I was not working the case and the only email I saw from Microsoft and Citrix referenced the Microsoft hotfix and to also make sure all antivirus exclusions were configured. We did find their traditional antivirus software was causing a severe performance issues with a specific application (well over 14000 actions while launching the application). Disabling the antivirus services cut the launch time of the application from 45 seconds to 15 seconds. Obviously, making sure exclusions are properly configured are important. The customer has decided to remove their traditional antivirus software from all servers and are moving to https://www.cylance.com/ . Cylance also requires precautions with “Citrix” servers and specific applications but has a very small RAM and CPU footprint. Watching it prevent ransomware attacks in real-time is amazing.

Thanks

Webster

we have a similar issue here, almost identical to what you have seen.
Can you give any idea where I can find information on the known issues with heavy IO as it may help point me in the direction of how this update can actually be applied and if it is valid?
as obviously we wouldn’t want to downgrade our ntfs.sys file on a whim, if we could work out how to do it at all…

In a large enterprise with very strict change control, they used the update Microsoft told them to use. Installing Citrix or Microsoft updates into images where over 1000 applications are used by people around the world is not an easy task. They are still testing updated apps so they can finish their move off of PS4.5 and Server 2003.

Webster

No need to call MS to get a deprecated hotfix.

In fact there is more than 800 hotfixes for 2008 R2. I strongly suggest you just use KUC http://www.windows-update-checker.com and just install all of them into your golden images. The recommended hotfixes list by Citrix is missing just a few hundreds…

No problems. I’m just curious. I got hold of the hotfix and tried to run it on a test machine that already had a newer version of ntfs.sys. WUSA said that it wasn’t applicable. Sorry, I’m just intrigued how this hotfix applied.

Cheers,
Jeremy

I was working on GPO issues so I was not here when they applied the hotfix. Both Citrix and Microsoft were on the call with the customer so I was not directly involved. I was just asked to write it up.

Webster

That’s weird. Then logic tells me it shouldn’t have applied. Hotfixes only update older files. So the update rolled back the version of the nfts.sys file, or did it do something else?

Cheers,
Jeremy

The ntfs.sys file in the hotfix was older than what was in the PVS image having the issue.

Webster

Nice write-up.

This is just an updated ntfs.sys file. I wonder if the security update from kb2840149 would have also solved the issue given that it’s a newer version? Possibly no need to contact Microsoft.

Cheers,
Jeremy