DFS Client bug causes offline folder synch issues.

book

Article ID: 159951

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

When the DLP Endpoint agent and SEP (or another security technology) are running on the same box it may cause intermittent issues with offline folder synchronization on Windows XP. 

Disabling EDPA and/or SEP will help to not trigger the MS bug. The problem in itself is NOT the result of SEP or Endpoint agents running on the endpoint.  Rather, it is the quantity of minifilter drivers present within the driver stack.

Resolution

This issue has been confirmed as a Microsoft XP bug:

When an XP machine is configured for offline folders and those folders reside on a DFS destination, OR a DFS destination is mapped as network drive, the drive or folders are marked as offline, if DLP and SEP are installed.  Users see a balloon pop-up notifying the network destination is offline.  Users need to manually synch-up their folders or map network drive again.

There is a known issue with Windows XP's implementation of the DFS Client (MUP.sys).  If a file system filter driver (i.e. vfsmfd.sys) attaches to MUP.sys before the DFS client finds its target device information, it will use the filter's target device, causing access to the DFS share to fail and go offline.  With legacy file system drivers the issue is not seen.

Microsoft has acknowledged this to be a bug in XP, and will not fix this as XP is nearing end of support.  Windows Vista (and later) have been redesigned to address this and other adjacent issues. Hence the issue does not manifest there.

Again, it is not so much the presence or type of mini filter drivers, but the number on the driver stack.  Since MUP.sys determines the target device in a lazy manner, there is no safe way to attach a file system filter driver that would avoid this limitation.

Offline files with DFS hosted destinations are not recommended on Windows XP due to a bug in MS filter manager, which manifests when SEP and DLP are installed.  In general, any software that installs a file system filter driver will have same issue if there are multiple filter drivers. 

 

Windows 7 is recommended in such configurations. Additional insight can be gained through the use of the "fltmc" command.  Type this at the command prompt to see the minifilter drivers presently on the stack.

        

While this is a known problem with XP, it does not appear in Vista or subsequent Windows offerings as they have rewritten the code.

See the attachment to the right for the explanation directly from Microsoft.

See also Etrack 2645095.


Attachments

MS PROBLEM DESCRIPTION 56000.docx get_app