A file sharing connection to a Windows Server 2008-based server drops unexpectedly if the server has Symantec Endpoint Protection prior to 11.0.4202 (MR4-MP2) or Symantec Antivirus 10.2 installed

Assume that you try to access a network file share that resides on a server that is running Windows Server 2003, 2008, or 2008 R2. However, in this situation, the file sharing connection drops intermittently after a while, and then the network share becomes unresponsive.

When this problem occurs, the following events are logged in the event log:

Event ID: 4226
Source: Tcpip
Message:TCP/IP has reached the security limit imposed on the number of concurrent (incomplete) TCP connect attempts.

Event ID: 2022
Source: server
Message: The server was unable to find a free connection number times in the last number seconds.

Note Event 2022 may occur every 20 to 30 seconds.

This problem occurs when Windows Server is running certain versions of Endpoint Protection 11 or Symantec Antivirus 10.2. Some file filter drivers, such as Srtsp.sys or Srtsp64.sys, may cause this problem.

To resolve this issue, follow the instructions that are provided by Symantec to upgrade the software to the latest version of Symantec Endpoint Protection 11.0.4202.75 (MR4 MP2) or Symantec Antivirus. For more information, visit the following Symantec Knowledge Base article: For more information, visit the following Symantec Web site: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

For more information about intermittent file sharing connectivity from various clients to a Windows Server 2008 server, visit the following Microsoft Web site:

For more information see the following Microsoft Knowledge base articles:

961293 Unable to access Shares "The specified network name is no longer available" when Symantec Endpoint Protection prior to 11.0.4202 (MR4-MP2) or Symantec Antivirus 10.2 are installed on a Windows 2003, 2008 or 2008 R2 Server

http://support.microsoft.com/kb/961293

961654 A file sharing connection to a Windows Server 2008-based server drops unexpectedly if the server has Symantec Endpoint Protection prior to 11.0.4202 (MR4-MP2) or Symantec Antivirus 10.2 installed

http://support.microsoft.com/kb/961654

953615 Clients cannot get IP address from a Windows Server 2003 based DHCP server with Symantec Endpoint Protection 11.0 installed

http://support.microsoft.com/kb/953615

923360 You may experience various problems when you work with files over the network on a Windows Server 2003-based or Windows 2000 Server-based computer

http://support.microsoft.com/default.aspx?scid=kb;EN-US;923360

822219 Your system stops responding, you experience slow file server performance, or delays occur when you work with files that are located on a file server


http://support.microsoft.com/default.aspx?scid=kb;EN-US;822219