macOS High Sierra 10.13.2 - Finder issues when copying files in mounted shares

[ThijsX]

Hi,

Currently we are experiencing below issue since 10.13.2, this issue is not active on 10.13.1 / 10.12.6.

The finder crashes when; Copying a single file from a lower folder niveau to a higher folder niveau on a mounted network file share.

The finder does not crash when; Copying a single file from a higher folder niveau to a lower folder niveau on a mounted network share.

Mounted share as SMB or CIFS.

Is anyone experiencing the same issue?

Cheers,
Thijs - bol.com

[SGill]

Tried to reproduce this under 10.13.2/Build 17C88 (we use a lot of SMB here) but I was unable to. Copying and moving a file appeared to work as expected...

[obi-k]

Try installing the 10.13.2 combo update, see if that helps.

Combo

[ThijsX]

@SGill Thanks for testing it out for me :)
@mvu will try, thanks!

[donmontalvo]

Adjust SMB browsing behavior in macOS High Sierra 10.13

[ThijsX]

@donmontalvo Thank you for posting the helpful article, tested this out on some devices but no succes till now.
Will dive deeper!

Thanks
Cheers,
Thijs bol.com

[goose11]

Same issue here, running 10.13.2 with smb share. Create new folder works... the finder crashes when: copy, rename a folder

[goose11]

Same issue here, running 10.13.2 with smb share. Create new folder works... the finder crashes when: copy, rename a folder

[Jae]

We have this issue. Pretty sure related to APFS. None of the suggestions worked in our environment. We have Windows Servers using SMB3 which seems to be the issue. On Servers using SMB2, we didn't see this problem. Only options was to connect with SMB1/cifs

cifs://servername rather then SMB. I would do a check in terminal with the drives mounted to see how your connected and then see if there is an option on the server to switch it off. Though from what I understand SMB2 and SMB3 piggy back off one another so you can't just turn one off or on.

[ThijsX]

@goose11 @Jae Thank you for helping me out, good to hear (lucky) i am not the only one in this. Fact is, we have over 1500+ Windows machines that is functioning properly on SMBv3 so we cant turn it off.

I will check if we can find a workaround, hopefully Apple is quickly fixing this issue!

Cheers,
Thijs bol.com

[ThijsX]

Hi,

We are not alone, seems to be..

https://discussions.apple.com/thread/8191222

Cheers,
Thijs - bol.com

[option8]

I've replicated and tested this all afternoon, and it looks like the only workaround I can find is switching from smb:// to cifs:// - none of the other tweaks to SMB sharing I've found online made any difference.

Watching the console for log messages while invoking the bug by changing the name of a file on the server, I see the following messages on SMB connection:

default 15:25:19.151066 -0500 Finder Write options: 2 -- URL: <private> -- purposeID: com.apple.desktopservices.copyengine -- claimID: 414B91F0-D637-42BA-AAAA-D0643F98A239 default 15:25:19.151538 -0500 filecoordinationd Received claim 414B91F0-D637-42BA-AAAA-D0643F98A239 default 15:25:19.151628 -0500 filecoordinationd Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 granted in server default 15:25:19.151682 -0500 filecoordinationd Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 invoked in server default 15:25:19.151857 -0500 Finder Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 granted in client default 15:25:19.151882 -0500 Finder Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 invoked in client

And this while connected as CIFS:

default 15:36:16.636776 -0500 Finder Write options: 2 -- URL: <private> -- purposeID: com.apple.desktopservices.copyengine -- claimID: DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 default 15:36:16.637052 -0500 filecoordinationd Received claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 default 15:36:16.637140 -0500 filecoordinationd Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 granted in server default 15:36:16.637185 -0500 filecoordinationd Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 invoked in server default 15:36:16.637346 -0500 Finder Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 granted in client default 15:36:16.637371 -0500 Finder Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 invoked in client default 15:36:16.663322 -0500 filecoordinationd Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 was revoked

Note, the last line, where the claim is revoked. That seems to be missing in a SMB connection, and I suspect is the step that's causing the Finder to lock up, waiting.

Maybe someone who knows what filecoordinationd is actually doing can clear things up, but I suspect it's to do with locking the file to changes while the Finder renames it, then releasing the lock. On an SMB2/3 connection the lock never releases, while on SMB1/CIFS, it does.

Anyhoo, I'm trying to install the 10.13.2 combo update on an effected machine, and I'll follow up if it makes any difference.

[andysemak]

Seeing this also.

When Finder crashes, are you able to relaunch? I'm having to force power off .

Has anyone raised a ticket with Apple that can be duped?

[ThijsX]

@option8 T.hanks for the great logging and troubleshooting, will also investigate this.

@andysemak We also have to force power off.
Did not raise a ticket with Apple, is there a process for that?

[ch3valier]

I am seeing identical issues to those expressed and have opened a ticket with apple. I encourage everyone to do so; generally speaking the more tickets the higher priority a patch becomes.

To wit:
Temporary fix is to use CIFS until this is patched.
Only occurs with workstations running 10.13.2 (with 10.13.1 this is not an issue)
I even formatted and did a clean install; issues remains
Appears to be only occurring when connecting to SMB3 shares
When this happens the Mac must be powered down; finder cannot be restarted or killed even via terminal with sudo privilages
I attempted some steps in this KB https://support.apple.com/en-us/HT208209 to see if it helped; it did not resolve this issue.

[powderspecial60]

We had the same thing happen here as well. I was able to fix it by creating an nsmb.conf file to disable packet signing. Once I created the file and rebooted it was no longer an issue. Hope this helps until there is a fix.
https://support.apple.com/en-ca/HT205926

[pchadwick]

I'm having precisely the same issue after upgrading macOS Server to 10.13.x

client machine finder crash on file move; must hard reboot.

thankful to have found this thread. reverting to AFP connections resolves problem which is less than ideal.

[swapdrive]

I can reproduce the Finder crash.

Server: macOS High Sierra 10.13.2 with Fusion Drive and HFS+ Filesystem
Standard macOS SMB file sharing

Client System: macOS High Sierra 10.13.2
User has full file permissions via an ACL permissions group except „change permissions“ and „change owner“.

It happens when I move a file (drag'n drop) from one folder (same level) to another on the network drive. Finder can only be forced to quit and doesn't restart afterwards. System can only be shut down via holding the power button.

[ThijsX]

Reached out to Apple Enterprise support, they created a ticket and will come back to me soon.
If i have any intel on this, i keep ya posted.

Cheers,
Thijs - bol.com

[jmahlman]

Glad to know I'm not the only one having there issue.

[ThijsX]

Created a big log file with the Enterprise Data Capture tool from Apple Enterprise support, just submitted it an they created an escalation.

Cheers,
Thijs - bol.com

[cbdilger]

All of this is very familiar: moving a file on a shared volume leads to Bad Things which only a hard reboot fixes.

Thanks everyone for the work here.

[murphycoverdot]

Having what sounds like the same problem in at least one of our branches. Nobody here has reported it, but then, not everyone is on 10.13.x. FWIW, 10.13.1 will lock up the Finder the same way if we push it hard enough (typically, this doesn't happen on the first(or even the second or third necessarily) operation (drag and drops), but it will happen. Not sure about 10.12.x as we haven't pushed it hard enough to see if we can lock up the Finder.

Hope to hear something good from Apple Enterprise via Thijs. FWIW, we've disabled SMBv1 on all our Windows servers due to vulnerabilities in the protocol.

[murphycoverdot]

Wondering if this just started back in December? When I asked a user with the issue, they said it happened some time after an update to MS OneDrive for Business. Not sure if there is a real connection there or not.

[djjohns1]

Experiencing the same issue here with 10.3.2. Coworkers have not had any problems with 10.3.1. Have worked closely with my IT department and no solutions as of yet.

Any time I'm moving a file, finder locks up (I have found that CTRL+C and CTRL+V'ing a file is a work around for the time being). Any time I'm renaming a file, finder locks up. And on and on. A hard reboot is the only solution I have to get things back up and running.

Looking forward to getting things back to norm.

[ThijsX]

@murphycoverdot It started happening since 10.13.2, We currently do not have MS OneDrive in our organization.

[MitchT11]

This just started happening to us Wednesday. Finder crashes, if you try to Relaunch it just hangs. If you go to another app and get the Menu Bar back and Shut Down it doesn't shut down all the way. Hard shutdown required. Major pain. It's also preventing me from connecting to the Win 2012 server via our Sophos VPN. I have a Macbook sitting next to me running Sierra and it works fine. At least via the VPN using CIFS doesn't change anything, neither does changing SMB packet signing settings https://support.apple.com/en-ca/HT205926

[ThijsX · Accepted solution]

Got a workaround that worked in our organization.

This changes for macOS the SMB behavior to v2
Changed beneath setting in the /etc/nsmb.con file.

#!/bin/sh echo "[default]" >> /etc/nsmb.conf echo "protocol_vers_map=2" >> /etc/nsmb.conf exit 0

For now, no more finder crashes.

Cheers,
Thijs - bol.com

[ch3valier]

Thijs,

This is great - I wish that Apple had suggested this work around to me. I figured there was a way to disable SMB3 but couldn't find it. The docs I found on nsmb.conf on the Apple Developer site did not mention the protocol_vers_map feature. I've had to support and troubleshoot a number of issues with CIFS and software that is establishing/maintaining it's own connection.

So far this morning this one seems to resolutely resolve all issues until Apple has a patch for its broken SMB3 implementation with 10.13.2.

[ThijsX]

@ch3valier Great to hear!

Cheers,
Thijs - bol.com

[andysemak]

@txhaflaire Hi

Do you have an Enterprise Support case number?

[NaeemTHM]

@txhaflaire

I created an account JUST to say you completely solved my issue!!

Thank you so much.

[ThijsX]

@NaeemTHM Great that it solved it temporary for you!

@andysemak Sure, what do you need it for?

Apple asked me to test 10.13.3 beta and verify if the problem still there, havent found the time to test the beta.

Cheers,
Thijs - bol.com

[anth0nys]

I tested it last on 10.13.3 beta 2 and it was still broken, haven't had a chance to update to beta 3 (or 4 which I just found out was released). Forcing SMB2 worked for me in my test environment, which is a VM running Windows 2012 R2 server and a machine running 10.13.3 beta 2.

[mbeach]

Apologies in advance. Noob here. I am a single MAC running in a windows environment and I am experiencing the Finder lock up with shares on the server described here. It is very much limiting my ability to work efficiently. Plus having to hard reboot is playing havoc with my attached USB Time Machine backup drive. Already had to erase it twice and I am having to disconnect it after a manual backup to maintain its integrity.

When I try to execute the code to limit SMB communications to SMB2 I get access denied. I have tried adding SUDO to each line but that doesn't work. I went to Apple support and tried to do it per this article https://support.apple.com/en-us/HT208209 but again access denied.

Can someone here tell me how to execute the commands properly and how I can check that they were done. I assume that the /etc/nsmb.conf is a hidden file in a hidden folder under /system/library/ but that is just an assumption on my part.

I do have Admin rights for my user. Do I need to enable and log in as the root user (having read that this is potentially a dangerous thing to do).

I know that I know enough to be dangerous but not enough to keep me out of trouble. Thanks in advance.

[jakobstockman]

So the "protocol_vers_map=2" solution seems to work 50/50, the half that it doesn't work for receives an Access Denied when trying to authenticate against the server (Win 2012r2). In the server log I find the following message:

"SMB Session Authentication Failure

Client Name: x.x.x.x
Client Address: x.x.x.x:49219
User Name: DOMAINuser
Session ID: 0x1234567890
Status: The remote user session has been deleted. (0xC0000203)

Guidance:

You should expect this error when attempting to connect to shares using incorrect credentials.

This error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.

This error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled"

Any ideas?

[ThijsX]

@mbeach

To verify that the nsmb.conf file is changed do the following;

• Finder > Go > Go to folder > /etc
• Search for the nsmb.conf file
• Open the file with textedit oi.
• Check if the file has the value's in it.
• If the file is not there, there went something wrong en let us know!

Cheers,
Thijs - bol.com

[jutah]

@txhaflaire

Can you give a little more detail? I have a few Mac's in our office doing this but making a nsmb.con file then pasting the code doesn't fix the problem for us.

Im using exactly what you posted.

!/bin/sh

echo "[default]" >> /etc/nsmb.conf
echo "protocol_vers_map=2" >> /etc/nsmb.conf

exit 0

[Tekniqueman]

@thijs
Thanks Thijs,
Your solution was just what worked, now I can relax and my client is happy again. Thank you one more time, it really make my day

[mantos]

Thanks guys for working on this. I have had the same issue since December.
@txhaflaire I can't find the nsmb.conf file when going into the /etc folder (hidden files are shown). Do you have any suggestion why that is? Thanks man