Windows Server 2025 SMB Client Fails to Send CLOSE Command After Partial Compound Request Failure, Causing Handle Leak

cb zhang 0 Reputation points
2026-06-30T07:41:44.6166667+00:00

Problem Description:

Issue Summary: When Windows Server 2025 (Build 26100.32230) acts as an SMB client accessing a third-party SMB server, it sends compound requests containing CREATE. When CREATE succeeds but subsequent operations fail, the client does not send a CLOSE command to release the handle, resulting in resource leaks on the server side.

Environment:

  • Affected System: Windows Server 2025 Build 26100.32230
  • Working Systems: Windows Server 2016, Windows 10 (no issue)
  • SMB Server: Third-party SMB server (ksmbd-like implementation)

Reproduction Steps:

  1. Use WS2025 client to connect to SMB server
  2. Client sends compound request: CREATE + IOCTL (or other operations)
  3. Server returns: CREATE success (FileId) + IOCTL failure
  4. Observation: Client does NOT send CLOSE command
  5. Repeated operations cause handle leak on server side

Impact:

  • Server-side file handles/resources continuously leak
  • May lead to resource exhaustion during long-term operation
  • This issue does NOT occur on Windows Server 2016 and Windows 10

Additional Information:

    • Network packet capture (.pcap) is available showing the missing CLOSE command winserver 2025: 企业微信截图_17827915832344 win10: 企业微信截图_17827915194188
    • This behavior appears to be a regression from previous Windows versions
Windows for business | Windows Server | User experience | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Nguyen Tran 21,375 Reputation points Independent Advisor
    2026-06-30T10:48:20.14+00:00

    Hi cb zhang,

    From what you’ve described, the Windows Server 2025 SMB client is not issuing a CLOSE command after a compound request partially fails, which results in orphaned handles. This does look like a regression compared to Windows Server 2016 and Windows 10, where the client properly cleans up after such failures.

    At this point, the recommended steps are:

    • Confirm the issue with a clean test environment to rule out third-party interference.
    • Capture traces (as you’ve already done) and verify that the CLOSE command is indeed missing after the failed compound request.
    • Share those traces and reproduction steps with Microsoft Support, as this will help engineering validate the regression.
    • As a temporary mitigation, consider adjusting client-side logic to avoid compound requests that mix CREATE with operations likely to fail, or configure the SMB server to enforce handle cleanup on its side.

    Careful monitoring and server-side cleanup policies can help reduce the risk of resource exhaustion until a future update is released to resolve this.

    I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

    Jason.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.