I have an odd problem. I have a farm of 8 Citrix terminal servers, running Server 2003 Std x86. The hardware on all servers is identical and all servers were built from the same image. Late last week, one the servers started having a problem where any file, when opened by double-clicking, seems to lock explorer.exe for about 2 minutes (I've timed it multiple times, anywhere from 2:09 to 2:40) after which point the file eventually opens. The file can be .txt, .doc, .xls, .jpg, etc. HOWEVER, if I open the required program first (notepad, Excel, whatever) and go to File/Open the file opens without incident.
I've tried running ProcessMonitor while the explorer 'lock' is occurring and I can't find a smoking gun (it's possible that it's there, but with 18,000+ lines it'll take a while to track it down even using filters).
I've started the server in Safe Mode and files open normally (without the lock). Subsequently I've tried stopping every service I can (while started normally) without success.
I've uninstalled AV (Symantec EAP 11) without any positive impact. The event logs are clean and none of the other servers are experiencing this problem.
Does anyone have any thoughts?
Okay, I figured it out and thought I'd post the answer here in case anyone finds this post thought a search.
Last week I replaced Adobe Reader on the Citrix farm with Foxit Reader. Before doing so I did some testing using an old Citrix server that's not part of the production farm. At some point I noticed that the Foxit install just consisted of an execuatable, and you could click the executable from anywhere on the network. At some point I clicked on the Foxit executable from the server which later became inflicted with this problem.
Late last week that old Citrix (testing) server failed and it wasn't restarted.
Justin's comment to use Wireshark showed multiple attempts on the part of the afflicted server to contact the failed test server. I searched the registry for that servername and found that the open, print and printto registry keys set to the foxit executable on the failed test server, rather than the local copy of Foxit.exe These keys: HKEY_CLASSES_ROOT\Applications\Foxit Reader.exe\shell\open\command HKEY_CLASSES_ROOT\Applications\Foxit Reader.exe\shell\print\command HKEY_CLASSES_ROOT\Applications\Foxit Reader.exe\shell\printto\command
Changing these keys to point to the local copy of Foxit.exe fixed the problem. Thanks Justin, for pointing me in the right direction.
Every time I've seen explorer hang it was because of an inaccessible mapped drive.
I would disable the Netbios protocol altogether (temporarily ) and see if that improves performance. By removing the protocol completely, you can narrow down the problem. Also, disabling the network adapter (temporarilty) would accomplish the same thing probably.