Windows sysinternals

Chapter 17 Hangs and Sluggish Performance 415
About 15 minutes after I had received Jason’s e-mail, I sent him a reply explaining my
conclusion with the configuration file attached. Shortly after, he wrote back confirming the
delays were gone and expressing amazement that I had figured out the problem and solution
so quickly. It might have seemed like magic to him, but I had simply used basic Procmon
troubleshooting techniques and the Web to solve the case. Needless to say, the revised demo
flow and transition between AppLocker and application compatibility came off great.
The Case of the Slow Project File Opens
The case opened when the customer, a network administrator, contacted Microsoft support
because a user reported that Microsoft Project files located on a network share were taking
up to a minute to open and about once every 10 times the open resulted in the error shown
in Figure 17-19.
FIGURE 17-19 Error that occurred on Project file opens one time in 10.
The administrator verified the issue and checked networking settings and latency to the file
server, but he could not find anything that would explain the problem. The Microsoft support
engineer assigned to the case asked the administrator to capture Procmon and Network
Monitor traces of a slow file open. After receiving the logs a short time later, he opened the
Procmon log and set a filter to include only operations issued by the Project process and
then another filter to include paths that referenced the target file share. The File Summary
dialog box, which he opened from Procmon’s Tools menu, showed significant time spent in
file operations accessing files on the share, shown in the File Time column in Figure 17-20.
FIGURE 17-20 File Summary dialog box showing time spent in file operations (domain name obscured).
www.it-ebooks.info