What is the cause of FAST I/O DISALLOWED errors? (Causing Outlook to open attachments really slowly)

Question

When a colleague tries to open attachments in her email (Outlook 2003 talking to an Exchange 2007 server) they take ages to open. The files are relatively small, all less than 1MB.

We've tried creating a new Windows profile for the user and tried creating new Outlook profiles, however that hasn't made any difference.

And we've tried accessing her account from someone else's PC, and the attachments open immediately there.

The only thing that might provide a clue is that Process Monitor shows Outlook on her PC trying to write the file to a folder within the user's "Temporary Internet Files" folder with FAST I/O DISALLOWED errors. Can't find a lot of useful information on that message online though.

What causes the FAST I/O DISALLOWED errors?

And would that make opening attachments so incredibly slow that opening a < 1MB file can take a matter of minutes?

UPDATE: Discovered that this isn't just an issue with Outlook. Other files being accessed over the network show the same FAST I/O DISALLOWED errors in Process Monitor. The problem is just more noticeable with Outlook, because although other applications take a while to open files it isn't a matter of minutes.

Solution 1

FAST I/O DISALLOWED just means that a process is trying to access file data and the system doesn't have that data cached.

It's documented quite extensively in the fourth edition of Windows Internals by Mark Russinovich and David Solomon.

So in relation to the problem we were having it makes sense to see these FAST I/O DISALLOWED errors because the data wouldn't likely be cached.

We never managed to work out exactly what was causing the issues with the attachments.

Solution 2

The items listed here will generally clear up workstation-specific Outlook issues. The short list is:

• Insufficient computer specifications
• The latest service pack for Outlook 2007 not installed
• Large Personal Folders files (.pst) or Offline Folder files (.ost)
• Outlook .ost files or .pst files that are stored on a drive with insufficient write performance
• Third-party add-ins
• Gadgets that access Outlook data (This only applies to Windows Vista)
• Microsoft Office Communicator integration
• Antivirus software interaction
• Windows Desktop Search indexing
• Incomplete closure of .pst files or .ost files
• POP3 accounts on Windows Vista clients
• Many Really Simple Syndication (RSS) feeds
• To-Do Bar and Online mode with Exchange server

Tho this may be the kind of issue where you'll get better answers on SU, I haven't had my coffee yet.

Solution 3

at http://forum.sysinternals.com/what-is-fast-io-disallowed_topic23154.html is says:

It's benign but the explanation is a bit long.

Basically, for a few I/O operations there are two ways that a driver can service the request. The first is through a procedural interface where the driver is called with a set of parameters that describe the I/O operation. The other is an interface where the driver receives a packetized description of the I/O operation.

The former interface is called the "fast I/O" interface and is entirely optional, the latter interface is the IRP based interface and what most drivers use. A driver may choose to register for both interfaces and in the fast I/O path simply return a code that means, "sorry, can't do it via the fast path, please build me an IRP and call me at my IRP based entry point." This is what you're seeing in the Process Monitor output, someone is returning "no" to the fast I/O path and this results in an IRP being generated and the normal path being taken.

Comments

[Dave M]

Does this system happen to have an external hard drive attached?

[Alistair McMillan]

No the user doesn't have any external drives.

[Alistair McMillan]

Went through this list. Computer specs okay. Outlook updated with latest service pack. No PST or OST files, addins, gadgets, or desktop search tools. No RSS feeds. Using same anti-virus software (which is up to date) as everyone else, which doesn't show any particularly noticeable change in activity when opening attachments anyway. And don't think it can be a server problem since the same attachments can be accessed okay on other PCs.

[George Birbilis]

at sysinternals (aka Mark Russinovich et al, now part of Microsoft, they make procmon) forum I found something that looks like a different answer though, see my reply below (couldn't fit in a comment)