Why do "net use" and windows "map network drive" share have a drastic speed difference?

Question

Why, when I copy a file (windows explorer copy, paste), am I getting ~100KB/s transfer rate from a drive mapped using the "net use" command in the command prompt and between 25-50MB/s transfer rate when I map the drive using Windows explorer? What is different about these two methods that would affect transfer speed?

Givens/Environment:

• Server of the share: Windows 2012R2, locked down with the CIS benchmark at http://benchmarks.cisecurity.org/downloads/show-single/?file=windows2012R2.110

  • Settings were locked down by group policy on the domain controller that the server is a member of.

• Server of the share is attached to a domain controller on the same network, let's call it "mydomain.local"

• Server connecting to the share: Windows 2008R2, remote location, different domain, let's call it "mydomain.remote"

• Removing all of the CIS recommended settings makes the speed fast for both types of network drive mapping.

• The connecting and the sharing servers are in two different data centers, connected via the internet

• Regardless of which connection (net use / windows explorer) is used, the same credentials are supplied. Let's call this account: mydomain.local\myuser

• I believe the speed is slow because of this (http://jrs-s.net/2013/04/15/windows-server-2012-slow-networksmbcifs-problem/ ), but I don't know why it would be different depending on if "net use" was used rather than windows explorer.

Solution

I have seen situations multiple times regarding domain controllers hosting shares. They require a security signature on SMB that can dramatically slow file transfer rates to and from domain controllers especially on legacy hardware as the encryption process taxes the processor pretty hard.

Here is the registry key

HKLM\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature

Here is an article related to these statements.

https://technet.microsoft.com/en-us/library/c9dfa127-8e28-46de-81d0-6d0742c28420

Comments

[TheFiddlerWins]

You'd need to sniff to verify but a guess is net use is using SMB 2 and the GUI is using SMB 3

[JNadal]

Would there be a way to force the "net use" to use SMB3?

[BlueCompute]

If one of the parties is 2008 R2 then SMB 3.0 isn't an option. blogs.technet.com/b/josebda/archive/2012/06/06/…

[BlueCompute]

Can you use New-PSDrive instead?

[JNadal]

Yes, one of the sides is 2008 R2 (the side that's mapping the drive, and the one that's pulling a file down).

[JNadal]

I can give New-PSDrive a try; thanks for the suggestion. Does that work over SMB as well?

[BlueCompute]

Yes, see here: technet.microsoft.com/en-us/library/hh849829.aspx The -persist parameter allows you to map a windows network drive.

[JNadal]

In this situation, the domain controller is not the server hosting the share. I may not have been clear in my word choice when I said that the server of the share was "attached" to the domain, but neither the sharing server nor the connecting (client) server is a domain controller, and they are connected to two different domains. I did think that that registry key (or in my case, the group policy) had an effect, but I can't understand why net use would be different than mapping it in windows explorer.

[Citizen]

It may be worth checking for the registry entry in the server to validate if the signature is turned on or not. You could compare transfer times between the two states and rule out some possibilities or solve the problem.

[JNadal]

Well, yes, I will say that the signature is turned on -- the CIS benchmark linked in the original question requires it. My question wasn't about why net use was slowing down with that the requirement of security signature -- that much was clear in the documentation of the benchmark. I don't understand why net use and the GUI have different performance when that requirement is turned on.