What does Windows actually do behind the scenes when you request to delete a file from a file share?

if user site b connects share on server in site , deletes large amount of data, why there large amount of bandwidth being used action?  what process occurring? 

hi,

the behaviour governed client operating system you're running. server side doesn't of it's own initiation other delete files.

if you're running windows vista or 7, you're going find great deal of traffic generated preview function responsible generating statistical information see (number of files, folders, estimated time complete, etc).

if perform same function command line, won't see of traffic nor take anywhere near long remove files.

personally, work command line, i'm unaware of if there's way disable functionality within windows explorer.

if want confirm what's happening, there's couple of avenues can pursue depending on client operating system , how prepared diagnostics:

• windows 7 / server 2008 r2: resource monitor
  need administrator run this. it's extremely basic insofar can use confirm behaviour described above. while statistics being compiled, see traffic system process destined port 445 on file server skyrocket.
• process monitor (download here)
  set trace captures "operation" that equal "querydirectory". kick off delete action , watch events pile up.
• network monitor (download here)
  if you're keen, can drill network layer network monitor , see literally traffic. i'd still recommend use filter though. following instructions apply network monitor 3.4.

configuring network monitor 3.4

• launch network monitor 3.4 administrator on client machine
• deselect adapters other local area connection (or if you've renamed it, whatever primary lan connection named)
• click new capture
• click capture settings button in toolbar
• type in following rule textbox area: smb2 && ipv4.address == <fileserveripaddress>
  replace <fileserveripaddress> ip4 address of file server
• click apply button close button accept capture filter
• click start button begin network trace
• attempt delete operation windows explorer , watch network monitor explode smb2 transactions
• stop network trace once statistics have finished being calculated

if happen have installed top users expert network monitor 3.4 (download here), can produce chart of how traffic passed between 2 hosts during calculation stage of delete operation.

technically, process monitor , network monitor approaches work on windows xp.

cheers,
lain

Windows Server  >  File Services and Storage