Discussion:
Setting security on a folder on DFS share takes too long.
(too old to reply)
4u3u
2006-08-02 14:12:02 UTC
Permalink
read permissionHello everyone,

I have a problem with DFS share on Windows Server 2003 R2. The problem is
that it takes too long to set permissions on folders under DFS share. When I
connect to the target directly however, I can change security on a folder
almost instantly.

Let me give you an example:

Let's say I have a dfs namespace root \\mycompany.com\CORP
It has a folder \\mycompany.com\CORP\Data
The folder has two targets associated with it, \\server1\Data and
\\server2\Data$ both servers are 2003 R2 servers.
There's a folder called let's say \\mycompany.com\CORP\Data\Somefolder. It
is 4GB in size and has 1304 Folders and 14870 files in it but there are many
subfolders which do not inherit security settings from the parent folder.
Somefolder has three groups listed in DACL in Security tab.

So I connect to \\mycompany.com\CORP\Data (\\server2\Data$ is active target
according to DFS tab in folder properties) and try to add read permission for
another security group to Somefolder. It takes more than 1.5 minutes to
update security after I press Apply.

When I connect to the \\server2\Data$ or \\server1\Data however it takes
less than a second to apply security on same folder.

Besides this share works perfectly (no replication errors, download/upload
speed is normal)

Any thoughts on this? I hope the answer is not "this is by design" :-)

Thank you.
Ned Pyle [MSFT]
2006-08-02 20:12:27 UTC
Permalink
KB873407. You will need to open a case to get the hotfixes for the various
OS's involved (shouldn't need one for the server's themselves, it was fixed
in SP1).
--
Ned Pyle
Microsoft Enterprise Platforms Support

All postings on this newsgroup are provided "AS IS" with no warranties, and
confer no rights.
For more information please visit
http://www.microsoft.com/info/cpyright.mspx to find terms of use.
4u3u
2006-08-03 08:14:02 UTC
Permalink
Thank you!


"The problem occurs because each subfolder and each file is checked to see
if the subfolder or the file is a DFS junction"
That's exactly what I've seen in packet trace though I wasn't sure it is
related so didn't mention it.

--4u3u
Post by Ned Pyle [MSFT]
KB873407. You will need to open a case to get the hotfixes for the various
OS's involved (shouldn't need one for the server's themselves, it was fixed
in SP1).
--
Ned Pyle
Microsoft Enterprise Platforms Support
All postings on this newsgroup are provided "AS IS" with no warranties, and
confer no rights.
For more information please visit
http://www.microsoft.com/info/cpyright.mspx to find terms of use.
4u3u
2006-08-03 08:43:01 UTC
Permalink
Follow-up question: do you by chance have any plans to make this update
available on WSUS/MU?

--4u3u
Post by 4u3u
Thank you!
"The problem occurs because each subfolder and each file is checked to see
if the subfolder or the file is a DFS junction"
That's exactly what I've seen in packet trace though I wasn't sure it is
related so didn't mention it.
--4u3u
Post by Ned Pyle [MSFT]
KB873407. You will need to open a case to get the hotfixes for the various
OS's involved (shouldn't need one for the server's themselves, it was fixed
in SP1).
--
Ned Pyle
Microsoft Enterprise Platforms Support
All postings on this newsgroup are provided "AS IS" with no warranties, and
confer no rights.
For more information please visit
http://www.microsoft.com/info/cpyright.mspx to find terms of use.
Ned Pyle [MSFT]
2006-08-03 21:28:59 UTC
Permalink
It will become part of the next service packs, since it's not a security
vulnerability update.
--
Ned Pyle
Microsoft Enterprise Platforms Support

All postings on this newsgroup are provided "AS IS" with no warranties, and
confer no rights.
For more information please visit
http://www.microsoft.com/info/cpyright.mspx to find terms of use.
4u3u
2006-08-04 08:51:01 UTC
Permalink
Yes but security updates Isn't the only class of updates that if offered
through MU/WSUS. Here's the list of update classifications I see on my WSUS
server right now:
===============
Connectors
Critical Updates
Definition Updates
Development Kits
Drivers
Feature Packs
Guidance
Security Updates
Service Packs
Tools
Update Rollups
Updates
==============

But anyway, thank you for the link. I guess I'll need to improve my search
skills on support.microsoft.com since I didn't find this KB during initial
search for solution.
Post by Ned Pyle [MSFT]
It will become part of the next service packs, since it's not a security
vulnerability update.
--
Ned Pyle
Microsoft Enterprise Platforms Support
All postings on this newsgroup are provided "AS IS" with no warranties, and
confer no rights.
For more information please visit
http://www.microsoft.com/info/cpyright.mspx to find terms of use.
Ned Pyle [MSFT]
2006-08-04 12:43:12 UTC
Permalink
Good points - but it is pretty much unheard of for us to push out bug fixes
except via Service Packs, ordinarily.

Well, sort of - because technically, every hotfix you get for XP or 2003
actually contains *two* hotfixes - one branch for GDR, which is the critical
security updates, and one branch for QFE, which is the GDR+rolled up hotfix
changes. It was changed years back to stop customers from getting unexpected
behavior changes caused by bug fixes when all they thought was coming was a
seamless security change.

http://support.microsoft.com/kb/824994/en-us

Oh well, interesting to me. Didn't mean to sidetrack. :-)
--
Ned Pyle
Microsoft Enterprise Platforms Support

All postings on this newsgroup are provided "AS IS" with no warranties, and
confer no rights.
For more information please visit
http://www.microsoft.com/info/cpyright.mspx to find terms of use.
Continue reading on narkive:
Loading...