Slow copy speed from 2008R2 to XP


  • Dear All

    I know there are many threads on similar issues and we have tried some of those solutions but to no avail. So I hope that this is not a problem starting off a new thread on what may be an old subject as I wanted to isolate our case a little. I was a little worried to jump head first into making changes suggested elsewhere as I don't want to go an upset anything needlessly if there is a more obvious solution that someone can suggest.

    To summarise the problem, we are sufffering business effecting slow speeds across the network but from 2008R2 to XP clients only.

    We have about 15-20 XP machines still on the network, the rest are either Vista or W7. This problem does not effect any of the other clients.

    To try to explain as much as possible about the setup we have (but you may want to know more).

    We recently switched from a dedicated 2003 server which was fine (except it had some connection issues and was beginning to labour a little) when copying files.

    We now have a server with virtualised 2008R2 domain/file server, SQL server and WIN8 (this just runs lots of scheduled task and will eventually be the e-mail server (we run a 3rd party e-mail server)).

    Everything is Gigabit networked, running on different LAN cards/chipsets (we have a variety of different machines and specs so they are not all the same).

    The machines running Vista or W7, there is no issue. We can copy files without a problem. As a footnote to that, we did have the same issue on a Vista machine, but we tried enabling IP6 on it and that cured the problem - which goes against what some people were suggesting in other posts that it should be turned off. We tried IP6 on an XP machine in case that was the issue there, but it did not help. We tried disabling IP4 in case it was defaulting to that. But with just IP6 on on the XP machine, it could not see the network at all. So I don't believe that helps, although odd why it did on the Vista machine (a red herring maybe?).

    But the XP machines are just so slow. The main issue is that we are a retail outlet. The tills run 'off network' that is to say the data isn't live. If anything changes that requires the tills to be updated, we have to copy the files from the server down to the tills. This is a batch of files, maybe 20 or so. On the old server, this was just a few seconds. Now, just to copy the first 2 files (60mb) takes 7 or 8 mins. The whole process can take 40 mins which is just unacceptable when we need data live as quickly as possible.

    The strange thing about this whole problem is that this did not occur for the first 3-4 weeks, it was fine. Then suddenly, one day we had a problem. We rebooted and the problem went away for a few days, then returned. We rebooted again and we maybe had a day or so where it was fine before it happening again. Now, rebooting doesn't help - it appears to be a permanent problem. This means we cannot do any till updates during the day.

    We run through 3 Netgear managed switches. But we have eliminated these being an issue as we cabled back directly to an unmanaged switch connected directly to the server with no solution. We don't believe it is a network card issue as we have such a variety of machines that we don't think this could be the case. It looked initially like the server lacked some memory so we bumbed it up by 4GB, but that didn't make much of a difference either although at least it is showing plenty of free memory now.

    Nothing else appears slow - SQL is fine for example. It is just file from the 2008R2 server to XP machines that appears to be the issue.

    As I previously said, I appreciate that there are other posts about similar problems. But wanted to start a fresh in case this problem was obvious to someone from what I have described. We didn't want to go changing network settings unnecessarily in case we caused further problems. The only adjustment we have made (after seeing this suggested) was turning off SMB 2.0 on the server - but, again, no difference.

    Please ask for any other information if I have not provided enough.

    Any assistance would be most welcome for this annoying problem.



    Tuesday, January 14, 2014 10:47 AM

All replies

  • Hi Trevor,

    I am trying to involve someone familiar with this topic to further look at this issue.

    There might be some time delay. Appreciate your patience.

    Best Regards,


    Friday, January 17, 2014 1:56 AM
  • Hi Anna

    Thank you for the reply. The delay is not a problem at all.

    At the moment, we can mitigate the problem (for a short time, before the problem re-occurs) by rebooting the server, which obviously isn't ideal, but does give us some time to sort the problem out.

    Thanks again


    Friday, January 17, 2014 9:49 AM
  • Hi Trevor,

    Thanks for your clear description.

    From the verbatim, it seems the issue is complicate since you have already eliminated some factors, middle devices, restart the machine, disable SMB2.0. That's great. Your thought is very clear. Currently, I think we should to analyze the netmon traces when the issue happens and when everything goes well, to find the clues from the traces.

    Please help me to collect network traces on the XP client and the file server(and the Win7 client and the file server). To do this:
    a. Download Microsoft Network Monitor Tool from the following link and install it on the two machines.

    b. Start Network Monitor at "Start" ->"Program"-> "Microsoft Network Monitor 3.4" -> "Microsoft Network Monitor 3.4" on the two machines.
    c. On the left-panel, check the "LAN connection" and uncheck the other unnecessary connections on the two machines.
    d. Click "Tools", click "Options", switch to the "Capture" tap, and set the "Temporary capture file size (MB)" to 200 on the two machines.
    e. Click "New Capture", click "Start" on the Capture menu in the two Network Monitor windows.
    f. Now from the client, to do this:
    g. Open the cmd as administrator and type in the following command:
      nbtstat -RR
      ipconfig /flushdns
    h. Ping the server.
    i. reproduce the issue.
    j. Ping the server again. (Since there are a lot of packets in one file, this will help us to address the useful information)
    k. Click "Stop" on the Capture menu, and click "File"->"Save as" to save the captured file. Please send the files to me.
    Note: Please let me know: 1. The IP addresses of the client and the file server. Please upload to a workspace that I could access.

    Thank you.

    Best regards,

    Steven Song

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Tuesday, January 21, 2014 5:17 AM
  • Hi Steve,

    Thanks very much for your post.

    Sorry, but just so we can get this correct, can I just clarify a couple of things?

    (1) We install net monitor as per your instructions and then leave this running in the background capturing packets or just run in for 10-15 mins when the copy is good and then again for 10-15 when it is bad? I am assuming the first option, but wanted to check so we get accurate results to you from the offset. If it is the first option, once the copy goes 'bad' how long should we run net monitor for to get some results that are useful?

    (2) The ping part - do you want us to start pinging the server from the client as soon as net monitor is started and leave it it pinging away? Or just do a quick ping (30 seconds or so) at each point you have mentioned?

    Once I know what to do with the above, we will get all this set up and get the results to you over the next few days. The problem isn't predictable, it just starts to happen randomly. So once we have some meaningfull results - when the copy is good and when it is bad - we will get them to you.

    Thanks for taking the time to help, much appreciated.



    Tuesday, January 21, 2014 9:43 AM
  • Hi Trevor,

    I prefer to gather the trace when the issue happens and keep running for about 10mins. Regarding the ping, begain pinging server from the client as soon as netmon is started and pinging it again before leaving it.

    Thanks for your understanding.

    Best regards,
    Steven Song

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Tuesday, January 21, 2014 10:00 AM
  • Thanks for the clarification Steve.

    We have been rebooting nightly to keep the disruption to a minimum, so at the moment things are good. So I will get that started to get some 'good copy data'. Then, when the problem occurs, I will do it again to get some 'bad copy data' and then get the results uploaded to somewhere where you can access them.

    Thanks again,


    Tuesday, January 21, 2014 10:09 AM
  • Hi Steven

    Just to update.....

    We have 10 mins of data from an XP machine and 10 mins of data from a Win7 machine, both when the problem was occuring. On the Win7 machine too less than 1 min to copy 60Mb, on the XP machine this wa over 10 mins.

    At the moment, we can't actually get it back into a 'good' state. Rebooting the last time it went straight to 'bad copy'.

    So I don't have any good data for you at the moment, but could upload the captures from the XP and Win7 when the copy was slow if that is any use at this stage? But I guess you need the other captures too to compare?

    Best wishes,


    Wednesday, January 22, 2014 10:46 AM
  • Hi Steven

    We have now created the information you require, I hope.

    I have created 4 files as follows:

    GoodCopyCaptueWinXP.cap - captured when speed not an issue, XP machine

    GoodCopyCaptueWin7.cap - captured when speed not an issue, Win7 machine

    BadCopyCaptueWinXP.cap - captured when speed was a problem, XP machine

    BadCopyCaptueWin7.cap - captured when speed was a problem, Win7 machine

    They are zipped up and in a file called on SkyDrive.

    During each capture which are each roughly 10-15 mins I did the following:

    Started capture
    Pinged the server
    Copied 2 relatively large files (onces that are part of a batch of files that cause an issue when copy is slow)
    Waited 10-15 mins .....
    Pinged the server again
    Stopped the capture

    I believe I said before that there wasn't an issue on Win7 machine. This may not have been totally correct. Relatively speaking, when the copy was slow, Win7 seemed not to have the problem as it was fairly quick. For example, when the copy is slow, it took 5-10 mins on the XP machine to copy 2 files totalling 60Mb. On the Win7 machine this just took 60 seconds or so. So we assumed it was not an issue on Win7. But when we did the capture when speeds were good, the XP machine copied the same 60Mb files in 10 seconds or so and the Win7 was virtually instant. So I would say this probably isn't an issue just on XP but it is exagerated on XP because those machines tyend to be older and lower spec'd.

    IP addresses of the machines are as follows:

    Server (vitualised 2008R2) -
    Win XP PC -
    Win 7 PC -

    Hope this gives you enough information to potentially spot the problem we are having.

    If you need anymore data, please do ask and I will endeavour to get it to your asap.

    Thanks again for your help,

    Buckingham Nurseries and Garden Centre.

    • Edited by Buckingham Nurseries Thursday, January 23, 2014 3:11 PM Account now verified so able to add link to SkyDrive
    Thursday, January 23, 2014 2:35 PM
  • Hi Steven

    Just checking in to make sure the trace data we posted was of use? If not, or there is any other information you require, please do let me know and I will get it to you asap.


    Trevor Bradley
    Buckingham Nurseries.

    Tuesday, January 28, 2014 11:09 AM
  • Anyone able to help? This is causing us a real problem.
    Tuesday, February 4, 2014 4:53 PM
  • Hi

    Sorry for the delay, since the issue is complex, also the traces is big, we took some more days to analysis. Hope you can understand it.


    1.Copy the files under Safe Mode or Clean Boot to eliminate some factors.

    a. Click Start,click Run, type "msconfig" (without the quotation marks) in the Open box, and then click OK.

    b. In the Startup tab, click the "Disable All" button.

    c. In the Services tab, check the "Hide All Microsoft Services" checkbox, and then click the "Disable All" button.

    d. Click OK and restart your computer.


    Clean Boot + binary search

    In a Clean Boot, all the 3rd party services and
    startup programs are disabled. If the server can start normally in Clean Boot, we can be sure that the issue was caused by some 3rd party service or application. And then we can do a "binary search". You can enable half
    of all the services in Services tab, and then restart the server to check the result. If the issue reoccurs, it means the culprit is in this list; if not, the culprit is in the other half. And then, we can continue the binary search, until we find out the root cause.

    Please let me know if this action plan is OK for you.

    Meanwhile, if the issue is really urgent,you may create an Email Support ticket or Phone Support ticket.

    Again thanks for your time and understanding.

    Best regards,

    Steven Song

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Wednesday, February 5, 2014 1:17 AM
  • Hi Steven

    Thank you for the reply.

    We have had a think about this and it is probably not possible to turn off all the 3rd party services on the server. There is too much that the business relies on which runs on the server that, if turned off, would effect the business itself. For example, we run a 'Faircom' database (our EPOS system relies on this). If we were to turn that off, we would have no EPOS system. Same for antivirus, we run Symantec Endpoint Protection - if we were to turn it off, we would have no antivirus protection. And other things too.

    I can see your thinking on this, to try to eliminate possibilities, but we just would not be able to do it that way because of the effects it would have.

    I appreciate you said the logs were big, but did anyting show up? Or do you have any other thoughts?

    If not, we will need to do as you suggest and raise a ticket because this problem really impacts on the business here. Can you provvide me a link where we can go to raise a support ticket for this please?

    Many thanks,

    Trevor Bradley
    Buckingham Nurseries and Garden Centre

    Friday, February 7, 2014 8:57 AM
  • Hi,

    This is the netmon traces from XP, good and bad.

    Cood: there are 12 times ReTransmit within 15 minutes.

    135 4:09:08 PM 1/23/2014 7.2635993 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #133]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=916403672 - 916403711, Ack=2301074298, Win=64240 {TCP:4, IPv4:3}
    932 4:09:41 PM 1/23/2014 40.7479743 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #927]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=92, Seq=916643498 - 916643590, Ack=2301094837, Win=64166 {TCP:4, IPv4:3}
    4918 4:09:48 PM 1/23/2014 47.5135993 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #4914]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=919027136 - 919027175, Ack=2301210565, Win=63491 {TCP:4, IPv4:3}
    4974 4:09:54 PM 1/23/2014 53.4354743 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #4973]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=919027487 - 919027526, Ack=2301211497, Win=64118 {TCP:4, IPv4:3}
    130762 4:10:22 PM 1/23/2014 82.1854743 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #130758][Continuation to #130704]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=751, Seq=1037224264 - 1037225015, Ack=2301370286, Win=64051 {TCP:4, IPv4:3}
    130833 4:10:30 PM 1/23/2014 89.3104743 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #130829]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=1037225639 - 1037225678, Ack=2301372326, Win=63520 {TCP:4, IPv4:3}
    212235 4:25:34 PM 1/23/2014 993.7167243 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #212234]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=1108111061 - 1108111100, Ack=2301600768, Win=63880 {TCP:4, IPv4:3}
    212542 4:25:38 PM 1/23/2014 997.6542243 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #212541]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=1108132966 - 1108133005, Ack=2301624078, Win=63431 {TCP:4, IPv4:3}
    212553 4:25:38 PM 1/23/2014 998.1073493 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #212550]Flags=...A...., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=1460, Seq=1108133109 - 1108134569, Ack=2301624248, Win=63261 {TCP:4, IPv4:3}
    213006 4:25:42 PM 1/23/2014 1001.5917243 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #213005]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=92, Seq=1108151806 - 1108151898, Ack=2301651891, Win=63858 {TCP:4, IPv4:3}
    213181 4:25:50 PM 1/23/2014 1010.0135993 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #213168]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=39, Seq=1108155892 - 1108155931, Ack=2301657040, Win=63160 {TCP:4, IPv4:3}
    213236 4:25:53 PM 1/23/2014 1012.4198493 System SERVER002  MOOFFICE3  TCP TCP:[ReTransmit #213234]Flags=...AP..., SrcPort=Microsoft-DS(445), DstPort=1724, PayloadLen=102, Seq=1108162847 - 1108162949, Ack=2301658257, Win=63439 {TCP:4, IPv4:3}

    Bad: 7 times ReTransmit within 5 minutes

    291 9:46:29 PM 1/21/2014 50.6216041 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #290]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=118, Seq=2978301693 - 2978301811, Ack=3115403475, Win=65431 {TCP:11, IPv4:3}
    367 9:46:30 PM 1/21/2014 51.1245341 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #366]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=132, Seq=2978304751 - 2978304883, Ack=3115437599, Win=65431 {TCP:11, IPv4:3}
    493 9:46:30 PM 1/21/2014 51.6274631 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #477]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=214, Seq=2978306327 - 2978306541, Ack=3115517597, Win=65535 {TCP:11, IPv4:3}
    626 9:46:31 PM 1/21/2014 52.1303931 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #624]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=126, Seq=2978310373 - 2978310499, Ack=3115584138, Win=65431 {TCP:11, IPv4:3}
    2370 9:46:58 PM 1/21/2014 79.7915261 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #2369]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=63, Seq=2978410367 - 2978410430, Ack=3115870619, Win=65352 {TCP:11, IPv4:3}
    52972 9:51:05 PM 1/21/2014 326.8305881 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #52970]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=63, Seq=2978469735 - 2978469798, Ack=3161989373, Win=65283 {TCP:11, IPv4:3}
    53110 9:51:06 PM 1/21/2014 327.3335181 System MOOFFICE3  SERVER002  TCP TCP:[ReTransmit #53108]Flags=...AP..., SrcPort=2160, DstPort=Microsoft-DS(445), PayloadLen=63, Seq=2978469861 - 2978469924, Ack=3162112379, Win=65352 {TCP:11, IPv4:3}

    Hence, I think if the workload of Server or the middle device is heavy, data flow is also greater. The performace will affect this transmission. At that time, this server and middle device should be monitored.

    Meanwhile, this case will be analyzed in-depth. To such  issue, it is not an efficient way to work in this community since we may need more resources, which is not appropriate to handle in community. I’d like to suggest that you submit a service request to MS Professional tech support service so that a dedicated Support Professional can further assist with this request.
    Please visit the below link to see the various paid support options that are available to better meet your needs.

    Best Regards,

    Steven Song

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, February 7, 2014 1:12 PM
  • Hi Steven

    Thank your for the reply once again - we appreciate you taking the time to help.

    I have looked at the support options. We do not have any contract or subscriptions. That leaves us with the credit card option. We do feel that £199 is a lot of money to pay for one support request (although we really do need to get this sorted) esp as we have only had the software installed for a couple of months. We paid over £7000 for the Dell server and server software, so I would imagine a significant part of that is the server software. Are we not entitled to at least some free technical support as part of the software purchase? Most software comes with some technical support assistance. I'm suprised we pay all that money for a new server and software and Microsoft offer no free technical support.


    Trevor Bradley
    Buckingham Nurseries and Garden Centre

    Friday, February 7, 2014 4:54 PM
  • Steven

    Can I ask a question about the support request cost please? If we were to decide to pay out the £199 (which we are still reluctant to pay, this being a new install), would this be on a no fix - no fee basis? I mean what if MS cannot find the issue? Would the £199 be refunded? Or would MS work the case right through until a solution was found?


    Trevor Bradley
    Buckingham Nurseries and Garden Centre

    Thursday, February 20, 2014 5:06 PM
  • Hi,

    Yes, you are right. If the issue is not resolved, you could issue a refund.

    Thank you.

    Best Regards,

    Steven Song

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Saturday, February 22, 2014 11:20 AM
  • We finally go to the bottom of ths issue and so I am posting the solution in case this is an issue with someone else.

    The problem was with Symatec Endpoint Protection firewall on the server. Symantec advised to turn off the firewall on the server. Which works and no longer a problem. Not sure about turning off the firewall on a server, but Symantec seemed to think it was okay. We are site protected anyway.

    But that worked for us. No longer an issue with copy speeds.

    Friday, June 6, 2014 1:01 PM