Supports file, print, and named-pipe sharing over the network for your computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Default Settings
| Startup type: | Automatic |
| Display name: | Server |
| Service name: | LanmanServer |
| Service type: | share |
| Error control: | normal |
| Object: | LocalSystem |
| Path: | %SystemRoot%\system32\svchost.exe -k netsvcs -p |
| File: | %SystemRoot%\system32\srvsvc.dll |
| Registry key: | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer |
| Privileges: |
|
Default Behavior
Server is a Win32 service. In Windows 10 it is starting automatically when the operating system starts. Then the Server service is running as LocalSystem in a shared process of svchost.exe along with other services. If Server fails to start, the failure details are being recorded into Event Log. Then Windows 10 will start up and notify the user that the LanmanServer service has failed to start due to the error.
Dependencies
Server cannot be started under any conditions, if the following services are disabled, deleted or working improperly:
- Security Accounts Manager
- Server SMB 2.xxx Driver
While Server is stopped, the Computer Browser service cannot be launched.
Restore Default Startup Configuration of Server
Before you begin doing this, make sure that all the services on which Server depends are configured by default and function properly. See the list of dependencies above.
1. Run the Command Prompt as an administrator.
2. Copy the commands below, paste them into the command window and press ENTER:
sc config LanmanServer start= auto
sc start LanmanServer
3. Close the command window and restart the computer.
The LanmanServer service is using the srvsvc.dll file that is located in the C:\Windows\system32 directory. If the file is removed or corrupted, read this article to restore its original version from Windows 10 installation media.
In this article…
- What is the LanmanServer (Server) service?
- What happens if I stop the LanmanServer service?
- Is it safe to disable LanmanServer?
- Questions? Problems?
What is the LanmanServer (Server) service?
The LanmanServer service allows your computer to share files and printers with other devices on your network.
The service’s display name is Server and it runs inside the service host process, svchost.exe. By default, the service is set to start automatically when your computer boots:
What happens if I stop the LanmanServer service?
There will be a couple of potentially significant consequences if you stop the Server service.
1. File sharing will not work
Is your computer hosting a shared folder? If so, that folder will no longer be available to network computers once you stop LanmanServer.
Mapped drives pointing to your computer’s shared folders will be inaccessible and remote users will experience abrupt errors like this:
In addition, all sharing controls will disappear from your computer’s File Explorer windows.
For example, the drive properties window has a Sharing tab while LanmanServer is running:
But once the service stops, the Sharing tab vanishes:
Of course, only remote users will be impacted. The underlying files and folders will still be available on the computer hosting the drive.
2. Remote printing will not work
Is your computer sharing its printer with other computers? If so, the service being down will affect folks printing from those other computers.
Specifically, Windows will tell them that the remote printer is “Offline”. All their print requests will enter the print queue, patiently waiting for the printer to come back online:
Note that local printing (from the computer with the printer attached) will still work. Only remote users/computers will be affected.
Is it safe to disable LanmanServer?
Yes, it should be safe to disable the service — provided that your computer is not sharing files or printers. As mentioned above, those services won’t operate without the Server service.
Note that Internet-based networking features (for example, accessing web sites from your browser) will still be available when the service is disabled. In theory, many non-networked or home computers will do just fine without LanmanServer always running.
And because LanmanServer doesn’t have any dependencies, disabling it shouldn’t prevent any other services from starting up:
However, despite the above evidence to the contrary, Microsoft recommends keeping the Server service enabled. Unfortunately they don’t provide a reason or explanation!
Please proceed with caution if you decide to disable the LanmanServer service.
Questions? Problems?
If you would like to know more about the Server service, or you have a specific problem, please feel free to get in touch. We will do our best to help you!
You may also like…
The LanmanServer service is a crucial component of the Windows operating system, responsible for providing network shares and facilitating communication between devices on a local network. However, some users may wonder if it’s possible to disable LanmanServer, and what implications this might have on their system’s performance and security. In this article, we’ll delve into the world of LanmanServer, exploring its functions, potential vulnerabilities, and the consequences of disabling it.
What Is LanmanServer?
LanmanServer, also known as the Server service, is a Windows service that enables file and printer sharing on a local network. It allows users to share files, folders, and printers with other devices on the network, making it an essential component of a Windows-based network infrastructure. The service is responsible for:
- Managing network shares and permissions
- Providing access to shared files and folders
- Facilitating communication between devices on the network
- Supporting printer sharing and management
LanmanServer is a critical system service, and it’s enabled by default on most Windows installations. However, some users may choose to disable it, either to improve system performance or to enhance security.
Why Disable LanmanServer?
There are several reasons why a user might want to disable LanmanServer:
- Improved system performance: Disabling LanmanServer can free up system resources, potentially leading to improved performance and faster boot times.
- Enhanced security: By disabling LanmanServer, users can reduce the attack surface of their system, making it more difficult for malicious actors to exploit vulnerabilities in the service.
- Reduced network exposure: Disabling LanmanServer can limit the exposure of a system to the network, reducing the risk of unauthorized access or data breaches.
However, disabling LanmanServer can also have significant consequences, including:
- Loss of network sharing functionality: Disabling LanmanServer will prevent users from sharing files, folders, and printers with other devices on the network.
- Impact on system services: LanmanServer is a dependency for several other system services, including the Computer Browser service and the Network Location Awareness service. Disabling LanmanServer may impact the functionality of these services.
How To Disable LanmanServer
Disabling LanmanServer is a relatively straightforward process, but it requires caution and careful consideration. Here are the steps to disable LanmanServer:
- Method 1: Using the Services Console
- Press the Windows key + R to open the Run dialog box.
- Type “services.msc” and press Enter.
- In the Services console, locate the “Server” service (also known as LanmanServer).
- Right-click the service and select “Properties.”
- In the Properties window, set the “Startup type” to “Disabled.”
- Click “Stop” to stop the service.
- Method 2: Using the Registry Editor
- Press the Windows key + R to open the Run dialog box.
- Type “regedit” and press Enter.
- In the Registry Editor, navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer
- Set the value of the “Start” registry key to 4 (Disabled).
Consequences Of Disabling LanmanServer
Disabling LanmanServer can have significant consequences, including:
- Loss of network sharing functionality: Disabling LanmanServer will prevent users from sharing files, folders, and printers with other devices on the network.
- Impact on system services: LanmanServer is a dependency for several other system services, including the Computer Browser service and the Network Location Awareness service. Disabling LanmanServer may impact the functionality of these services.
- Potential security risks: While disabling LanmanServer can reduce the attack surface of a system, it may also introduce new security risks. For example, disabling LanmanServer may prevent the system from receiving critical security updates.
Alternatives To Disabling LanmanServer
If you’re concerned about the security or performance implications of LanmanServer, there are alternative solutions that don’t involve disabling the service entirely. Here are a few options:
- Configure LanmanServer to use a non-standard port: By default, LanmanServer listens on port 445. However, you can configure the service to use a non-standard port, making it more difficult for malicious actors to exploit vulnerabilities in the service.
- Implement network segmentation: Network segmentation involves dividing a network into smaller, isolated segments, each with its own set of access controls and security measures. This can help reduce the attack surface of a system and limit the exposure of LanmanServer.
- Use a firewall to restrict access: You can use a firewall to restrict access to LanmanServer, limiting the exposure of the service to the network.
Best Practices For Securing LanmanServer
If you choose not to disable LanmanServer, there are several best practices you can follow to secure the service:
- Keep LanmanServer up to date: Ensure that LanmanServer is running the latest version, with all security patches and updates applied.
- Configure strong passwords and authentication: Use strong passwords and authentication mechanisms to protect access to LanmanServer.
- Limit access to LanmanServer: Use access controls and security measures to limit access to LanmanServer, restricting it to only those users and devices that require it.
- Monitor LanmanServer for suspicious activity: Regularly monitor LanmanServer for suspicious activity, such as unusual login attempts or access patterns.
Conclusion
Disabling LanmanServer can have significant consequences, including the loss of network sharing functionality and potential security risks. However, for users who require enhanced security or improved system performance, disabling LanmanServer may be a viable option. Before making a decision, it’s essential to carefully consider the implications of disabling LanmanServer and to explore alternative solutions that can help mitigate the risks associated with the service. By following best practices for securing LanmanServer and implementing alternative solutions, users can minimize the risks associated with the service and ensure the security and integrity of their system.
What Is LanmanServer And What Does It Do?
LanmanServer is a Windows service that provides support for the SMB (Server Message Block) protocol, which allows for file and printer sharing across a network. It is also known as the Server service. This service is responsible for managing network connections, authenticating users, and providing access to shared resources.
When LanmanServer is running, it listens for incoming connections on TCP port 445 and UDP port 137-138. It also provides support for other network protocols, such as NetBIOS and DNS. By default, LanmanServer is enabled on Windows systems, allowing users to share files and printers with other devices on the network.
Disabling LanmanServer can provide several benefits, including improved security and reduced attack surface. By disabling this service, you can prevent unauthorized access to your system and reduce the risk of malware and ransomware attacks. Additionally, disabling LanmanServer can also improve system performance by reducing the number of running services and network connections.
However, it’s essential to note that disabling LanmanServer will also disable file and printer sharing, which may impact your workflow or productivity. Before disabling this service, ensure that you have alternative methods for sharing files and printers, such as using cloud storage or a third-party file-sharing service.
What Are The Risks Of Disabling LanmanServer?
Disabling LanmanServer can have several risks, including loss of file and printer sharing capabilities. If you rely on network shares for your work or daily activities, disabling this service may cause disruptions and impact your productivity. Additionally, disabling LanmanServer may also break certain applications or services that rely on SMB protocol, such as backup software or network-attached storage devices.
It’s crucial to weigh the benefits and risks before disabling LanmanServer. If you do decide to disable this service, ensure that you have alternative solutions in place to maintain your workflow and productivity. You should also test your system and applications to ensure that they function correctly without LanmanServer.
How Do I Disable LanmanServer On My Windows System?
To disable LanmanServer on your Windows system, you can use the Services console or the Windows Registry. To use the Services console, press the Windows key + R, type “services.msc,” and press Enter. In the Services console, scroll down to the “Server” service, right-click it, and select “Stop.” To disable the service permanently, right-click it again and select “Properties,” then set the “Startup type” to “Disabled.”
Alternatively, you can use the Windows Registry to disable LanmanServer. Press the Windows key + R, type “regedit,” and press Enter. Navigate to the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer” key, and set the “Start” value to “4” (Disabled). Restart your system to apply the changes.
Can I Disable LanmanServer On Windows 10 Home Edition?
Yes, you can disable LanmanServer on Windows 10 Home edition using the Services console or the Windows Registry. However, the process is slightly different compared to Windows 10 Pro or Enterprise editions. To disable LanmanServer using the Services console, press the Windows key + R, type “services.msc,” and press Enter. In the Services console, scroll down to the “Server” service, right-click it, and select “Stop.” To disable the service permanently, right-click it again and select “Properties,” then set the “Startup type” to “Disabled.”
Alternatively, you can use the Windows Registry to disable LanmanServer. Press the Windows key + R, type “regedit,” and press Enter. Navigate to the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer” key, and set the “Start” value to “4” (Disabled). Restart your system to apply the changes.
Will Disabling LanmanServer Affect My Network Connectivity?
Disabling LanmanServer will not affect your network connectivity, such as your internet connection or Wi-Fi connectivity. However, it will disable file and printer sharing, which may impact your ability to access shared resources on your network. If you rely on network shares for your work or daily activities, you may need to find alternative methods for sharing files and printers.
It’s essential to note that disabling LanmanServer will only affect SMB protocol-based connections. Other network protocols, such as TCP/IP and DNS, will continue to function normally. You can still access the internet, send emails, and use other network services without any issues.
Can I Re-enable LanmanServer If I Need It Later?
Yes, you can re-enable LanmanServer if you need it later. To re-enable the service, press the Windows key + R, type “services.msc,” and press Enter. In the Services console, scroll down to the “Server” service, right-click it, and select “Start.” To set the service to start automatically, right-click it again and select “Properties,” then set the “Startup type” to “Automatic.”
Alternatively, you can use the Windows Registry to re-enable LanmanServer. Press the Windows key + R, type “regedit,” and press Enter. Navigate to the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer” key, and set the “Start” value to “2” (Automatic). Restart your system to apply the changes.
The Workstation Service in Microsoft Windows Operating Systems, also known by the service name ‘lanmanworkstation’, is a system service that manages network connections and access to network resources. It is responsible for creating and maintaining client network connections to remote servers using the SMB (Server Message Block) protocol, commonly used for file, printer, and named pipe sharing over a network.
In Windows 10 and Windows 11, the Workstation Service is still very much in use. It operates in the background and is essential for Windows’ ability to interact with network shares and resources. Without this service running, the system would be unable to connect to or utilize resources over a network.
What is Workstation Service (Windows OS)?
Workstation Service, also known as LanmanWorkstation, is a component of the Microsoft Windows Server operating systems that allows a client to request file and print resources from servers over the network.
How does Workstation Service work?
The Workstation service is a user mode service that works together with a kernel mode component called the redirector file system driver, or rdr.sys. This redirector is implemented as a standard file system driver and resides above the Transport Driver Interface (TDI) layer, which allows it to interact independently with any transport protocols.
The Workstation service on a client computer accepts an input/output (I/O) request for a remote file, named pipe, or mailslot; determines which service can best provide this resource; and redirects the request to the Server service on the server where the requested resource resides. The Server service provides the requested resource and routes it back to the client that requested it. The Server service also consists of two components, a user mode component called LanmanServer and a kernel mode component called the server file system driver, or srv.sys.
You can also install additional redirectors from third-party vendors that can coexist with the Workstation service on Windows NT and Windows 2000. An example of an additional redirector included with Windows NT and Windows 2000 is Gateway Service for NetWare (GSNW), which enables Microsoft Windows clients to gain access to files and printers on a Novell NetWare server.
See also
- Server service
- Microsoft-Windows-WorkstationService, by Microsoft Learn
Fileserving in Windows environments is usually of critical importance. After all, if you can’t reach your files or have to wait five minutes every time you browse a share, the heat starts to build up in the IT department.
File serving is more than just saving a file to your home directory. I wrote a two-part article on MSTerminalServices.org on file serving and Terminal server environments. I suggest you read that article (Part 1 and Part 2 ) first to get a feel for the proper context of this article.
One of the main reasons I wrote that article is that fileserving can easily become a bottleneck if not configured properly, especially in Terminal Server environments.
To solve these performance problems, you sometimes have to tune the fileserver (lanmanserver) and the “fileserver-client” (lanmanworkstation). However, this isn’t for the faint of heart and can cause huge problems if you do it wrong. Unfortunately, documentation on these tuning parameters is rather scarce.
So in this article, I’ll try to explain what the important parameters are, what they do, and how they relate to each other. Once you know this, you’ll be able to tune your fileserving environments yourself.
Before we jump into this, please note that there are also a great deal optimizations that you can do in the «Terminal Server Terminal Server Client» hemisphere. Although the basic fileserving principles also apply in that area, this article is not meant to help you perform those optimizations. Also, there is a lot of additional tweaking you can do in other parts of the (Terminal Server) registry. I’ve purposely left these optimizations out because I wanted this article to focus on the performance of Fileserving components only.
This article was written assuming you’re running Windows 2000 (SP4+) or Windows Server 2003, Service Pack 1.
Core Components
Before we get down and dirty, we need to take a look at the core components that the Windows file serving environment is made of. File serving in Windows is a classic example of a Client-Server mechanism. All you have to do become a file server is to check the box “file and printer sharing for Microsoft networks” in the network connection properties box. On the other end all you have to do to “use” this file server is to check the box “client for Microsoft Networks”.
Both the server and the client components are run as a service. Not surprisingly, this is the «Server» service for the server component and the «Workstation» service for the client components.
Settings for these services are stored in the Windows registry. For the Server service this location is: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver. The corresponding location for the Workstation service is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation.
Lanmanserver
By default, the lanmanserver registry key on a freshly installed Windows Server 2003 Service Pack 1 machine looks like this:
The first sub key we encounter is the “AutotunedParameters” key. If you look at it you’ll see that it’s empty. Don’t worry—it’s supposed to be empty. This registry key exists because, by default, the Server service is auto-tuning. This means that every time the system boots, the server takes a look at the hardware configuration and incorporates any changes in the configuration of the Server service. Changes in hardware that are monitored are the amount of memory and the number of processors. There’s even a formula for it:
(4*(MB*SMBServerPerfSetting)*OSVersion/1)*(#Processors)
where:
MB = Megabytes RAM on the server
SMBServerPerfSetting = .5 if «Minimize Memory Used»
SMBServerPerfSetting = 1 if «Balance»
SMBServerPerfSetting = 2 if «Maximize Throughput for File Sharing»
OSVersion = 2 if running NTServer with > 16MB RAM
#Processors = is the number of processors in the system
In the formula you’ll notice that it refers to the SMBServerPerfSetting. This brings us to the only GUI ‘tool” native to Windows that you can use to “tune” the Server service. When you select the properties of a connection and then select the properties of “file and printer sharing for Microsoft networks”, you should end up with a window like this:
This is where you can optimize the Server service for a specific role. Consequently, if you do the numbers you’ll see that the higher you set the SMBServerPerfSetting, the higher the outcome of the formula is. But what is this number? Good question.
This number represents the value Windows will use for the MaxWorkItems, an important value in tuning the Server service. However, MaxWorkItems is just one of the parameters you can set to tune your fileserver. Let’s take a look at the (registry) values.
Parameters
Before we begin discussing the relevant parameters you can use to tune the Server service you should know that you should create them in the parameters sub key of the lanmanserver registry key. Let’s take look at the most important parameters:
MaxWorkItems
As said, MaxWorkItems isn’t the only thing tuning the Server service. It is one of the most important parameters though. What does this parameter mean? Well, MaxWorkItems specifies the maximum number or work items (receive buffers for file requests) that the Server service is permitted to allocate at one time. If this limit is reached, you get really bad performance out of your file server on even no performance (new connections to the file server are denied).
Possible values: 1-65535
InitWorkItems
This configures the number of work items allocated to a processor during startup. (The «initial» work items.) If this number is too low, it can significantly reduce performance or even deny new connections to the file server.
Possible values: 1-512
MaxMpxCt
This parameter permits a fileserver to provide a suggested maximum number of simultaneous outstanding client requests to itself. During negotiation of the Server Message Block dialect on this initial connection, this value is passed to the client’s redirector where the limit on outstanding requests is enforced. A higher value can increase server performance, but requires more use of server work items (MaxWorkItems).
Possible values: 1-65535
MaxWorkItems and MaxMpxCt Relationship
The value for MaxWorkItems must be at least four times as large as that for MaxMpxCt. For example, if MaxMpxCt has a value of 4096, then MaxWorkItems needs to have a value of at least 16384.
MaxRawWorkItems
This value determines the maximum number of raw receive buffers that a server can allocate. If this limit is reached, server performance may be degraded.
Possible values: 1-512
MaxFreeConnections
This value controls the number of free connection blocks that are maintained for each endpoint.
Possible values: 2–4096
MinFreeConnections
This value specifies the minimum number of free connection blocks to be maintained for each endpoint. This setting can sometimes dramatically improve performance.
Possible values: 0–256
SizReqBuf
This specifies the size of a WorkItem (see MaxWorkItems) that the Server service uses. Small WorkItems use less memory, but large WorkItems can improve performance.
When running applications that use a lot of copy or move functions to a remote server (profiles anyone?), the speed at which this function completes is determined by network speed (of course) and by the SMB size. By increasing this WorkItems size, you will allow the server to complete its file copies faster. This will increase the performance of the application making the copy/move calls.
For computers running Windows Server 2003 and with 512 MB or more of physical memory, the default size of the request buffers is 16,644 bytes; for servers with less physical memory, the default size is 4,356 bytes. If this entry is present in the registry, its value overrides the default value.
Possible values: 1-65535
Lanmanworkstation
This key is where all the configuration data for the Workstation service is stored. The lanmanworkstation key by default, looks like this on a freshly installed Windows Server 2003 Service Pack 1 machine:
As you can see, there’s no “AutotunedParameters” here. However, there is a «parameters» sub key in which we can do some tuning. It is not uncommon (especially in Terminal Server environments) to have to tune the Workstation service to alleviate performance problems. This is due to the nature of Terminal Servers. My article on MSTerminalServices.org discusses this in detail, but in a nutshell it’s like this: the workstation service was (and is) designed for a single workstation (like your desktop). However, a Terminal Server can easily host 50 desktop sessions, but unless you do manually intervene this server most likely is still configured just as your desktop would be. It’s pretty obvious that this could lead to some performance problems.
Parameters
Although there aren’t that many important parameters like in lanmanserver, there are still a few parameters of the Workstation service you should definitely know about.
MaxCmds
Specifies the maximum number of network control blocks that the redirector can reserve. The value of this entry coincides with the number of execution threads that can be outstanding simultaneously. Increase this value to improve network throughput, especially if you are running applications that perform more than 15 operations simultaneously.
MaxCmds actually serves the same purpose as the MaxMpxCt on the Fileserver. Not surprisingly these two parameters have a special relationship. It’s like this: whenever an SMB session is setup (i.e. a shared file is accessed), the SMB session is negotiated. During this negotiation the Fileserver passes down the value of MaxMpxCt to the client (a Terminal server for example). The client then compares this value to his own MaxCmds value. The lower of the two values then is used to set a maximum on the number of outstanding client requests to the File server.
Possible values: 1-65535
MaxThreads
The MaxThreads specifies how many threads are allowed to run at once. (Each thread allows one outstanding operation.) By increasing this you can increase the amount of simultaneous work. Each extra execution thread will take 1 Kbyte of additional NonPaged pool memory.
Possible values: 1-255
MaxCollectionCount
Specifies the amount of data that must be present in the buffer of the redirector to trigger a write operation. If the amount of data in the buffer meets or exceeds this value, then it is written immediately. Otherwise, it is retained in the buffer until either more data is added or the value of the CollectionTime entry expires.
Possible values: 1-65535
Monitoring
Problems stemming from poor fileserving performance can sometimes be a bit tricky to pinpoint. One way to make sure is by using good ol’ perfmon. The problem with interpreting perfmon counters is that you can never know what the «right» value is unless you have baselined your environment properly. So what to monitor and how to interpret those values is entirely up to you. However, there are some counters you can monitor that I can give some basic tips on. Configure perfmon to monitor the following counters:
Physical Disk
You can measure this on the Terminal Server as well, but you should start at the file server. If the queue length is more than one for a sustained period of time, then your disks are hyperventilating. Give them some air: up your I/O throughput. Look on the software-side: are you paging a lot? (that’ll kill your I/O throughput right there) or is your system disk heavily fragmented? Or on the hardware side: buy faster disks (15K SCSI) or upgrade your RAID controller.
Redirector
This is something you should only measure on your Terminal Server(s). You should monitor the «current commands» in the Redirector object. If the value is higher than 20 during sustained periods of time then you could have a bottleneck.
Server Work Queues
The Server Work Queues object should be monitored on the File server. You should monitor the «Available WorkItems» counter. Sustained values smaller than ten mean that the File server is running out of work items. When it does, performance really starts to plummet. Make sure this doesn’t happen by upping the MinFreeworkItems value.
Server
In this object there’s a counter called «Work Item Shortages». This value represents the number of times no work items were available or couldn’t be allocated to service a file request. Obviously if you see any other value than zero, you need to start worrying. Upping the InitWorkItems or MaxWorkItems could help out here.
Again, there’s so much more you can monitor but interpreting the results depends heavily on your environment. Just browsing the performance monitor objects I mentioned and playing around with it will give you a lot more information.
Tuning
So what do I set these registry values to? Unfortunately it’s not that simple. For starters, it depends on your specific environment. Also, an unfortunately side effect of almost every one of these registry values is that when they are increased, they consume more kernel memory. Seeing as (the lack of) kernel memory is often a bottleneck in scaling up in Terminal Server environments, you should be very careful in adjusting/creating the registry settings we discussed. If you are not careful, you could end up having more performance problems than you started out with. You need to know why.
Tuning LanManServer and LanManWorkstation in the registry, requires the use of more Non-Paged Pool memory. This can be a real issue on the File Server (LanManServer). Let me briefly explain where Non-Paged pool memory fits into the whole “2GB-Kernel—Memory-Bottleneck-Of-32-Bit-Windows”.
When you have a 32 bit operating system, this means that you have a 32 bit address space. That translates to 4GB of addressable memory space (2 to the power of 32). This 4GB is evenly shared between the user mode and kernel mode. User mode is the memory space that applications run in and kernel mode is used by the system for everything else. This 2 GB kernel mode memory is divided into several areas, amongst which is the NonPaged Pool. Because there’s only 2GB to share, the NonPaged pool gets configured with a maximum size at boot time. By default this is 256 MB. This 256 MB is the area in which you should perform your (LanManServer) tuning.
Why should you worry about this 256 MB? Well, because if the NonPaged pool is depleted then your system usually becomes unresponsive until some NonPaged pool becomes available again. So how does this apply to LanManServer tuning? Well, if you tune LanManServer in such a way that it allocates memory than the NonPaged pool has available and you indeed use up ALL of that allocated memory then you have effectively pushed Windows beyond its limits.
So what should you do? A safe way of doing it is to tune LanManServer in such a way that it can never deplete the NonPaged pool. The amount of memory LanManServer allocates in the NonPaged Pool is primarily determined by two parameters: MaxWorkItems and SizReqBuf. So if you set MaxWorkItems to 8192 and SizReqBuf to 16644 (default) (which in reality is 20480 due to tracking overhead) the amount of memory LanManServer will allocate is (8192 x 20480 bytes) 160 MB. This fits nicely into the 256 MB NonPaged Pool area.
So it basically boils down to this: If you have more than 512 MB of memory in your Terminal Server (which is every Terminal Server on earth and adjacent planets) then SizReqBuf starts out at 16644. This allows you to push the MaxWorkItems value to 8192. If you try higher numbers to create more of these similar sized WorkItems AND your File Servers tries to use these, you run the chance of running out of NonPaged Pool.
So there is however a decent chance that having 8192 WorkItems does not cut it for you. This is when the bits start to hit the fan. If you’re in that rather sad place, you really have only three options, with option 3 being the safest choice:
- Try making the size of the WorkItems smaller (trough the SizeReqBuf parameter) so you can safely set higher MaxWorkItems values. For example: If you set SizReqBuf lower to 8322 (plus a overhead of 3836 makes 12158 bytes) then this would allow you to have 13800 WorkItems ( 160MB / 12158 bytes).
- You could even try to up the MaxWorkItems and SizeReqBuf values further with the risk that you run out of NonPagedPool. Now, you should also know that you can tune the Kernel Mode memory in such a way that more memory is allocated to the NonPagedPool. The downside to this is of course is that this memory is taken away from other parts of the Kernel Mode memory. I wouldn’t go there if I were you (unless you’re up there with the likes of Mark Russinovich).
- Make sure that less Work Items are demanded from the File Server. This is a topic on its own but quick suggestions are: limit folder redirection (especially Application Data) or / and distribute File Services (put for example home directories on one Fileserver and redirected folders on another).
.ADM Templates
I have provided two .adm templates, one for lanmanserver and one for lanmanworkstation. I’ve separated these purposely because the lanmanserver adm template should be applied to your File Server and the lanmanworkstation adm template should be applied to your Terminal Servers.
Thincomputing.net Lanmanserver Tuning.zip
This template (download) contains all of the Lanmanserver parameters discussed in this article. When you import the ADM template and enable the policy, it will set the following parameters to the maximum recommended, safe values:
- MaxWorkItems
- InitWorkItems
- MaxMpxCt
- MaxRawWorkItems
- MaxFreeConnections
- MinFreeConnections
- SizReqBuf
These optimizations should applied to your FILESERVER, not your Terminal Server. I’ve included the possibility to ‘undo’ the optimizations made the template. You can do this by selecting -Undo Lanmanserver Optimizations- and REBOOTING.
Thincomputing.net Lanmanworkstation Tuning.zip
This template (download) contains all of the discussed Lanmanworkstation parameters in this article. When you import the ADM template and enable the policy, it will set the following parameters to the maximum recommended, safe values:
- MaxThreads
- MaxCollectionCount
- MaxCmds
These optimizations should applied to your TERMINAL SERVER, not your File server. I’ve included the possibility to ‘undo’ the optimizations made the template. You can do this by selecting -Undo Lanmanworkstation Optimizations- and REBOOTING.
Final Thoughts
Although some settings have been improved in Windows 2000 and even more in Windows Server 2003, I must say that I’m a bit disappointed that file serving problems like I discussed in the article are still quite common in Terminal Server environments. These problems have been around just as long as Terminal Server has, and one would think these problems would at least be a lot less common, but maybe that’s just my point of view.
Microsoft, finally, recently has published an excellent article which discusses these issues in very good detail. This article isn’t just about Terminal Server environments but it is still the best article Microsoft has ever written on the subject. Bookmark KB317249.
I hope that this document has provided you with enough knowledge to combat file serving performance problems.
There’s however a good chance that these problems with the file serving components of Windows will relatively soon be something of the past or at least be a lot less common. Windows Vista and Longhorn server will incorporate many changes, amongst which are major revisions in the file serving components. For example Vista comes with a major revision of the SMB protocol identified as SMB 2.0. The current protocol (SMB 1.0) was built to support file-serving solutions a couple of decades ago and was based on the assumptions existing then.
These are some of the key enhancements in SMB 2.0:
- SMB 2.0 supports an arbitrary, extensible way of compounding operations to reduce round trips. This makes the protocol less chatty as compared to SMB 1.0. Chattiness of SMB 1.0 has often been a major pain point.
- SMB 2.0 supports much larger buffer sizes compared to SMB 1.0.
- SMB 2.0 greatly grows the restrictive constants in the protocol, so we never need to worry about the protocol itself being the limiting factor for scalability. This includes increasing the number of concurrent open file handles on the server, and the number of shares that a server can share out, among other things.
- SMB 2.0 supports durable handles that can withstand short network glitches.
All these enhancements in SMB 2.0 will result in better performance and security over LAN and WAN.
Sounds good huh? I’ll believe it when I see it, but the file serving future looks bright!