OT: all systems on network slow for last week or so

Les,

Do your networks have TCP checksum offloading enabled or disabled on the
server and workstations?

I thought I had it disabled on both the SBS server and the workstation, but
it was enabled on the workstations. This tidbit was discovered after
reverting back to 5.0.

On a network with SBS 2003 SP2 (TCP checksum offloading off, RSS off, etc)
and XP Pro SP3 clients, should I expect any differences if I disable TCP
offloading on the workstations? Should I expect better or worse network
performance? I know in theory it should be better with the NIC doing some of
the work, but what about in real life?

I am waiting for Trend's response regarding their common firewall driver and
TCP checksum offloading.

Gregg Hill



"Les Connor" <> wrote in message
news:...
> Do you have more than one network that has this issue?
>
> I don't see it, have never seen it, and run 5.1 on 10 networks.
>
> --
> Les Connor [SBS-MVP]
>
>
> ____________________________
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in message news:...
>> Jim,
>>
>> Their tech support has gone to hell in a hand basket. No response other
>> than the initial one.
>>
>> A side note to you folks running WFBS 5.1 with normal speed. Do you have
>> TCP Checksum Offload enabled or disabled on your workstations? While
>> troubleshooting a problem with LogMeIn disconnecting behind WatchGuard
>> firewalls, I found out that my workstations had it enabled, when I
>> thought I had killed it at the same time I killed it on my server after
>> my SBS 2003 SP2 update.
>>
>> Turning it off on my workstations got rid of tons of errors in Wireshark
>> (which is how I knew it was on!), but I have no idea if those errors
>> could affect WFBS.
>>
>> Gregg Hill
>>
>>
>>
>>
>>
>>
>> "Jim Behning SBS MVP" <> wrote
>> in message news:...
>>> Interesting.
>>>
>>> I thought I saw something about AV causing a problem somewhere else.
>>> It will be interesting to hear what Trend knows.
>>>
>>> On Wed, 17 Dec 2008 21:18:13 -0800, "Gregg Hill" <greggmhill at please
>>> do not spam me at yahoo dot com> wrote:
>>>
>>>>Jim,
>>>>
>>>>I just got home from the client. I have determined with near-certainty
>>>>that
>>>>the problem is Trend Micro WFBS Advanced 5.1, initially an upgrade from
>>>>5.0,
>>>>which was an upgrade from 3.6. I had removed it completely from server
>>>>and
>>>>workstations and re-installed on 11/28/08 due to some left over registry
>>>>entries that had caused problems on my workstation.
>>>>
>>>>I checked five workstations, and all of them exhibited the same
>>>>behavior.
>>>>With the AV running, the UPS workstation would consistently take 1:30 to
>>>>start the UPS app the first time, and about 1:10 each consecutive time.
>>>>All
>>>>five computers would take 12-22 seconds to get to the MAS 90 login
>>>>prompt. I
>>>>would unload the AV, and the results would be roughly the same. MAS 90
>>>>dropped on some from 14 seconds to 9-10 seconds, but not on all of them.
>>>>
>>>>I noticed that even with the AV client unloaded, it still left the
>>>>"Trend
>>>>Micro Unauthorized Change Prevention Service" running. Killing that
>>>>service
>>>>made no difference.
>>>>
>>>>However, if I **removed** the AV client, the UPS app would take about
>>>>1:00
>>>>the first time I started it, and about 30-40 seconds each consecutive
>>>>time.
>>>>MAS 90 would show the prompt in 3.5 seconds. I tested over and over
>>>>again,
>>>>with the same results. Re-installing the AV client consistently brought
>>>>back
>>>>the slowness.
>>>>
>>>>I even removed all of last week's MS Updates on one system, without any
>>>>change. Some are XP Pro SP2, some are SP3, no difference between them.
>>>>
>>>>I will call Trend tomorrow.
>>>>
>>>>Gregg Hill
>>>>
>>>>
>>>>
>>>>
>>>>"Jim Behning SBS MVP" <>
>>>>wrote in
>>>>message news:...
>>>>> No one fussing and we have maybe 20 servers. Some do automatic
>>>>> updates. Some do not. We have enough that do automatic updates that we
>>>>> should have heard something.
>>>>>
>>>>> On Wed, 17 Dec 2008 17:56:02 -0800, "Gregg Hill" <greggmhill at please
>>>>> do not spam me at yahoo dot com> wrote:
>>>>>
>>>>>>Jim,
>>>>>>
>>>>>>Thank you for confirming I am not completely nuts...at least regarding
>>>>>>the
>>>>>>knowledge of the gateway IP, anyway.
>>>>>>
>>>>>>So, may I assume that the lack of other responses indicates others are
>>>>>>not
>>>>>>having an issue with the last round of MS Updates?
>>>>>>
>>>>>>Gregg Hill
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>"Jim Behning SBS MVP" <>
>>>>>>wrote
>>>>>>in
>>>>>>message news:...
>>>>>>> On Wed, 17 Dec 2008 07:25:01 -0800, Theiko
>>>>>>> <> wrote:
>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>"Gregg Hill" wrote:
>>>>>>>>
>>>>>>>>> Hello!
>>>>>>>>>
>>>>>>>>> For at least the last week, possibly following patch Tuesday, all
>>>>>>>>> XP
>>>>>>>>> Pro
>>>>>>>>> SP2
>>>>>>>>> and SP3 workstations on a client's SBS 2003 SP2 network are slow.
>>>>>>>>> On
>>>>>>>>> the
>>>>>>>>> server, patched three weeks ago to SP2, I have done all the
>>>>>>>>> post-SP2
>>>>>>>>> offload
>>>>>>>>> tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800
>>>>>>>>> server
>>>>>>>>> was
>>>>>>>>> completely updated, prior to SP2, with BIOS, BMC, backplane, NIC
>>>>>>>>> driver,
>>>>>>>>> video driver, etc.
>>>>>>>>>
>>>>>>>>> The workstations are slow to open applications, slow to save files
>>>>>>>>> to
>>>>>>>>> the
>>>>>>>>> server, slow to open local applications such as UPS WorldShip,
>>>>>>>>> Word,
>>>>>>>>> Excel,
>>>>>>>>> MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt
>>>>>>>>> takes
>>>>>>>>> 12 to
>>>>>>>>> 20 seconds, when it used to take 3 seconds. On the server, MAS 90
>>>>>>>>> shows
>>>>>>>>> the
>>>>>>>>> prompt in less than 3 seconds. Hmm.
>>>>>>>>>
>>>>>>>>> I have defragged several systems with no change. CPU usage does
>>>>>>>>> not
>>>>>>>>> increase
>>>>>>>>> over 20% when the systems are slow. Several workstations have
>>>>>>>>> Broadcom
>>>>>>>>> 440x
>>>>>>>>> NICs, all updated with latest driver.
>>>>>>>>>
>>>>>>>>> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both
>>>>>>>>> server
>>>>>>>>> and
>>>>>>>>> workstations, and systems are slow with it unloaded. I loaded
>>>>>>>>> QCheck
>>>>>>>>> and
>>>>>>>>> it
>>>>>>>>> shows data throughput at about 92Mbps both to and from
>>>>>>>>> workstation-server.
>>>>>>>>>
>>>>>>>>> All systems have been rebooted, including the server.
>>>>>>>>>
>>>>>>>>> SBS BPA gives a clean report.
>>>>>>>>>
>>>>>>>>> Any ideas? I am going to swap out the Dell 26-port switch (24
>>>>>>>>> 10/100
>>>>>>>>> and
>>>>>>>>> 2
>>>>>>>>> Gigabit) on a whim.
>>>>>>>>>
>>>>>>>>> Thank you!
>>>>>>>>>
>>>>>>>>> Gregg Hill
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> P.S. Because I know you'll ask, here are the ipconfig outputs.
>>>>>>>>>
>>>>>>>>> Workstation:
>>>>>>>>> Windows IP Configuration
>>>>>>>>> Host Name . . . . . . . . . . . . : OfficeMGR-XP
>>>>>>>>> Primary Dns Suffix . . . . . . . : office.internal
>>>>>>>>> Node Type . . . . . . . . . . . . : Hybrid
>>>>>>>>> IP Routing Enabled. . . . . . . . : No
>>>>>>>>> WINS Proxy Enabled. . . . . . . . : No
>>>>>>>>> DNS Suffix Search List. . . . . . : office.internal
>>>>>>>>> office.internal
>>>>>>>>>
>>>>>>>>> Ethernet adapter Local Area Connection:
>>>>>>>>> Connection-specific DNS Suffix . : office.internal
>>>>>>>>> Description . . . . . . . . . . . : Broadcom 440x 10/100
>>>>>>>>> Integrated
>>>>>>>>> Controller
>>>>>>>>> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
>>>>>>>>> Dhcp Enabled. . . . . . . . . . . : Yes
>>>>>>>>> Autoconfiguration Enabled . . . . : Yes
>>>>>>>>> IP Address. . . . . . . . . . . . : 192.168.1.113
>>>>>>>>> Subnet Mask . . . . . . . . . . . : 255.255.255.0
>>>>>>>>> Default Gateway . . . . . . . . . : 192.168.1.254
>>>>>>>>> DHCP Server . . . . . . . . . . . : 192.168.1.10
>>>>>>>>> DNS Servers . . . . . . . . . . . : 192.168.1.10
>>>>>>>>> Primary WINS Server . . . . . . . : 192.168.1.10
>>>>>>>>> Lease Obtained. . . . . . . . . . : Tuesday, December 16,
>>>>>>>>> 2008
>>>>>>>>> 11:11:23 PM
>>>>>>>>> Lease Expires . . . . . . . . . . : Wednesday, December
>>>>>>>>> 24,
>>>>>>>>> 2008
>>>>>>>>> 11:11:23 PM
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> SBS 2003 SP:
>>>>>>>>> Windows IP Configuration
>>>>>>>>> Host Name . . . . . . . . . . . . : MXPDC
>>>>>>>>> Primary Dns Suffix . . . . . . . : office.internal
>>>>>>>>> Node Type . . . . . . . . . . . . : Hybrid
>>>>>>>>> IP Routing Enabled. . . . . . . . : No
>>>>>>>>> WINS Proxy Enabled. . . . . . . . : No
>>>>>>>>> DNS Suffix Search List. . . . . . : office.internal
>>>>>>>>>
>>>>>>>>> Ethernet adapter Network Connection:
>>>>>>>>>
>>>>>>>>> Connection-specific DNS Suffix . :
>>>>>>>>> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT
>>>>>>>>> Network
>>>>>>>>> Connection
>>>>>>>>> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
>>>>>>>>> DHCP Enabled. . . . . . . . . . . : No
>>>>>>>>> IP Address. . . . . . . . . . . . : 192.168.1.10
>>>>>>>>> Subnet Mask . . . . . . . . . . . : 255.255.255.0
>>>>>>>>> Default Gateway . . . . . . . . . : 192.168.1.254
>>>>>>>>> DNS Servers . . . . . . . . . . . : 192.168.1.10
>>>>>>>>> Primary WINS Server . . . . . . . : 192.168.1.10
>>>>>>>>>
>>>>>>>>> Hello Gregg,
>>>>>>>>
>>>>>>>>Possibly the setting of your "Default Gateways" on your
>>>>>>>>XP-Workstations
>>>>>>>>are
>>>>>>>>responsible for the problem. In SBS-networks there should be the
>>>>>>>>ip-adress
>>>>>>>>of
>>>>>>>>the SBS-server itself. Good luck.
>>>>>>>>
>>>>>>>>>
>>>>>>> Not if you are running a single nic server with a router.
>>>>>>> See what SBS support is working on
>>>>>>> http://blogs.technet.com/sbs/default.aspx
>>>>>>> Check your SBS with the SBS Best Practices Analyzer
>>>>>>> http://blogs.technet.com/sbs/archive...A/default.aspx
>>>>>>
>>>>> See what SBS support is working on
>>>>> http://blogs.technet.com/sbs/default.aspx
>>>>> Check your SBS with the SBS Best Practices Analyzer
>>>>> http://blogs.technet.com/sbs/archive...A/default.aspx
>>>>
>>> See what SBS support is working on
>>> http://blogs.technet.com/sbs/default.aspx
>>> Check your SBS with the SBS Best Practices Analyzer
>>> http://blogs.technet.com/sbs/archive...A/default.aspx
>>
>>
>

I've not fiddled with the workstation nic settings at all. I don't even know
if any of my workstations have those capabilities.

--
-----------------------------------------------
Les Connor [SBS MVP]

"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
message news:#...
> Les,
>
> Do your networks have TCP checksum offloading enabled or disabled on the
> server and workstations?
>
> I thought I had it disabled on both the SBS server and the workstation,
> but it was enabled on the workstations. This tidbit was discovered after
> reverting back to 5.0.
>
> On a network with SBS 2003 SP2 (TCP checksum offloading off, RSS off, etc)
> and XP Pro SP3 clients, should I expect any differences if I disable TCP
> offloading on the workstations? Should I expect better or worse network
> performance? I know in theory it should be better with the NIC doing some
> of the work, but what about in real life?
>
> I am waiting for Trend's response regarding their common firewall driver
> and TCP checksum offloading.
>
> Gregg Hill
>
>
>
> "Les Connor" <> wrote in message
> news:...
>> Do you have more than one network that has this issue?
>>
>> I don't see it, have never seen it, and run 5.1 on 10 networks.
>>
>> --
>> Les Connor [SBS-MVP]
>>
>>
>> ____________________________
>> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
>> in message news:...
>>> Jim,
>>>
>>> Their tech support has gone to hell in a hand basket. No response other
>>> than the initial one.
>>>
>>> A side note to you folks running WFBS 5.1 with normal speed. Do you have
>>> TCP Checksum Offload enabled or disabled on your workstations? While
>>> troubleshooting a problem with LogMeIn disconnecting behind WatchGuard
>>> firewalls, I found out that my workstations had it enabled, when I
>>> thought I had killed it at the same time I killed it on my server after
>>> my SBS 2003 SP2 update.
>>>
>>> Turning it off on my workstations got rid of tons of errors in Wireshark
>>> (which is how I knew it was on!), but I have no idea if those errors
>>> could affect WFBS.
>>>
>>> Gregg Hill
>>>
>>>
>>>
>>>
>>>
>>>
>>> "Jim Behning SBS MVP" <>
>>> wrote in message news:...
>>>> Interesting.
>>>>
>>>> I thought I saw something about AV causing a problem somewhere else.
>>>> It will be interesting to hear what Trend knows.
>>>>
>>>> On Wed, 17 Dec 2008 21:18:13 -0800, "Gregg Hill" <greggmhill at please
>>>> do not spam me at yahoo dot com> wrote:
>>>>
>>>>>Jim,
>>>>>
>>>>>I just got home from the client. I have determined with near-certainty
>>>>>that
>>>>>the problem is Trend Micro WFBS Advanced 5.1, initially an upgrade from
>>>>>5.0,
>>>>>which was an upgrade from 3.6. I had removed it completely from server
>>>>>and
>>>>>workstations and re-installed on 11/28/08 due to some left over
>>>>>registry
>>>>>entries that had caused problems on my workstation.
>>>>>
>>>>>I checked five workstations, and all of them exhibited the same
>>>>>behavior.
>>>>>With the AV running, the UPS workstation would consistently take 1:30
>>>>>to
>>>>>start the UPS app the first time, and about 1:10 each consecutive time.
>>>>>All
>>>>>five computers would take 12-22 seconds to get to the MAS 90 login
>>>>>prompt. I
>>>>>would unload the AV, and the results would be roughly the same. MAS 90
>>>>>dropped on some from 14 seconds to 9-10 seconds, but not on all of
>>>>>them.
>>>>>
>>>>>I noticed that even with the AV client unloaded, it still left the
>>>>>"Trend
>>>>>Micro Unauthorized Change Prevention Service" running. Killing that
>>>>>service
>>>>>made no difference.
>>>>>
>>>>>However, if I **removed** the AV client, the UPS app would take about
>>>>>1:00
>>>>>the first time I started it, and about 30-40 seconds each consecutive
>>>>>time.
>>>>>MAS 90 would show the prompt in 3.5 seconds. I tested over and over
>>>>>again,
>>>>>with the same results. Re-installing the AV client consistently brought
>>>>>back
>>>>>the slowness.
>>>>>
>>>>>I even removed all of last week's MS Updates on one system, without any
>>>>>change. Some are XP Pro SP2, some are SP3, no difference between them.
>>>>>
>>>>>I will call Trend tomorrow.
>>>>>
>>>>>Gregg Hill
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>"Jim Behning SBS MVP" <>
>>>>>wrote in
>>>>>message news:...
>>>>>> No one fussing and we have maybe 20 servers. Some do automatic
>>>>>> updates. Some do not. We have enough that do automatic updates that
>>>>>> we
>>>>>> should have heard something.
>>>>>>
>>>>>> On Wed, 17 Dec 2008 17:56:02 -0800, "Gregg Hill" <greggmhill at
>>>>>> please
>>>>>> do not spam me at yahoo dot com> wrote:
>>>>>>
>>>>>>>Jim,
>>>>>>>
>>>>>>>Thank you for confirming I am not completely nuts...at least
>>>>>>>regarding the
>>>>>>>knowledge of the gateway IP, anyway.
>>>>>>>
>>>>>>>So, may I assume that the lack of other responses indicates others
>>>>>>>are not
>>>>>>>having an issue with the last round of MS Updates?
>>>>>>>
>>>>>>>Gregg Hill
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>"Jim Behning SBS MVP" <>
>>>>>>>wrote
>>>>>>>in
>>>>>>>message news:...
>>>>>>>> On Wed, 17 Dec 2008 07:25:01 -0800, Theiko
>>>>>>>> <> wrote:
>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>"Gregg Hill" wrote:
>>>>>>>>>
>>>>>>>>>> Hello!
>>>>>>>>>>
>>>>>>>>>> For at least the last week, possibly following patch Tuesday, all
>>>>>>>>>> XP
>>>>>>>>>> Pro
>>>>>>>>>> SP2
>>>>>>>>>> and SP3 workstations on a client's SBS 2003 SP2 network are slow.
>>>>>>>>>> On
>>>>>>>>>> the
>>>>>>>>>> server, patched three weeks ago to SP2, I have done all the
>>>>>>>>>> post-SP2
>>>>>>>>>> offload
>>>>>>>>>> tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800
>>>>>>>>>> server
>>>>>>>>>> was
>>>>>>>>>> completely updated, prior to SP2, with BIOS, BMC, backplane, NIC
>>>>>>>>>> driver,
>>>>>>>>>> video driver, etc.
>>>>>>>>>>
>>>>>>>>>> The workstations are slow to open applications, slow to save
>>>>>>>>>> files to
>>>>>>>>>> the
>>>>>>>>>> server, slow to open local applications such as UPS WorldShip,
>>>>>>>>>> Word,
>>>>>>>>>> Excel,
>>>>>>>>>> MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt
>>>>>>>>>> takes
>>>>>>>>>> 12 to
>>>>>>>>>> 20 seconds, when it used to take 3 seconds. On the server, MAS 90
>>>>>>>>>> shows
>>>>>>>>>> the
>>>>>>>>>> prompt in less than 3 seconds. Hmm.
>>>>>>>>>>
>>>>>>>>>> I have defragged several systems with no change. CPU usage does
>>>>>>>>>> not
>>>>>>>>>> increase
>>>>>>>>>> over 20% when the systems are slow. Several workstations have
>>>>>>>>>> Broadcom
>>>>>>>>>> 440x
>>>>>>>>>> NICs, all updated with latest driver.
>>>>>>>>>>
>>>>>>>>>> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both
>>>>>>>>>> server
>>>>>>>>>> and
>>>>>>>>>> workstations, and systems are slow with it unloaded. I loaded
>>>>>>>>>> QCheck
>>>>>>>>>> and
>>>>>>>>>> it
>>>>>>>>>> shows data throughput at about 92Mbps both to and from
>>>>>>>>>> workstation-server.
>>>>>>>>>>
>>>>>>>>>> All systems have been rebooted, including the server.
>>>>>>>>>>
>>>>>>>>>> SBS BPA gives a clean report.
>>>>>>>>>>
>>>>>>>>>> Any ideas? I am going to swap out the Dell 26-port switch (24
>>>>>>>>>> 10/100
>>>>>>>>>> and
>>>>>>>>>> 2
>>>>>>>>>> Gigabit) on a whim.
>>>>>>>>>>
>>>>>>>>>> Thank you!
>>>>>>>>>>
>>>>>>>>>> Gregg Hill
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> P.S. Because I know you'll ask, here are the ipconfig outputs.
>>>>>>>>>>
>>>>>>>>>> Workstation:
>>>>>>>>>> Windows IP Configuration
>>>>>>>>>> Host Name . . . . . . . . . . . . : OfficeMGR-XP
>>>>>>>>>> Primary Dns Suffix . . . . . . . : office.internal
>>>>>>>>>> Node Type . . . . . . . . . . . . : Hybrid
>>>>>>>>>> IP Routing Enabled. . . . . . . . : No
>>>>>>>>>> WINS Proxy Enabled. . . . . . . . : No
>>>>>>>>>> DNS Suffix Search List. . . . . . : office.internal
>>>>>>>>>> office.internal
>>>>>>>>>>
>>>>>>>>>> Ethernet adapter Local Area Connection:
>>>>>>>>>> Connection-specific DNS Suffix . : office.internal
>>>>>>>>>> Description . . . . . . . . . . . : Broadcom 440x 10/100
>>>>>>>>>> Integrated
>>>>>>>>>> Controller
>>>>>>>>>> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
>>>>>>>>>> Dhcp Enabled. . . . . . . . . . . : Yes
>>>>>>>>>> Autoconfiguration Enabled . . . . : Yes
>>>>>>>>>> IP Address. . . . . . . . . . . . : 192.168.1.113
>>>>>>>>>> Subnet Mask . . . . . . . . . . . : 255.255.255.0
>>>>>>>>>> Default Gateway . . . . . . . . . : 192.168.1.254
>>>>>>>>>> DHCP Server . . . . . . . . . . . : 192.168.1.10
>>>>>>>>>> DNS Servers . . . . . . . . . . . : 192.168.1.10
>>>>>>>>>> Primary WINS Server . . . . . . . : 192.168.1.10
>>>>>>>>>> Lease Obtained. . . . . . . . . . : Tuesday, December 16,
>>>>>>>>>> 2008
>>>>>>>>>> 11:11:23 PM
>>>>>>>>>> Lease Expires . . . . . . . . . . : Wednesday, December
>>>>>>>>>> 24,
>>>>>>>>>> 2008
>>>>>>>>>> 11:11:23 PM
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> SBS 2003 SP:
>>>>>>>>>> Windows IP Configuration
>>>>>>>>>> Host Name . . . . . . . . . . . . : MXPDC
>>>>>>>>>> Primary Dns Suffix . . . . . . . : office.internal
>>>>>>>>>> Node Type . . . . . . . . . . . . : Hybrid
>>>>>>>>>> IP Routing Enabled. . . . . . . . : No
>>>>>>>>>> WINS Proxy Enabled. . . . . . . . : No
>>>>>>>>>> DNS Suffix Search List. . . . . . : office.internal
>>>>>>>>>>
>>>>>>>>>> Ethernet adapter Network Connection:
>>>>>>>>>>
>>>>>>>>>> Connection-specific DNS Suffix . :
>>>>>>>>>> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT
>>>>>>>>>> Network
>>>>>>>>>> Connection
>>>>>>>>>> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
>>>>>>>>>> DHCP Enabled. . . . . . . . . . . : No
>>>>>>>>>> IP Address. . . . . . . . . . . . : 192.168.1.10
>>>>>>>>>> Subnet Mask . . . . . . . . . . . : 255.255.255.0
>>>>>>>>>> Default Gateway . . . . . . . . . : 192.168.1.254
>>>>>>>>>> DNS Servers . . . . . . . . . . . : 192.168.1.10
>>>>>>>>>> Primary WINS Server . . . . . . . : 192.168.1.10
>>>>>>>>>>
>>>>>>>>>> Hello Gregg,
>>>>>>>>>
>>>>>>>>>Possibly the setting of your "Default Gateways" on your
>>>>>>>>>XP-Workstations
>>>>>>>>>are
>>>>>>>>>responsible for the problem. In SBS-networks there should be the
>>>>>>>>>ip-adress
>>>>>>>>>of
>>>>>>>>>the SBS-server itself. Good luck.
>>>>>>>>>
>>>>>>>>>>
>>>>>>>> Not if you are running a single nic server with a router.
>>>>>>>> See what SBS support is working on
>>>>>>>> http://blogs.technet.com/sbs/default.aspx
>>>>>>>> Check your SBS with the SBS Best Practices Analyzer
>>>>>>>> http://blogs.technet.com/sbs/archive...A/default.aspx
>>>>>>>
>>>>>> See what SBS support is working on
>>>>>> http://blogs.technet.com/sbs/default.aspx
>>>>>> Check your SBS with the SBS Best Practices Analyzer
>>>>>> http://blogs.technet.com/sbs/archive...A/default.aspx
>>>>>
>>>> See what SBS support is working on
>>>> http://blogs.technet.com/sbs/default.aspx
>>>> Check your SBS with the SBS Best Practices Analyzer
>>>> http://blogs.technet.com/sbs/archive...A/default.aspx
>>>
>>>
>>
>
>

Trend Micro support just called me and confirmed that they have a known
problem with the common firewall driver causing slowness in WFBS 5.1. They
are working on a patch but have no ETA.

Gregg Hill



"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
message news:...
> Hello!
>
> For at least the last week, possibly following patch Tuesday, all XP Pro
> SP2 and SP3 workstations on a client's SBS 2003 SP2 network are slow. On
> the server, patched three weeks ago to SP2, I have done all the post-SP2
> offload tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800
> server was completely updated, prior to SP2, with BIOS, BMC, backplane,
> NIC driver, video driver, etc.
>
> The workstations are slow to open applications, slow to save files to the
> server, slow to open local applications such as UPS WorldShip, Word,
> Excel, MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt
> takes 12 to 20 seconds, when it used to take 3 seconds. On the server, MAS
> 90 shows the prompt in less than 3 seconds. Hmm.
>
> I have defragged several systems with no change. CPU usage does not
> increase over 20% when the systems are slow. Several workstations have
> Broadcom 440x NICs, all updated with latest driver.
>
> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server
> and workstations, and systems are slow with it unloaded. I loaded QCheck
> and it shows data throughput at about 92Mbps both to and from
> workstation-server.
>
> All systems have been rebooted, including the server.
>
> SBS BPA gives a clean report.
>
> Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
> Gigabit) on a whim.
>
> Thank you!
>
> Gregg Hill
>
>
> P.S. Because I know you'll ask, here are the ipconfig outputs.
>
> Workstation:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : OfficeMGR-XP
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
> office.internal
>
> Ethernet adapter Local Area Connection:
> Connection-specific DNS Suffix . : office.internal
> Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
> Controller
> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : 192.168.1.113
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DHCP Server . . . . . . . . . . . : 192.168.1.10
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
> Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
> 11:11:23 PM
> Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
> 11:11:23 PM
>
>
> SBS 2003 SP:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : MXPDC
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
>
> Ethernet adapter Network Connection:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> Connection
> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.1.10
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
>

Can you update me on the status of this client?

I have a good bit of experience with Trend and mas90.



Gregg Hill wrote:

OT: all systems on network slow for last week or so
17-Dec-08

Hello

For at least the last week, possibly following patch Tuesday, all XP Pro SP2
and SP3 workstations on a client's SBS 2003 SP2 network are slow. On the
server, patched three weeks ago to SP2, I have done all the post-SP2 offload
tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800 server was
completely updated, prior to SP2, with BIOS, BMC, backplane, NIC driver,
video driver, etc

The workstations are slow to open applications, slow to save files to the
server, slow to open local applications such as UPS WorldShip, Word, Excel,
MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt takes 12 to
20 seconds, when it used to take 3 seconds. On the server, MAS 90 shows the
prompt in less than 3 seconds. Hmm

I have defragged several systems with no change. CPU usage does not increase
over 20% when the systems are slow. Several workstations have Broadcom 440x
NICs, all updated with latest driver

Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server and
workstations, and systems are slow with it unloaded. I loaded QCheck and it
shows data throughput at about 92Mbps both to and from workstation-server

All systems have been rebooted, including the server

SBS BPA gives a clean report

Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
Gigabit) on a whim

Thank you

Gregg Hil

P.S. Because I know you'll ask, here are the ipconfig outputs

Workstation
Windows IP Configuratio
Host Name . . . . . . . . . . . . : OfficeMGR-X
Primary Dns Suffix . . . . . . . : office.interna
Node Type . . . . . . . . . . . . : Hybri
IP Routing Enabled. . . . . . . . : N
WINS Proxy Enabled. . . . . . . . : N
DNS Suffix Search List. . . . . . : office.interna
office.interna

Ethernet adapter Local Area Connection
Connection-specific DNS Suffix . : office.interna
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
Controlle
Physical Address. . . . . . . . . : 00-0D-56-xx-xx-x
Dhcp Enabled. . . . . . . . . . . : Ye
Autoconfiguration Enabled . . . . : Ye
IP Address. . . . . . . . . . . . : 192.168.1.11
Subnet Mask . . . . . . . . . . . : 255.255.255.
Default Gateway . . . . . . . . . : 192.168.1.25
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
Primary WINS Server . . . . . . . : 192.168.1.1
Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
11:11:23 P
Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
11:11:23 P

SBS 2003 SP
Windows IP Configuratio
Host Name . . . . . . . . . . . . : MXPD
Primary Dns Suffix . . . . . . . : office.interna
Node Type . . . . . . . . . . . . : Hybri
IP Routing Enabled. . . . . . . . : N
WINS Proxy Enabled. . . . . . . . : N
DNS Suffix Search List. . . . . . : office.interna

Ethernet adapter Network Connection

Connection-specific DNS Suffix .
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
Connectio
Physical Address. . . . . . . . . : 00-11-43-xx-xx-x
DHCP Enabled. . . . . . . . . . . : N
IP Address. . . . . . . . . . . . : 192.168.1.1
Subnet Mask . . . . . . . . . . . : 255.255.255.
Default Gateway . . . . . . . . . : 192.168.1.25
DNS Servers . . . . . . . . . . . : 192.168.1.1
Primary WINS Server . . . . . . . : 192.168.1.10

Previous Posts In This Thread:

On Wednesday, December 17, 2008 3:07 AM
Gregg Hill wrote:

OT: all systems on network slow for last week or so
Hello

For at least the last week, possibly following patch Tuesday, all XP Pro SP2
and SP3 workstations on a client's SBS 2003 SP2 network are slow. On the
server, patched three weeks ago to SP2, I have done all the post-SP2 offload
tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800 server was
completely updated, prior to SP2, with BIOS, BMC, backplane, NIC driver,
video driver, etc.

The workstations are slow to open applications, slow to save files to the
server, slow to open local applications such as UPS WorldShip, Word, Excel,
MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt takes 12 to
20 seconds, when it used to take 3 seconds. On the server, MAS 90 shows the
prompt in less than 3 seconds. Hmm.

I have defragged several systems with no change. CPU usage does not increase
over 20% when the systems are slow. Several workstations have Broadcom 440x
NICs, all updated with latest driver.

Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server and
workstations, and systems are slow with it unloaded. I loaded QCheck and it
shows data throughput at about 92Mbps both to and from workstation-server.

All systems have been rebooted, including the server.

SBS BPA gives a clean report.

Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
Gigabit) on a whim.

Thank you!

Gregg Hill


P.S. Because I know you'll ask, here are the ipconfig outputs.

Workstation:
Windows IP Configuration
Host Name . . . . . . . . . . . . : OfficeMGR-XP
Primary Dns Suffix . . . . . . . : office.internal
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : office.internal
office.internal

Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : office.internal
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
Controller
Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.113
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.254
DHCP Server . . . . . . . . . . . : 192.168.1.10
DNS Servers . . . . . . . . . . . : 192.168.1.10
Primary WINS Server . . . . . . . : 192.168.1.10
Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
11:11:23 PM
Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
11:11:23 PM


SBS 2003 SP:
Windows IP Configuration
Host Name . . . . . . . . . . . . : MXPDC
Primary Dns Suffix . . . . . . . : office.internal
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : office.internal

Ethernet adapter Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
Connection
Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.254
DNS Servers . . . . . . . . . . . : 192.168.1.10
Primary WINS Server . . . . . . . : 192.168.1.10

On Wednesday, December 17, 2008 4:50 AM
Neil Hoskins wrote:

"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
<snip>

You're northern hemisphere, right? Standard case of SAD; I have got it too.

;-)

On Wednesday, December 17, 2008 10:25 AM
Theik wrote:

RE: OT: all systems on network slow for last week or so
"Gregg Hill" wrote:


Possibly the setting of your "Default Gateways" on your XP-Workstations are
responsible for the problem. In SBS-networks there should be the ip-adress of
the SBS-server itself. Good luck.

On Wednesday, December 17, 2008 11:36 AM
Jim Behning SBS MVP wrote:

Re: OT: all systems on network slow for last week or so
On Wed, 17 Dec 2008 07:25:01 -0800, Theiko
<> wrote:

Not if you are running a single nic server with a router.
See what SBS support is working on
http://blogs.technet.com/sbs/default.aspx
Check your SBS with the SBS Best Practices Analyzer
http://blogs.technet.com/sbs/archive...A/default.aspx

On Wednesday, December 17, 2008 8:50 PM
Gregg Hill wrote:

Neil,Other than just yanking my chain, was there a point to your comment?
Neil,

Other than just yanking my chain, was there a point to your comment?

I do not get it.

Greg

"Neil Hoskins" <> wrote in

On Wednesday, December 17, 2008 8:53 PM
Gregg Hill wrote:

Theiko,Jim Behning beat me to the answer of "Not if you are running a single
Theiko

Jim Behning beat me to the answer of "Not if you are running a single nic
server with a router.

Besides, that has been the gateway since day one (four years ago), and this
problem is only a week or so old

Gregg Hil


"Theiko" <> wrote in message
news:9C39C355-FB51-4F35-92A0-...

On Wednesday, December 17, 2008 8:56 PM
Gregg Hill wrote:

Jim,Thank you for confirming I am not completely nuts...
Jim

Thank you for confirming I am not completely nuts...at least regarding the
knowledge of the gateway IP, anyway

So, may I assume that the lack of other responses indicates others are not
having an issue with the last round of MS Updates

Gregg Hil


"Jim Behning SBS MVP" <> wrote in
message news:...

On Wednesday, December 17, 2008 10:41 PM
Jim Behning SBS MVP wrote:

No one fussing and we have maybe 20 servers. Some do automaticupdates.
No one fussing and we have maybe 20 servers. Some do automati
updates. Some do not. We have enough that do automatic updates that w
should have heard something

On Wed, 17 Dec 2008 17:56:02 -0800, "Gregg Hill" <greggmhill at pleas
do not spam me at yahoo dot com> wrote

See what SBS support is working o
http://blogs.technet.com/sbs/default.asp
Check your SBS with the SBS Best Practices Analyze
http://blogs.technet.com/sbs/archive...A/default.aspx

On Thursday, December 18, 2008 12:18 AM
Gregg Hill wrote:

Jim,I just got home from the client.
Jim

I just got home from the client. I have determined with near-certainty that
the problem is Trend Micro WFBS Advanced 5.1, initially an upgrade from 5.0,
which was an upgrade from 3.6. I had removed it completely from server and
workstations and re-installed on 11/28/08 due to some left over registry
entries that had caused problems on my workstation

I checked five workstations, and all of them exhibited the same behavior.
With the AV running, the UPS workstation would consistently take 1:30 to
start the UPS app the first time, and about 1:10 each consecutive time. All
five computers would take 12-22 seconds to get to the MAS 90 login prompt. I
would unload the AV, and the results would be roughly the same. MAS 90
dropped on some from 14 seconds to 9-10 seconds, but not on all of them

I noticed that even with the AV client unloaded, it still left the "Trend
Micro Unauthorized Change Prevention Service" running. Killing that service
made no difference

However, if I **removed** the AV client, the UPS app would take about 1:00
the first time I started it, and about 30-40 seconds each consecutive time.
MAS 90 would show the prompt in 3.5 seconds. I tested over and over again,
with the same results. Re-installing the AV client consistently brought back
the slowness

I even removed all of last week's MS Updates on one system, without any
change. Some are XP Pro SP2, some are SP3, no difference between them

I will call Trend tomorrow

Gregg Hil


"Jim Behning SBS MVP" <> wrote in
message news:...

On Thursday, December 18, 2008 8:59 AM
Jim Behning SBS MVP wrote:

Interesting.
Interesting

I thought I saw something about AV causing a problem somewhere else
It will be interesting to hear what Trend knows

On Wed, 17 Dec 2008 21:18:13 -0800, "Gregg Hill" <greggmhill at pleas
do not spam me at yahoo dot com> wrote

See what SBS support is working o
http://blogs.technet.com/sbs/default.asp
Check your SBS with the SBS Best Practices Analyze
http://blogs.technet.com/sbs/archive...A/default.aspx

On Sunday, January 04, 2009 3:35 AM
Gregg Hill wrote:

Jim,Their tech support has gone to hell in a hand basket.
Jim

Their tech support has gone to hell in a hand basket. No response other than
the initial one.

A side note to you folks running WFBS 5.1 with normal speed. Do you have TCP
Checksum Offload enabled or disabled on your workstations? While
troubleshooting a problem with LogMeIn disconnecting behind WatchGuard
firewalls, I found out that my workstations had it enabled, when I thought I
had killed it at the same time I killed it on my server after my SBS 2003
SP2 update.

Turning it off on my workstations got rid of tons of errors in Wireshark
(which is how I knew it was on!), but I have no idea if those errors could
affect WFBS.

Gregg Hill






"Jim Behning SBS MVP" <> wrote in
message news:...

On Sunday, January 04, 2009 10:16 AM
Les Connor wrote:

Do you have more than one network that has this issue?
Do you have more than one network that has this issue?

I don't see it, have never seen it, and run 5.1 on 10 networks.

--
Les Connor [SBS-MVP]


____________________________
"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
message news:...

On Sunday, January 04, 2009 3:49 PM
Gregg Hill wrote:

Les,Both networks where I went from 5.0 to 5.1 slowed down.
Les,

Both networks where I went from 5.0 to 5.1 slowed down. The ONLY computer on
my client's network that did not slow down was the server itself. My client
has MAS 90 for Windows, and Blytheco installed it years ago, including a MAS
90 workstation installation on the server for them to use. On the server,
even with WFBS 5.1, I could open MAS 90 and get the login prompt in a couple
of seconds. The workstations went from opening in about 3-4 seconds to
taking up to 22 seconds just to get the prompt, and slow to do everything
else once they logged into MAS 90.

Other apps (UPS, Excel, Word, web browsing) all slowed down. They complained
of "slow Internet access" as well. My post form 12/17 at 9:18PM gives more
detail.

Even my wife who is not a speed demon asked what I had done to her computer.

I am afraid to "upgrade" anyone else to it.

Gregg Hill




"Les Connor" <> wrote in message
news:...

On Monday, January 12, 2009 1:20 PM
Gregg Hill wrote:

Les,Do your networks have TCP checksum offloading enabled or disabled on the
Les,

Do your networks have TCP checksum offloading enabled or disabled on the
server and workstations?

I thought I had it disabled on both the SBS server and the workstation, but
it was enabled on the workstations. This tidbit was discovered after
reverting back to 5.0.

On a network with SBS 2003 SP2 (TCP checksum offloading off, RSS off, etc)
and XP Pro SP3 clients, should I expect any differences if I disable TCP
offloading on the workstations? Should I expect better or worse network
performance? I know in theory it should be better with the NIC doing some of
the work, but what about in real life?

I am waiting for Trend's response regarding their common firewall driver and
TCP checksum offloading.

Gregg Hill



"Les Connor" <> wrote in message
news:...

On Monday, January 12, 2009 1:47 PM
Les Connor wrote:

I've not fiddled with the workstation nic settings at all.
I've not fiddled with the workstation nic settings at all. I don't even know
if any of my workstations have those capabilities.

--
-----------------------------------------------
Les Connor [SBS MVP]

"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
message news:#...

On Thursday, January 15, 2009 12:42 PM
Gregg Hill wrote:

Trend Micro support just called me and confirmed that they have a known
Trend Micro support just called me and confirmed that they have a known
problem with the common firewall driver causing slowness in WFBS 5.1. They
are working on a patch but have no ETA.

Gregg Hill



"Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote in
message news:...

On Sunday, February 01, 2009 6:32 AM
Ryan wrote:

This is a problem, for sure with WFBS 5.1.
This is a problem, for sure with WFBS 5.1. I too have the same problem
and the FW patch that came out on the 27th has not helped. Just FYI.
I too have extreme slowdown that is really disappointing.

EggHeadCafe - Software Developer Portal of Choice
Excel macro for creating and manipulating charts
http://www.eggheadcafe.com/tutorials...-creating.aspx

Carey,

Your timing is incredible! I just got an email a few minutes ago from Ingram
Micro asking me to become a reseller. I informed them that I am already a
reseller, and a quite unhappy one at that. I then flamed Trend Micro for its
horrible malware catch rates and network slowness problems.

Regarding that client, the slowness was all caused by an "upgrade" from WFBS
5.0 to 5.1. Reverting to WFBS 5.0 fixed all the slowness problems, and that
is where that client remains today out of fear that installing WFBS 6.0 will
have the same problems, as evidenced by many complaints in here.

I am holding off on any upgrades until I know that WFBS 6.0 SP1 is stable
and does not cause slowness.

Gregg Hill


<carey mansfield> wrote in message
news:...
> Can you update me on the status of this client?
>
> I have a good bit of experience with Trend and mas90.
>
>
>
> Gregg Hill wrote:
>
> OT: all systems on network slow for last week or so
> 17-Dec-08
>
> Hello!
>
> For at least the last week, possibly following patch Tuesday, all XP Pro
> SP2
> and SP3 workstations on a client's SBS 2003 SP2 network are slow. On the
> server, patched three weeks ago to SP2, I have done all the post-SP2
> offload
> tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800 server
> was
> completely updated, prior to SP2, with BIOS, BMC, backplane, NIC driver,
> video driver, etc.
>
> The workstations are slow to open applications, slow to save files to the
> server, slow to open local applications such as UPS WorldShip, Word,
> Excel,
> MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt takes 12
> to
> 20 seconds, when it used to take 3 seconds. On the server, MAS 90 shows
> the
> prompt in less than 3 seconds. Hmm.
>
> I have defragged several systems with no change. CPU usage does not
> increase
> over 20% when the systems are slow. Several workstations have Broadcom
> 440x
> NICs, all updated with latest driver.
>
> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server
> and
> workstations, and systems are slow with it unloaded. I loaded QCheck and
> it
> shows data throughput at about 92Mbps both to and from workstation-server.
>
> All systems have been rebooted, including the server.
>
> SBS BPA gives a clean report.
>
> Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
> Gigabit) on a whim.
>
> Thank you!
>
> Gregg Hill
>
>
> P.S. Because I know you'll ask, here are the ipconfig outputs.
>
> Workstation:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : OfficeMGR-XP
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
> office.internal
>
> Ethernet adapter Local Area Connection:
> Connection-specific DNS Suffix . : office.internal
> Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
> Controller
> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : 192.168.1.113
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DHCP Server . . . . . . . . . . . : 192.168.1.10
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
> Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
> 11:11:23 PM
> Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
> 11:11:23 PM
>
>
> SBS 2003 SP:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : MXPDC
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
>
> Ethernet adapter Network Connection:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> Connection
> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.1.10
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
>
> Previous Posts In This Thread:
>
> On Wednesday, December 17, 2008 3:07 AM
> Gregg Hill wrote:
>
> OT: all systems on network slow for last week or so
> Hello!
>
> For at least the last week, possibly following patch Tuesday, all XP Pro
> SP2
> and SP3 workstations on a client's SBS 2003 SP2 network are slow. On the
> server, patched three weeks ago to SP2, I have done all the post-SP2
> offload
> tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800 server
> was
> completely updated, prior to SP2, with BIOS, BMC, backplane, NIC driver,
> video driver, etc.
>
> The workstations are slow to open applications, slow to save files to the
> server, slow to open local applications such as UPS WorldShip, Word,
> Excel,
> MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt takes 12
> to
> 20 seconds, when it used to take 3 seconds. On the server, MAS 90 shows
> the
> prompt in less than 3 seconds. Hmm.
>
> I have defragged several systems with no change. CPU usage does not
> increase
> over 20% when the systems are slow. Several workstations have Broadcom
> 440x
> NICs, all updated with latest driver.
>
> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server
> and
> workstations, and systems are slow with it unloaded. I loaded QCheck and
> it
> shows data throughput at about 92Mbps both to and from workstation-server.
>
> All systems have been rebooted, including the server.
>
> SBS BPA gives a clean report.
>
> Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
> Gigabit) on a whim.
>
> Thank you!
>
> Gregg Hill
>
>
> P.S. Because I know you'll ask, here are the ipconfig outputs.
>
> Workstation:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : OfficeMGR-XP
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
> office.internal
>
> Ethernet adapter Local Area Connection:
> Connection-specific DNS Suffix . : office.internal
> Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
> Controller
> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : 192.168.1.113
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DHCP Server . . . . . . . . . . . : 192.168.1.10
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
> Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
> 11:11:23 PM
> Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
> 11:11:23 PM
>
>
> SBS 2003 SP:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : MXPDC
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
>
> Ethernet adapter Network Connection:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> Connection
> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.1.10
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
>
> On Wednesday, December 17, 2008 4:50 AM
> Neil Hoskins wrote:
>
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> <snip>
>
> You're northern hemisphere, right? Standard case of SAD; I have got it
> too.
>
> ;-)
>
> On Wednesday, December 17, 2008 10:25 AM
> Theik wrote:
>
> RE: OT: all systems on network slow for last week or so
> "Gregg Hill" wrote:
>
>
> Possibly the setting of your "Default Gateways" on your XP-Workstations
> are
> responsible for the problem. In SBS-networks there should be the ip-adress
> of
> the SBS-server itself. Good luck.
>
> On Wednesday, December 17, 2008 11:36 AM
>Jim Behning SBS MVP wrote:
>
> Re: OT: all systems on network slow for last week or so
> On Wed, 17 Dec 2008 07:25:01 -0800, Theiko
> <> wrote:
>
> Not if you are running a single nic server with a router.
> See what SBS support is working on
> http://blogs.technet.com/sbs/default.aspx
> Check your SBS with the SBS Best Practices Analyzer
> http://blogs.technet.com/sbs/archive...A/default.aspx
>
> On Wednesday, December 17, 2008 8:50 PM
> Gregg Hill wrote:
>
> Neil,Other than just yanking my chain, was there a point to your comment?
> Neil,
>
> Other than just yanking my chain, was there a point to your comment?
>
> I do not get it.
>
> Gregg
>
>
> "Neil Hoskins" <> wrote
> in
>
> On Wednesday, December 17, 2008 8:53 PM
> Gregg Hill wrote:
>
> Theiko,Jim Behning beat me to the answer of "Not if you are running a
> single
> Theiko,
>
> Jim Behning beat me to the answer of "Not if you are running a single nic
> server with a router."
>
> Besides, that has been the gateway since day one (four years ago), and
> this
> problem is only a week or so old.
>
> Gregg Hill
>
>
>
> "Theiko" <> wrote in message
> news:9C39C355-FB51-4F35-92A0-...
>
> On Wednesday, December 17, 2008 8:56 PM
> Gregg Hill wrote:
>
> Jim,Thank you for confirming I am not completely nuts...
> Jim,
>
> Thank you for confirming I am not completely nuts...at least regarding the
> knowledge of the gateway IP, anyway.
>
> So, may I assume that the lack of other responses indicates others are not
> having an issue with the last round of MS Updates?
>
> Gregg Hill
>
>
>
>
> "Jim Behning SBS MVP" <> wrote
> in
> message news:...
>
> On Wednesday, December 17, 2008 10:41 PM
> Jim Behning SBS MVP wrote:
>
> No one fussing and we have maybe 20 servers. Some do automaticupdates.
> No one fussing and we have maybe 20 servers. Some do automatic
> updates. Some do not. We have enough that do automatic updates that we
> should have heard something.
>
> On Wed, 17 Dec 2008 17:56:02 -0800, "Gregg Hill" <greggmhill at please
> do not spam me at yahoo dot com> wrote:
>
> See what SBS support is working on
> http://blogs.technet.com/sbs/default.aspx
> Check your SBS with the SBS Best Practices Analyzer
> http://blogs.technet.com/sbs/archive...A/default.aspx
>
> On Thursday, December 18, 2008 12:18 AM
> Gregg Hill wrote:
>
> Jim,I just got home from the client.
> Jim,
>
> I just got home from the client. I have determined with near-certainty
> that
> the problem is Trend Micro WFBS Advanced 5.1, initially an upgrade from
> 5.0,
> which was an upgrade from 3.6. I had removed it completely from server and
> workstations and re-installed on 11/28/08 due to some left over registry
> entries that had caused problems on my workstation.
>
> I checked five workstations, and all of them exhibited the same behavior.
> With the AV running, the UPS workstation would consistently take 1:30 to
> start the UPS app the first time, and about 1:10 each consecutive time.
> All
> five computers would take 12-22 seconds to get to the MAS 90 login prompt.
> I
> would unload the AV, and the results would be roughly the same. MAS 90
> dropped on some from 14 seconds to 9-10 seconds, but not on all of them.
>
> I noticed that even with the AV client unloaded, it still left the "Trend
> Micro Unauthorized Change Prevention Service" running. Killing that
> service
> made no difference.
>
> However, if I **removed** the AV client, the UPS app would take about 1:00
> the first time I started it, and about 30-40 seconds each consecutive
> time.
> MAS 90 would show the prompt in 3.5 seconds. I tested over and over again,
> with the same results. Re-installing the AV client consistently brought
> back
> the slowness.
>
> I even removed all of last week's MS Updates on one system, without any
> change. Some are XP Pro SP2, some are SP3, no difference between them.
>
> I will call Trend tomorrow.
>
> Gregg Hill
>
>
>
>
> "Jim Behning SBS MVP" <> wrote
> in
> message news:...
>
> On Thursday, December 18, 2008 8:59 AM
> Jim Behning SBS MVP wrote:
>
> Interesting.
> Interesting.
>
> I thought I saw something about AV causing a problem somewhere else.
> It will be interesting to hear what Trend knows.
>
> On Wed, 17 Dec 2008 21:18:13 -0800, "Gregg Hill" <greggmhill at please
> do not spam me at yahoo dot com> wrote:
>
> See what SBS support is working on
> http://blogs.technet.com/sbs/default.aspx
> Check your SBS with the SBS Best Practices Analyzer
> http://blogs.technet.com/sbs/archive...A/default.aspx
>
> On Sunday, January 04, 2009 3:35 AM
> Gregg Hill wrote:
>
> Jim,Their tech support has gone to hell in a hand basket.
> Jim,
>
> Their tech support has gone to hell in a hand basket. No response other
> than
> the initial one.
>
> A side note to you folks running WFBS 5.1 with normal speed. Do you have
> TCP
> Checksum Offload enabled or disabled on your workstations? While
> troubleshooting a problem with LogMeIn disconnecting behind WatchGuard
> firewalls, I found out that my workstations had it enabled, when I thought
> I
> had killed it at the same time I killed it on my server after my SBS 2003
> SP2 update.
>
> Turning it off on my workstations got rid of tons of errors in Wireshark
> (which is how I knew it was on!), but I have no idea if those errors could
> affect WFBS.
>
> Gregg Hill
>
>
>
>
>
>
> "Jim Behning SBS MVP" <> wrote
> in
> message news:...
>
> On Sunday, January 04, 2009 10:16 AM
> Les Connor wrote:
>
> Do you have more than one network that has this issue?
> Do you have more than one network that has this issue?
>
> I don't see it, have never seen it, and run 5.1 on 10 networks.
>
> --
> Les Connor [SBS-MVP]
>
>
> ____________________________
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> message news:...
>
> On Sunday, January 04, 2009 3:49 PM
> Gregg Hill wrote:
>
> Les,Both networks where I went from 5.0 to 5.1 slowed down.
> Les,
>
> Both networks where I went from 5.0 to 5.1 slowed down. The ONLY computer
> on
> my client's network that did not slow down was the server itself. My
> client
> has MAS 90 for Windows, and Blytheco installed it years ago, including a
> MAS
> 90 workstation installation on the server for them to use. On the server,
> even with WFBS 5.1, I could open MAS 90 and get the login prompt in a
> couple
> of seconds. The workstations went from opening in about 3-4 seconds to
> taking up to 22 seconds just to get the prompt, and slow to do everything
> else once they logged into MAS 90.
>
> Other apps (UPS, Excel, Word, web browsing) all slowed down. They
> complained
> of "slow Internet access" as well. My post form 12/17 at 9:18PM gives more
> detail.
>
> Even my wife who is not a speed demon asked what I had done to her
> computer.
>
> I am afraid to "upgrade" anyone else to it.
>
> Gregg Hill
>
>
>
>
> "Les Connor" <> wrote in message
> news:...
>
> On Monday, January 12, 2009 1:20 PM
> Gregg Hill wrote:
>
> Les,Do your networks have TCP checksum offloading enabled or disabled on
> the
> Les,
>
> Do your networks have TCP checksum offloading enabled or disabled on the
> server and workstations?
>
> I thought I had it disabled on both the SBS server and the workstation,
> but
> it was enabled on the workstations. This tidbit was discovered after
> reverting back to 5.0.
>
> On a network with SBS 2003 SP2 (TCP checksum offloading off, RSS off, etc)
> and XP Pro SP3 clients, should I expect any differences if I disable TCP
> offloading on the workstations? Should I expect better or worse network
> performance? I know in theory it should be better with the NIC doing some
> of
> the work, but what about in real life?
>
> I am waiting for Trend's response regarding their common firewall driver
> and
> TCP checksum offloading.
>
> Gregg Hill
>
>
>
> "Les Connor" <> wrote in message
> news:...
>
> On Monday, January 12, 2009 1:47 PM
> Les Connor wrote:
>
> I've not fiddled with the workstation nic settings at all.
> I've not fiddled with the workstation nic settings at all. I don't even
> know
> if any of my workstations have those capabilities.
>
> --
> -----------------------------------------------
> Les Connor [SBS MVP]
>
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> message news:#...
>
> On Thursday, January 15, 2009 12:42 PM
> Gregg Hill wrote:
>
> Trend Micro support just called me and confirmed that they have a known
> Trend Micro support just called me and confirmed that they have a known
> problem with the common firewall driver causing slowness in WFBS 5.1. They
> are working on a patch but have no ETA.
>
> Gregg Hill
>
>
>
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> message news:...
>
> On Sunday, February 01, 2009 6:32 AM
> Ryan wrote:
>
> This is a problem, for sure with WFBS 5.1.
> This is a problem, for sure with WFBS 5.1. I too have the same problem
> and the FW patch that came out on the 27th has not helped. Just FYI.
> I too have extreme slowdown that is really disappointing.
>
> EggHeadCafe - Software Developer Portal of Choice
> Excel macro for creating and manipulating charts
> http://www.eggheadcafe.com/tutorials...-creating.aspx

I meant to say, "I just got an email a few minutes ago from Ingram Micro
asking me to become Trend Micro reseller. I informed them that I am already
a Trend Micro reseller...."

Gregg Hill


<carey mansfield> wrote in message
news:...
> Can you update me on the status of this client?
>
> I have a good bit of experience with Trend and mas90.
>
>
>
> Gregg Hill wrote:
>
> OT: all systems on network slow for last week or so
> 17-Dec-08
>
> Hello!
>
> For at least the last week, possibly following patch Tuesday, all XP Pro
> SP2
> and SP3 workstations on a client's SBS 2003 SP2 network are slow. On the
> server, patched three weeks ago to SP2, I have done all the post-SP2
> offload
> tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800 server
> was
> completely updated, prior to SP2, with BIOS, BMC, backplane, NIC driver,
> video driver, etc.
>
> The workstations are slow to open applications, slow to save files to the
> server, slow to open local applications such as UPS WorldShip, Word,
> Excel,
> MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt takes 12
> to
> 20 seconds, when it used to take 3 seconds. On the server, MAS 90 shows
> the
> prompt in less than 3 seconds. Hmm.
>
> I have defragged several systems with no change. CPU usage does not
> increase
> over 20% when the systems are slow. Several workstations have Broadcom
> 440x
> NICs, all updated with latest driver.
>
> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server
> and
> workstations, and systems are slow with it unloaded. I loaded QCheck and
> it
> shows data throughput at about 92Mbps both to and from workstation-server.
>
> All systems have been rebooted, including the server.
>
> SBS BPA gives a clean report.
>
> Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
> Gigabit) on a whim.
>
> Thank you!
>
> Gregg Hill
>
>
> P.S. Because I know you'll ask, here are the ipconfig outputs.
>
> Workstation:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : OfficeMGR-XP
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
> office.internal
>
> Ethernet adapter Local Area Connection:
> Connection-specific DNS Suffix . : office.internal
> Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
> Controller
> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : 192.168.1.113
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DHCP Server . . . . . . . . . . . : 192.168.1.10
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
> Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
> 11:11:23 PM
> Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
> 11:11:23 PM
>
>
> SBS 2003 SP:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : MXPDC
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
>
> Ethernet adapter Network Connection:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> Connection
> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.1.10
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
>
> Previous Posts In This Thread:
>
> On Wednesday, December 17, 2008 3:07 AM
> Gregg Hill wrote:
>
> OT: all systems on network slow for last week or so
> Hello!
>
> For at least the last week, possibly following patch Tuesday, all XP Pro
> SP2
> and SP3 workstations on a client's SBS 2003 SP2 network are slow. On the
> server, patched three weeks ago to SP2, I have done all the post-SP2
> offload
> tweaks to turn it off, per Susan's (?) web site. The Dell PE 2800 server
> was
> completely updated, prior to SP2, with BIOS, BMC, backplane, NIC driver,
> video driver, etc.
>
> The workstations are slow to open applications, slow to save files to the
> server, slow to open local applications such as UPS WorldShip, Word,
> Excel,
> MAS 90 (to mapped drive on server), etc. The MAS 90 login prompt takes 12
> to
> 20 seconds, when it used to take 3 seconds. On the server, MAS 90 shows
> the
> prompt in less than 3 seconds. Hmm.
>
> I have defragged several systems with no change. CPU usage does not
> increase
> over 20% when the systems are slow. Several workstations have Broadcom
> 440x
> NICs, all updated with latest driver.
>
> Antivirus is Trend WFBS Advanced 5.1 with a clean install on both server
> and
> workstations, and systems are slow with it unloaded. I loaded QCheck and
> it
> shows data throughput at about 92Mbps both to and from workstation-server.
>
> All systems have been rebooted, including the server.
>
> SBS BPA gives a clean report.
>
> Any ideas? I am going to swap out the Dell 26-port switch (24 10/100 and 2
> Gigabit) on a whim.
>
> Thank you!
>
> Gregg Hill
>
>
> P.S. Because I know you'll ask, here are the ipconfig outputs.
>
> Workstation:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : OfficeMGR-XP
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
> office.internal
>
> Ethernet adapter Local Area Connection:
> Connection-specific DNS Suffix . : office.internal
> Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated
> Controller
> Physical Address. . . . . . . . . : 00-0D-56-xx-xx-xx
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : 192.168.1.113
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DHCP Server . . . . . . . . . . . : 192.168.1.10
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
> Lease Obtained. . . . . . . . . . : Tuesday, December 16, 2008
> 11:11:23 PM
> Lease Expires . . . . . . . . . . : Wednesday, December 24, 2008
> 11:11:23 PM
>
>
> SBS 2003 SP:
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : MXPDC
> Primary Dns Suffix . . . . . . . : office.internal
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : office.internal
>
> Ethernet adapter Network Connection:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> Connection
> Physical Address. . . . . . . . . : 00-11-43-xx-xx-xx
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.1.10
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.1.254
> DNS Servers . . . . . . . . . . . : 192.168.1.10
> Primary WINS Server . . . . . . . : 192.168.1.10
>
> On Wednesday, December 17, 2008 4:50 AM
> Neil Hoskins wrote:
>
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> <snip>
>
> You're northern hemisphere, right? Standard case of SAD; I have got it
> too.
>
> ;-)
>
> On Wednesday, December 17, 2008 10:25 AM
> Theik wrote:
>
> RE: OT: all systems on network slow for last week or so
> "Gregg Hill" wrote:
>
>
> Possibly the setting of your "Default Gateways" on your XP-Workstations
> are
> responsible for the problem. In SBS-networks there should be the ip-adress
> of
> the SBS-server itself. Good luck.
>
> On Wednesday, December 17, 2008 11:36 AM
>Jim Behning SBS MVP wrote:
>
> Re: OT: all systems on network slow for last week or so
> On Wed, 17 Dec 2008 07:25:01 -0800, Theiko
> <> wrote:
>
> Not if you are running a single nic server with a router.
> See what SBS support is working on
> http://blogs.technet.com/sbs/default.aspx
> Check your SBS with the SBS Best Practices Analyzer
> http://blogs.technet.com/sbs/archive...A/default.aspx
>
> On Wednesday, December 17, 2008 8:50 PM
> Gregg Hill wrote:
>
> Neil,Other than just yanking my chain, was there a point to your comment?
> Neil,
>
> Other than just yanking my chain, was there a point to your comment?
>
> I do not get it.
>
> Gregg
>
>
> "Neil Hoskins" <> wrote
> in
>
> On Wednesday, December 17, 2008 8:53 PM
> Gregg Hill wrote:
>
> Theiko,Jim Behning beat me to the answer of "Not if you are running a
> single
> Theiko,
>
> Jim Behning beat me to the answer of "Not if you are running a single nic
> server with a router."
>
> Besides, that has been the gateway since day one (four years ago), and
> this
> problem is only a week or so old.
>
> Gregg Hill
>
>
>
> "Theiko" <> wrote in message
> news:9C39C355-FB51-4F35-92A0-...
>
> On Wednesday, December 17, 2008 8:56 PM
> Gregg Hill wrote:
>
> Jim,Thank you for confirming I am not completely nuts...
> Jim,
>
> Thank you for confirming I am not completely nuts...at least regarding the
> knowledge of the gateway IP, anyway.
>
> So, may I assume that the lack of other responses indicates others are not
> having an issue with the last round of MS Updates?
>
> Gregg Hill
>
>
>
>
> "Jim Behning SBS MVP" <> wrote
> in
> message news:...
>
> On Wednesday, December 17, 2008 10:41 PM
> Jim Behning SBS MVP wrote:
>
> No one fussing and we have maybe 20 servers. Some do automaticupdates.
> No one fussing and we have maybe 20 servers. Some do automatic
> updates. Some do not. We have enough that do automatic updates that we
> should have heard something.
>
> On Wed, 17 Dec 2008 17:56:02 -0800, "Gregg Hill" <greggmhill at please
> do not spam me at yahoo dot com> wrote:
>
> See what SBS support is working on
> http://blogs.technet.com/sbs/default.aspx
> Check your SBS with the SBS Best Practices Analyzer
> http://blogs.technet.com/sbs/archive...A/default.aspx
>
> On Thursday, December 18, 2008 12:18 AM
> Gregg Hill wrote:
>
> Jim,I just got home from the client.
> Jim,
>
> I just got home from the client. I have determined with near-certainty
> that
> the problem is Trend Micro WFBS Advanced 5.1, initially an upgrade from
> 5.0,
> which was an upgrade from 3.6. I had removed it completely from server and
> workstations and re-installed on 11/28/08 due to some left over registry
> entries that had caused problems on my workstation.
>
> I checked five workstations, and all of them exhibited the same behavior.
> With the AV running, the UPS workstation would consistently take 1:30 to
> start the UPS app the first time, and about 1:10 each consecutive time.
> All
> five computers would take 12-22 seconds to get to the MAS 90 login prompt.
> I
> would unload the AV, and the results would be roughly the same. MAS 90
> dropped on some from 14 seconds to 9-10 seconds, but not on all of them.
>
> I noticed that even with the AV client unloaded, it still left the "Trend
> Micro Unauthorized Change Prevention Service" running. Killing that
> service
> made no difference.
>
> However, if I **removed** the AV client, the UPS app would take about 1:00
> the first time I started it, and about 30-40 seconds each consecutive
> time.
> MAS 90 would show the prompt in 3.5 seconds. I tested over and over again,
> with the same results. Re-installing the AV client consistently brought
> back
> the slowness.
>
> I even removed all of last week's MS Updates on one system, without any
> change. Some are XP Pro SP2, some are SP3, no difference between them.
>
> I will call Trend tomorrow.
>
> Gregg Hill
>
>
>
>
> "Jim Behning SBS MVP" <> wrote
> in
> message news:...
>
> On Thursday, December 18, 2008 8:59 AM
> Jim Behning SBS MVP wrote:
>
> Interesting.
> Interesting.
>
> I thought I saw something about AV causing a problem somewhere else.
> It will be interesting to hear what Trend knows.
>
> On Wed, 17 Dec 2008 21:18:13 -0800, "Gregg Hill" <greggmhill at please
> do not spam me at yahoo dot com> wrote:
>
> See what SBS support is working on
> http://blogs.technet.com/sbs/default.aspx
> Check your SBS with the SBS Best Practices Analyzer
> http://blogs.technet.com/sbs/archive...A/default.aspx
>
> On Sunday, January 04, 2009 3:35 AM
> Gregg Hill wrote:
>
> Jim,Their tech support has gone to hell in a hand basket.
> Jim,
>
> Their tech support has gone to hell in a hand basket. No response other
> than
> the initial one.
>
> A side note to you folks running WFBS 5.1 with normal speed. Do you have
> TCP
> Checksum Offload enabled or disabled on your workstations? While
> troubleshooting a problem with LogMeIn disconnecting behind WatchGuard
> firewalls, I found out that my workstations had it enabled, when I thought
> I
> had killed it at the same time I killed it on my server after my SBS 2003
> SP2 update.
>
> Turning it off on my workstations got rid of tons of errors in Wireshark
> (which is how I knew it was on!), but I have no idea if those errors could
> affect WFBS.
>
> Gregg Hill
>
>
>
>
>
>
> "Jim Behning SBS MVP" <> wrote
> in
> message news:...
>
> On Sunday, January 04, 2009 10:16 AM
> Les Connor wrote:
>
> Do you have more than one network that has this issue?
> Do you have more than one network that has this issue?
>
> I don't see it, have never seen it, and run 5.1 on 10 networks.
>
> --
> Les Connor [SBS-MVP]
>
>
> ____________________________
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> message news:...
>
> On Sunday, January 04, 2009 3:49 PM
> Gregg Hill wrote:
>
> Les,Both networks where I went from 5.0 to 5.1 slowed down.
> Les,
>
> Both networks where I went from 5.0 to 5.1 slowed down. The ONLY computer
> on
> my client's network that did not slow down was the server itself. My
> client
> has MAS 90 for Windows, and Blytheco installed it years ago, including a
> MAS
> 90 workstation installation on the server for them to use. On the server,
> even with WFBS 5.1, I could open MAS 90 and get the login prompt in a
> couple
> of seconds. The workstations went from opening in about 3-4 seconds to
> taking up to 22 seconds just to get the prompt, and slow to do everything
> else once they logged into MAS 90.
>
> Other apps (UPS, Excel, Word, web browsing) all slowed down. They
> complained
> of "slow Internet access" as well. My post form 12/17 at 9:18PM gives more
> detail.
>
> Even my wife who is not a speed demon asked what I had done to her
> computer.
>
> I am afraid to "upgrade" anyone else to it.
>
> Gregg Hill
>
>
>
>
> "Les Connor" <> wrote in message
> news:...
>
> On Monday, January 12, 2009 1:20 PM
> Gregg Hill wrote:
>
> Les,Do your networks have TCP checksum offloading enabled or disabled on
> the
> Les,
>
> Do your networks have TCP checksum offloading enabled or disabled on the
> server and workstations?
>
> I thought I had it disabled on both the SBS server and the workstation,
> but
> it was enabled on the workstations. This tidbit was discovered after
> reverting back to 5.0.
>
> On a network with SBS 2003 SP2 (TCP checksum offloading off, RSS off, etc)
> and XP Pro SP3 clients, should I expect any differences if I disable TCP
> offloading on the workstations? Should I expect better or worse network
> performance? I know in theory it should be better with the NIC doing some
> of
> the work, but what about in real life?
>
> I am waiting for Trend's response regarding their common firewall driver
> and
> TCP checksum offloading.
>
> Gregg Hill
>
>
>
> "Les Connor" <> wrote in message
> news:...
>
> On Monday, January 12, 2009 1:47 PM
> Les Connor wrote:
>
> I've not fiddled with the workstation nic settings at all.
> I've not fiddled with the workstation nic settings at all. I don't even
> know
> if any of my workstations have those capabilities.
>
> --
> -----------------------------------------------
> Les Connor [SBS MVP]
>
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> message news:#...
>
> On Thursday, January 15, 2009 12:42 PM
> Gregg Hill wrote:
>
> Trend Micro support just called me and confirmed that they have a known
> Trend Micro support just called me and confirmed that they have a known
> problem with the common firewall driver causing slowness in WFBS 5.1. They
> are working on a patch but have no ETA.
>
> Gregg Hill
>
>
>
> "Gregg Hill" <greggmhill at please do not spam me at yahoo dot com> wrote
> in
> message news:...
>
> On Sunday, February 01, 2009 6:32 AM
> Ryan wrote:
>
> This is a problem, for sure with WFBS 5.1.
> This is a problem, for sure with WFBS 5.1. I too have the same problem
> and the FW patch that came out on the 27th has not helped. Just FYI.
> I too have extreme slowdown that is really disappointing.
>
> EggHeadCafe - Software Developer Portal of Choice
> Excel macro for creating and manipulating charts
> http://www.eggheadcafe.com/tutorials...-creating.aspx