Slow opening times for files on a network drive

[HCHTech]

We have a client where we recently replaced their server (10/24). A single box running a DC and an APPServer VMs. The old box was Server 2016 and the new one is Server 2022. We added the new DC as a secondary, moved the roles, promoted it to primary, then removed the old DC. There were no problems with the data migration, and things have been running well for the 20 users in this domain......except for 1. One computer has a nagging problem that has gotten worse over time. When they open a Word document, an Excel spreadsheet, or a PDF file from the shared network drive by double-clicking on the file, it takes at last count about 30 seconds to open. If, on the other hand they open the software in question and use the File menu to open that very same file, it opens instantly.

The workstation in question is pretty new, installed in 7/24. Running Windows 11 Pro, of course. If I log into that workstation with the domain admin account, then the files open instantly, no matter what method is used. This points to some problem with her user profile it seems.

I have tried:

1. AV and EDR scans - all clean
2. Changing the default apps for Office Documents and PDF files, then changing them back.
3. Scouring through the various Windows logs. Explorer.exe is crashing, but with a generic 1000 error, so no help with a cause.
4. Updating to latest BIOS & various system drivers (Lenovo Vantage)
5. DISM run against a freshly-downloaded Win11 ISO - no errors detected
6. SFC /scannow run - no errors detected
7. Unjoining that workstation from the domain, then rejoining it - seemed to be a bit better, but user reports the problem still exists.
8. Unjoining, renaming the computer, then rejoining to the domain again - no change

I'm not keen to do a nuke & pave for this problem, but I'm afraid that's what I'm in for. Have I missed any diagnostic steps here?

 

[timeshifter]

What if you log in with a different user account on her PC (rather than an admin)? Or, login with her user account on a different PC?

 

[Metanis]

User profile still has reference to the old server which then times out and allows authentication to current server. It's always DNS!

(I don't actually know, just throwing stuff against the wall to see what sticks!)

 

[HCHTech]

User profile still has reference to the old server which then times out and allows authentication to current server.

This sure feels like the problem, but I can't find it. I had something similar one time and the user had put a shortcut to a folder on the old server in their quick launch group. As soon as I deleted that, it got better. I've looked, but cannot locate anything similar on this user's profile. I suspect if I backup her user data, then unjoin the workstation, delete the user's folders altogether, then rejoin it and restore the data....that'll work. I was really hoping to find the culprit. Damn.

 

[Markverhyden]

One thing I do in situations like this is fire up wireshark and then monitor traffic when a connection is attempted.

 

[YeOldeStonecat]

The mention of explorer crashing, and alsp PDF...

In Explorer, views, try toggling the setting for preview pane.

Whatever PDF reader is on the rig, go into it, dig around settings ...find the setting for PDF Preview in explorer...and disable that.

See if indexing is enabled for the mapped drive...disable if you find it is

Sometimes makes me want to say rebuild shell icon cache.

 

[HCHTech]

In Explorer, views, try toggling the setting for preview pane.

Whatever PDF reader is on the rig, go into it, dig around settings ...find the setting for PDF Preview in explorer...and disable that.

See if indexing is enabled for the mapped drive...disable if you find it is

Sometimes makes me want to say rebuild shell icon cache.

Good thoughts, but none of these actions helped, unfortunately. I did another fine-toothed-comb review of the user directories & logs, to no avail. I enabled the detailed DNS logging on the DC and reviewed that as well, nothing actionable. I also tried Wireshark, but couldn't find anything that looked like it was searching for the old server....admittedly, I don't really know what I'm doing with Wireshark - it's possible the answer was there but I couldn't see it.

What I ended up doing:

1. Backing up the data in the profile (Fabs)
2. Unjoining the computer from the domain
3. Deleting the computer from AD
4. Deleting the user directory from the workstation
5. Deleting the profiles from the registry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList)
6. Joining the computer to the domain again
7. Restoring the backed up data to the new profile
8. Logging back into the M365 account in the Office apps

Once this slog was completed, things are acting normally. I don't know what about the old profile was corrupted, but something sure was.

 

[Porthos]

AV and EDR scans

Which ones?

 

[HCHTech]

Which ones?

Managed BitDefender and SentinelOne.

 

[Porthos]

Managed BitDefender and SentinelOne.

Thanks

 

[trevm999]

If you want to figure out issues like this, you're going to have to learn to use Process Monitor