SMB transfer speeds decrease after installing Symantec Endpoint Protection


Article ID: 157551


Updated On:


Endpoint Protection


When Symantec Endpoint Protection (SEP) installed on a Windows computer, SMB network traffic throughput can decrease significantly. If SEP's Firewall component is uninstalled, the issue no longer occurs.


Performance degradation when processing occurs in user mode space.


This issued has been fixed in Symantec Endpoint Protection which introduces a "kernel mode" caching mechanism to improve performance. 

In order for the fix to work, the following "user mode" features of SEP must be disabled to prevent the traffic from entering the "user mode space".

  1. Denial of Service Protection
  2. Fingerprint Masquerading
  3. Stealth mode web browsing
  4. P2P Authentication
  5. Custom IPS

In addition, the fix will not work if on any firewall rule you have enabled packet logging. 

The fix supports Windows Vista and later platforms.