Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

config causing 35 second delay opening modern MS Office file formats (.docx & .xlsx etc) #171

Open
Guyver1wales opened this issue Nov 2, 2022 · 0 comments

Comments

@Guyver1wales
Copy link

I applied the sysmon-config successfully to approx. 285 windows servers in out estate without issue.

However, one file server (Server 2012 R2) out of our 4 identical file servers developed an issue whereby ONLY .docx, .xlsx file would have an explicit delay of 35 seconds before it would open.
After approx. 30+ full work hours tearing the server apart I resolved the issue by detaching the sysmon filter driver from the D:\ where all the servers shares were:
fltMC.exe detach SysmonDrv D:

You can see this on this reddit thread - https://www.reddit.com/r/sysadmin/comments/yis8fi/network_share_word_and_excel_files_take_35/

I believe you have something in the configuration that under certain circumstances is causing CANNOT BREAK OPLOCK issues on these specific file types.

I can provide PROCMON output if required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant