

    Can you share with us how you discovered that Mcafee was the source of this issue?   We have a similar issue we're troubleshooting and am interested to know what you did to identify Mcafee as the cause of this and also what you did to resolve it. 

    Thanks

    Friday, August 26, 2011 7:23 AM
  • Hi Leonardo,

    Can you share with us how you discovered that Mcafee was the source of this issue?   We have a similar issue we're troubleshooting and am interested to know what you did to identify Mcafee as the cause of this and also what you did to resolve it. 

    Thanks


    +1
    Friday, September 02, 2011 7:56 AM
  • hiiii

    just for my personal information

    can a switch occur error c000020c???

    Friday, March 16, 2012 7:16 AM