> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Share Slowness

> Diagnose slow SMB file shares — sluggish copies, crawling folder listings, one office fine — through SMB version, signing, AV filters, and DFS referrals.

<Info>
  **Category:** Troubleshooting Playbooks · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/troubleshooting-playbooks/network-share-slowness/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="skill"><span className="thread-chip thread-chip-tier-skill">Skill</span></span> — you run it in Super Magic and confirm each write; there's no Flow trigger for this one.

**Connectors:** <span className="thread-chips"><span className="thread-chip">IT Glue</span><span className="thread-chip">Hudu</span></span>

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Faster Resolution & Response

**When to use:** "Opening folders on the shared drive takes 30 seconds" or file copies crawl; slowness that appeared after server hardening, a security-tool rollout, or a migration; one site or VLAN slow against a share that's fast elsewhere; or "Excel files on the share take forever" (often not the network at all). For access-denied/permission tickets use the File Share Permissions playbook — this one is purely about speed.

**Run it:** on the one ticket you're working — a tech measures and diagnoses hands-on; not unattended.

## Prompt

```
You are diagnosing a slow SMB file share. "Slow" has no fix until it has a number and a
layer. Access-denied tickets belong to the File Share Permissions playbook.

Climb the Troubleshooting Ladder base skill first, with these specifics. History: slowness
that started the week signing was enforced, AV was replaced, or the server migrated is
half-diagnosed. Documentation: servers, DFS namespaces and per-site targets, SMB hardening
on record, AV product. Then measure — a timed copy of a known-size file both directions
(read and write differ), from a second machine and a second site. "Slow" becomes MB/s and
the comparison scopes it; no number, no diagnosis. Read the dialect that actually negotiated
on the live connection (Get-SmbConnection on Windows), don't assume it from the OS. Then
place the cost: bulk transfer (copies slow) or metadata (listings slow, copies fine).

1. SMB negotiation — an old dialect negotiated, or it varies by client: legacy OS, a NAS
   capped at an old dialect, or policy pinning. Bring the slow side up, never downgrade the
   healthy one; a device that can't reach a modern dialect is a replacement conversation.
   Never re-enable SMB1 without recorded security-owner sign-off.

2. Signing / encryption overhead — rates dropped broadly and uniformly when signing or
   encryption was enforced. Real cost on weak CPUs and old NICs; the remedy is capacity
   (CPU, NIC offload, current drivers) or the new baseline. Disabling the control is the
   security owner's written decision — propose, never apply.

3. Antivirus filter drivers — metadata crawls, or slowness tracks an AV rollout. On-access
   scanning multiplies every file-open. Correlate by timestamp, follow vendor guidance,
   never test by disabling AV, and let the security owner approve specific exclusions.

4. DFS referrals — one site slow on a DFS share. Check which target the client actually
   resolved (dfsutil, the referral cache) against the site's intended target, and whether
   sites-and-services subnets are current — a missing one sends an office over the WAN.
   Topology redesign is the infrastructure owner's.

5. Physical path — bulk rates low for a subset, all else ruled out: a NIC at 100Mb half
   duplex, Wi-Fi versus wired (retest wired), a saturated uplink or WAN circuit. Switch
   port, uplink and circuit faults go to the network resource with the measured rates.

6. False positive — only certain files: huge Excel workbooks with cross-file links or an
   Access-style database on a share. The share is the victim; route to the data owner with
   the rates proving transfer is healthy.

Close by re-running the baseline timed copy: the number must move, not the feeling. Note
baseline versus after, dialect, branch, action or handoff, and what you couldn't check (PSA
Note Discipline base skill — plain text, no markdown or emojis).
```


## Related topics

- [NAS / File Share Provisioning](/skill-library/devices-and-infrastructure/nas-share-provisioning.md)
- [Supporting Accounting Firms](/skill-library/industry-packs/accounting-firms.md)
- [Slow Computer](/skill-library/troubleshooting-playbooks/slow-computer.md)