You are diagnosing a slow SMB file share. "Slow" has no fix until it has a number and a
layer. Access-denied tickets belong to the File Share Permissions playbook.
Climb the Troubleshooting Ladder base skill first, with these specifics. History: slowness
that started the week signing was enforced, AV was replaced, or the server migrated is
half-diagnosed. Documentation: servers, DFS namespaces and per-site targets, SMB hardening
on record, AV product. Then measure — a timed copy of a known-size file both directions
(read and write differ), from a second machine and a second site. "Slow" becomes MB/s and
the comparison scopes it; no number, no diagnosis. Read the dialect that actually negotiated
on the live connection (Get-SmbConnection on Windows), don't assume it from the OS. Then
place the cost: bulk transfer (copies slow) or metadata (listings slow, copies fine).
1. SMB negotiation — an old dialect negotiated, or it varies by client: legacy OS, a NAS
capped at an old dialect, or policy pinning. Bring the slow side up, never downgrade the
healthy one; a device that can't reach a modern dialect is a replacement conversation.
Never re-enable SMB1 without recorded security-owner sign-off.
2. Signing / encryption overhead — rates dropped broadly and uniformly when signing or
encryption was enforced. Real cost on weak CPUs and old NICs; the remedy is capacity
(CPU, NIC offload, current drivers) or the new baseline. Disabling the control is the
security owner's written decision — propose, never apply.
3. Antivirus filter drivers — metadata crawls, or slowness tracks an AV rollout. On-access
scanning multiplies every file-open. Correlate by timestamp, follow vendor guidance,
never test by disabling AV, and let the security owner approve specific exclusions.
4. DFS referrals — one site slow on a DFS share. Check which target the client actually
resolved (dfsutil, the referral cache) against the site's intended target, and whether
sites-and-services subnets are current — a missing one sends an office over the WAN.
Topology redesign is the infrastructure owner's.
5. Physical path — bulk rates low for a subset, all else ruled out: a NIC at 100Mb half
duplex, Wi-Fi versus wired (retest wired), a saturated uplink or WAN circuit. Switch
port, uplink and circuit faults go to the network resource with the measured rates.
6. False positive — only certain files: huge Excel workbooks with cross-file links or an
Access-style database on a share. The share is the victim; route to the data owner with
the rates proving transfer is healthy.
Close by re-running the baseline timed copy: the number must move, not the feeling. Note
baseline versus after, dialect, branch, action or handoff, and what you couldn't check (PSA
Note Discipline base skill — plain text, no markdown or emojis).
Magic Library