Setting security on a folder on DFS share takes too long.

Discussion in 'File Systems' started by 4u3u, Aug 2, 2006.

  1. 4u3u

    4u3u Guest

    read permissionHello everyone,

    I have a problem with DFS share on Windows Server 2003 R2. The problem is
    that it takes too long to set permissions on folders under DFS share. When I
    connect to the target directly however, I can change security on a folder
    almost instantly.

    Let me give you an example:

    Let's say I have a dfs namespace root \\mycompany.com\CORP
    It has a folder \\mycompany.com\CORP\Data
    The folder has two targets associated with it, \\server1\Data and
    \\server2\Data$ both servers are 2003 R2 servers.
    There's a folder called let's say \\mycompany.com\CORP\Data\Somefolder. It
    is 4GB in size and has 1304 Folders and 14870 files in it but there are many
    subfolders which do not inherit security settings from the parent folder.
    Somefolder has three groups listed in DACL in Security tab.

    So I connect to \\mycompany.com\CORP\Data (\\server2\Data$ is active target
    according to DFS tab in folder properties) and try to add read permission for
    another security group to Somefolder. It takes more than 1.5 minutes to
    update security after I press Apply.

    When I connect to the \\server2\Data$ or \\server1\Data however it takes
    less than a second to apply security on same folder.

    Besides this share works perfectly (no replication errors, download/upload
    speed is normal)

    Any thoughts on this? I hope the answer is not "this is by design" :)

    Thank you.
     
    4u3u, Aug 2, 2006
    #1
    1. Advertisements

  2. KB873407. You will need to open a case to get the hotfixes for the various
    OS's involved (shouldn't need one for the server's themselves, it was fixed
    in SP1).

    --

    Ned Pyle
    Microsoft Enterprise Platforms Support

    All postings on this newsgroup are provided "AS IS" with no warranties, and
    confer no rights.
    For more information please visit
    http://www.microsoft.com/info/cpyright.mspx to find terms of use.
     
    Ned Pyle [MSFT], Aug 2, 2006
    #2
    1. Advertisements

  3. 4u3u

    4u3u Guest

    Thank you!


    "The problem occurs because each subfolder and each file is checked to see
    if the subfolder or the file is a DFS junction"
    That's exactly what I've seen in packet trace though I wasn't sure it is
    related so didn't mention it.

    --4u3u
     
    4u3u, Aug 3, 2006
    #3
  4. 4u3u

    4u3u Guest

    Follow-up question: do you by chance have any plans to make this update
    available on WSUS/MU?

    --4u3u
     
    4u3u, Aug 3, 2006
    #4
  5. It will become part of the next service packs, since it's not a security
    vulnerability update.

    --

    Ned Pyle
    Microsoft Enterprise Platforms Support

    All postings on this newsgroup are provided "AS IS" with no warranties, and
    confer no rights.
    For more information please visit
    http://www.microsoft.com/info/cpyright.mspx to find terms of use.
     
    Ned Pyle [MSFT], Aug 3, 2006
    #5
  6. 4u3u

    4u3u Guest

    Yes but security updates Isn't the only class of updates that if offered
    through MU/WSUS. Here's the list of update classifications I see on my WSUS
    server right now:
    ===============
    Connectors
    Critical Updates
    Definition Updates
    Development Kits
    Drivers
    Feature Packs
    Guidance
    Security Updates
    Service Packs
    Tools
    Update Rollups
    Updates
    ==============

    But anyway, thank you for the link. I guess I'll need to improve my search
    skills on support.microsoft.com since I didn't find this KB during initial
    search for solution.
     
    4u3u, Aug 4, 2006
    #6
  7. Good points - but it is pretty much unheard of for us to push out bug fixes
    except via Service Packs, ordinarily.

    Well, sort of - because technically, every hotfix you get for XP or 2003
    actually contains *two* hotfixes - one branch for GDR, which is the critical
    security updates, and one branch for QFE, which is the GDR+rolled up hotfix
    changes. It was changed years back to stop customers from getting unexpected
    behavior changes caused by bug fixes when all they thought was coming was a
    seamless security change.

    http://support.microsoft.com/kb/824994/en-us

    Oh well, interesting to me. Didn't mean to sidetrack. :)

    --

    Ned Pyle
    Microsoft Enterprise Platforms Support

    All postings on this newsgroup are provided "AS IS" with no warranties, and
    confer no rights.
    For more information please visit
    http://www.microsoft.com/info/cpyright.mspx to find terms of use.
     
    Ned Pyle [MSFT], Aug 4, 2006
    #7
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.