Event details
Post Windows 24H2 something changed within SMB/Mapped Drives that results in recurring IO timeout errors.
Is anyone on the SMB/Shell team aware of this issue?
It appears when a process (most notably browsers) open a explorer process/thread when a mapped network drive is present, explorer attempts to enumerate mapped drives. As a result the process will hang, explorer will stop showing updates without a manual refresh.
Once SMB triggers an IO timeout the hang clears and explorer becomes responsive again.
I suspect this is related to hardening policies made available 24H2 or changes made to the SMB/shell integration as part of the implementation of those hardening policies.
Upon reviewing procmon and WPR captures the only visible issue is the SMB hang. We've seen this issue present in our environment across multiple shares, multiple users, and the shares are running on different servers with different OS' behind them, all the same behavior.
The only correlation is the upgrade to 24H2 which we've confirmed is reproducable in 25H2 as well.
We've applied the CIS benchmark SMB hardening policies but cannot reasonable find why those hardening policies would result in this behavior.
More information post on this Reddit thread: https://www.reddit.com/r/sysadmin/s/U9wfVVreIx
We've opened a ticket (#4367406/KLNKNY-99RWM) but I believe this needs an engineer familiar with the SMB/shell integration within Windows, specifically the changes made between 23H2 to 24H2 which are still present in 25H2.
- Joe_Lurie
Microsoft
wcw102653 Thanks for the detailed reproduction information and for including the support case number. We can’t confirm a known product issue from the symptoms alone, but the support case is the right path to correlate your WPR/ProcMon evidence and engage the SMB/Shell engineers; please make sure it includes simultaneous client/server network traces, the affected share types, and the exact CIS settings applied.
Windows 11 24H2 introduced additional SMB security defaults, documented here, though we don’t recommend disabling them as a general workaround: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security-hardening.
The SMB trace-collection guidance is also useful for the case: https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/troubleshooting-smb
