A slow copy does not automatically mean slow storage

A file server can feel slow because a folder takes ten seconds to open, an application waits on thousands of small files, or a sequential copy plateaus. Those symptoms cross DNS, authentication, SMB, the network, antivirus filters, cache, and storage. Replacing disks before identifying the waiting layer often moves the problem rather than solving it.

A useful investigation ties the user experience to a time, path, client, and workload, then compares controlled scenarios. The commands below observe state without changing configuration, except for an explicitly isolated Robocopy test in a disposable folder and a local Defender diagnostic recording.

Symptom	First comparison	Common directions
Folder opens slowly	Name versus IP; small versus large folder	DNS, metadata, filter, latency
Large file is slow	Client, server-local, and another network	Throughput, loss, SMB, storage
Small files are slow	One large file of equivalent total size	Round trips, antivirus, metadata
One application is slow	Explorer or Robocopy against the same path	Application, lock, filter, access pattern
Intermittent slowdown	Backup and scheduled-task timeline	Contention, scanning, growth, replication

1. Define the scope before measuring

Keep a small test matrix with start, finish, and result. A global average can hide pauses that stall an interactive application, while one spike does not prove sustained saturation. No universal threshold fits every file set, protocol, array, and application.

Record the exact time, UNC path, operation, file count, and total size.
Determine whether one user, one site, one VLAN, a VPN, or every client is affected.
Compare a wired client with Wi-Fi or VPN without changing several variables at once.
Separate folder enumeration, read, write, rename, delete, and file-locking symptoms.
List recent patches, GPOs, EDR agents, NIC drivers, backups, replication, and storage changes.
Repeat the same cold and warm scenario; cache can make the second run deceptively fast.

2. Check DNS and the authentication path

Resolve the name users actually enter, then validate TCP 445. Connecting by IP might appear to bypass a DNS delay, but it also changes authentication and can prevent Kerberos. Use this comparison as evidence, never as the permanent fix.

A poorly designed DNS alias can also interfere with Kerberos when alternate names and SPNs are not managed correctly. Microsoft recommends Kerberos, avoiding IP-based share access, and using supported alternate-name configuration.

PowerShell — read-only resolution and connectivity

$Server = 'FS01.contoso.example'
Resolve-DnsName $Server -Type A
Resolve-DnsName $Server -Type AAAA -ErrorAction SilentlyContinue
Test-NetConnection $Server -Port 445 -InformationLevel Detailed

# After connecting to the share: tickets and SMB session
klist
Get-SmbConnection | Where-Object ServerName -eq 'FS01' |
  Format-Table ServerName,ShareName,Dialect,NumOpens -Auto

3. Inspect the live SMB session, not the assumed configuration

Observe dialect, signing, encryption, and channel count on the session that reproduces the slowdown. Run Get-SmbConnection on the client; Get-SmbSession and Get-SmbOpenFile require administrative access on the server. Open files can reveal a lock or unexpected client, but do not prove causation by themselves.

SMB Multichannel can improve throughput and resilience with multiple interfaces or RSS. SMB Direct uses RDMA to reduce latency and CPU when the entire stack supports it. Do not force either feature without confirming the adapters, drivers, switches, and paths in use.

Client — connection, configuration, and channels

Get-SmbConnection | Format-Table ServerName,ShareName,UserName,Dialect,NumOpens -Auto
Get-SmbMultichannelConnection | Format-Table ServerName,ClientIPAddress,ServerIPAddress,Selected,ClientRssCapable,ServerRssCapable -Auto
Get-SmbClientConfiguration | Select-Object EnableMultiChannel,EnableSecuritySignature,RequireSecuritySignature,EnableInsecureGuestLogons

Server — sessions, open files, and configuration

Get-SmbSession | Format-Table ClientComputerName,ClientUserName,Dialect,NumOpens,SecondsIdle -Auto
Get-SmbOpenFile | Sort-Object ClientComputerName,Path | Select-Object ClientComputerName,ClientUserName,Path,Locks
Get-SmbServerConfiguration | Select-Object EnableMultiChannel,EnableSecuritySignature,RequireSecuritySignature,EncryptData

4. Measure the network without confusing bandwidth and latency

A 1 or 10 Gb/s link does not guarantee low latency or zero loss. Small files and chatty applications are sensitive to round trips; a sequential copy mostly measures throughput. Compare the same operation from the same client and then from another segment.

Ping provides a signal, but some devices filter ICMP. Pathping estimates loss and latency across hops; it does not replace a targeted trace when TCP retransmissions or pauses are suspected. Correlate it with adapter counters at both endpoints.

PowerShell and Windows — network path state

$Server = 'FS01.contoso.example'
Test-NetConnection $Server -Port 445 -InformationLevel Detailed
pathping $Server
Get-NetAdapter | Sort-Object Name | Format-Table Name,Status,LinkSpeed,DriverInformation -Auto
Get-NetAdapterStatistics | Format-Table Name,ReceivedDiscardedPackets,ReceivedPacketErrors,OutboundDiscardedPackets,OutboundPacketErrors -Auto
Get-NetTCPConnection -RemotePort 445 | Format-Table LocalAddress,RemoteAddress,State,OwningProcess -Auto

Microsoft — Pathping ↗

5. Compare one large file with many small files

Prepare a non-sensitive data set in a test share. Run the same test outside peak hours and record duration, bytes, and files per second. Robocopy /J uses unbuffered I/O, which helps with a large-file test; /MT can accelerate many files, but it changes concurrency and should not hide abnormal latency.

A server-local copy helps separate network from storage, but still creates I/O. Use a disposable folder, an approved window, and the normal deletion process afterward. Never run a write-heavy DiskSpd test against a production volume.

Command Prompt — controlled test to a disposable folder

robocopy C:\PerfTest \\FS01\PerfTest$ large.bin /J /R:0 /W:0 /NP /LOG:C:\Temp\large-file.log
robocopy C:\PerfTest\Small \\FS01\PerfTest$\Small /E /R:0 /W:0 /NP /LOG:C:\Temp\small-files.log

rem Repeat with /MT:8 only to measure concurrency, not as an automatic fix.

Microsoft — Robocopy ↗

6. Correlate SMB, CPU, memory, network, and disk

Capture counters during the scenario, not hours later. SMB Client Shares, SMB Server Shares, and SMB Server Sessions counters relate demand to the share. Microsoft warns that some server-side SMB counters can materially affect high-I/O workloads, so keep collection short and representative.

Avg. Disk sec/Read and Write show latency observed by Windows, but an average hides spikes and may not reveal the responsible layer in a VM, SAN, or array. Compare against the same service's normal baseline and application sensitivity rather than a universal threshold from the Internet.

PowerShell — short counter sample

$Counters = @(
  '\Processor(_Total)\% Processor Time',
  '\Memory\Available MBytes',
  '\PhysicalDisk(*)\Avg. Disk sec/Read',
  '\PhysicalDisk(*)\Avg. Disk sec/Write',
  '\PhysicalDisk(*)\Disk Transfers/sec',
  '\Network Interface(*)\Bytes Total/sec',
  '\SMB Server Shares(*)\Data Bytes/sec',
  '\SMB Server Sessions(*)\Data Bytes/sec'
)
Get-Counter -Counter $Counters -SampleInterval 2 -MaxSamples 30

7. Prove antivirus impact before adding an exclusion

Antivirus can add work when an application rapidly opens, creates, and renames thousands of files. It can also be blamed when storage is already waiting. Microsoft Defender's performance analyzer records antimalware-engine events during a reproduction and ranks the paths, files, extensions, and processes consuming scan time.

Appearance in the report does not automatically justify an exclusion. Confirm vendor guidance, data type, risk, actual process, and measurable improvement. Prefer narrow scope, an owner, and a review date. Never exclude an entire volume, a whole application process, or executable extensions merely to gain throughput.

Administrator PowerShell — targeted Defender recording

New-MpPerformanceRecording -RecordTo C:\Temp\Defender-FileServer.etl
# Reproduce the scenario once, then press Enter.
Get-MpPerformanceReport -Path C:\Temp\Defender-FileServer.etl -TopFiles 20 -TopProcesses 20 -TopExtensions 20
Get-MpPreference | Select-Object ExclusionPath,ExclusionProcess,ExclusionExtension

8. Inspect storage and filters in context

Check free capacity, volume state, and storage events. For a virtual machine, obtain hypervisor and array telemetry too: the guest can observe a pause without seeing the physical queue, snapshot, or RAID rebuild.

File-system filter drivers belong to antivirus, backup, replication, encryption, deduplication, and DLP products. Their presence alone is not a fault. Look for timing correlation and driver versions; update or reconfigure with the vendor instead of removing a filter live.

PowerShell — capacity, reliability, and events

Get-Volume | Sort-Object DriveLetter | Format-Table DriveLetter,FileSystem,HealthStatus,SizeRemaining,Size -Auto
Get-PhysicalDisk | Format-Table FriendlyName,MediaType,HealthStatus,OperationalStatus,Size -Auto
Get-PhysicalDisk | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-4)} |
  Where-Object ProviderName -Match 'disk|stor|ntfs|refs|volsnap' |
  Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message
fltmc filters

9. Do not weaken SMB to hide a slowdown

SMB signing and encryption consume resources, especially on older hardware, but disabling them changes protection against tampering, relay, and eavesdropping. Windows 11 24H2 Enterprise, Pro, and Education require inbound and outbound SMB signing; Windows Server 2025 requires outbound signing by default. Treat a gap as an architecture and capacity decision, not a troubleshooting trick.

Measure CPU, dialect, algorithm, throughput, and hardware. Update drivers and firmware, then test a supported correction. Do not copy old SMB credit or thread registry changes from a generic post: Microsoft documents that several settings are version-dependent and not suitable for every server.

10. Turn measurements into a diagnosis

Correlation is not yet causation. Change one variable, define the expected result, and keep a rollback. If the metric does not improve or another risk appears, reverse the change.

Reproducible finding	Cause to test	Next validation
Name slow, IP fast	DNS or Kerberos, not simply SMB	Resolution, SPNs, tickets, aliases
Small files slow, large file normal	Latency, metadata, or scanning	RTT, filter, process, IOPS
Local and SMB copies slow	Server storage, filter, or CPU	Counters, events, array
Local normal, SMB slow at one site	Network or client path	Loss, retransmissions, VPN, MTU
Only one client slow	NIC, driver, DNS, security, or app	Control client on the same port
Spike during backup	Scheduled contention	Timeline, volume, limits, window
Defender dominates the recording	Specific path or process scanning	Pilot minimal exception, then measure
Multichannel absent	Ineligible topology or capability	RSS, adapters, routes, support

Lightweight collection versus change-window operations

Lightweight collection	Schedule carefully
DNS, TCP 445, SMB connection and sessions	Long packet capture or verbose debugging
Short counter sample	Continuous server SMB counters under heavy I/O
Volume, NIC, and event state	DiskSpd or sustained write testing
Defender report during one reproduction	Protection disablement or broad exclusion
Limited Robocopy into a disposable folder	Bulk copy on the production volume
Filter inventory	Driver removal, registry changes, or restart

A repeatable action plan

For a critical incident, protect data integrity and rollback capability first. A complete infrastructure assessment should then connect Windows evidence to the hypervisor, network, array, backups, and service objectives. This guide accelerates triage; it does not replace end-to-end validation.

T0 — record time, user, path, operation, file count, and size.
T+5 — capture DNS, TCP 445, SMB connection, client, server, and recent changes.
T+15 — reproduce large-file and small-file cases while correlating network, SMB, CPU, and disk.
T+30 — analyze Defender and filters only when evidence points to scanning.
Triage — classify DNS/authentication, client, network, SMB, filter, or storage.
Change — one adjustment with an owner, window, success criterion, and rollback.
After — compare before and after, monitor a representative period, and document the cause.

About the author

Marc-Antoine Lambert

Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.

Discuss your environment →