Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

macOS High Sierra 10.13.2 - Finder issues when copying files in mounted shares

Hi,

Currently we are experiencing below issue since 10.13.2, this issue is not active on 10.13.1 / 10.12.6.

The finder crashes when; Copying a single file from a lower folder niveau to a higher folder niveau on a mounted network file share.

The finder does not crash when; Copying a single file from a higher folder niveau to a lower folder niveau on a mounted network share.

Mounted share as SMB or CIFS.

Is anyone experiencing the same issue?

Cheers,
Thijs - bol.com

Like Comment
Order by:
SOLVED Posted: by SGill

Tried to reproduce this under 10.13.2/Build 17C88 (we use a lot of SMB here) but I was unable to. Copying and moving a file appeared to work as expected...

Like
SOLVED Posted: by mvu

Try installing the 10.13.2 combo update, see if that helps.

Combo

Like
SOLVED Posted: by txhaflaire

@SGill Thanks for testing it out for me :)
@mvu will try, thanks!

Like
SOLVED Posted: by txhaflaire

@donmontalvo Thank you for posting the helpful article, tested this out on some devices but no succes till now.
Will dive deeper!

Thanks
Cheers,
Thijs bol.com

Like
SOLVED Posted: by goose11

Same issue here, running 10.13.2 with smb share. Create new folder works... the finder crashes when: copy, rename a folder

Like
SOLVED Posted: by goose11

Same issue here, running 10.13.2 with smb share. Create new folder works... the finder crashes when: copy, rename a folder

Like
SOLVED Posted: by Jae

We have this issue. Pretty sure related to APFS. None of the suggestions worked in our environment. We have Windows Servers using SMB3 which seems to be the issue. On Servers using SMB2, we didn't see this problem. Only options was to connect with SMB1/cifs

cifs://servername rather then SMB. I would do a check in terminal with the drives mounted to see how your connected and then see if there is an option on the server to switch it off. Though from what I understand SMB2 and SMB3 piggy back off one another so you can't just turn one off or on.

Like
SOLVED Posted: by txhaflaire

@goose11 @Jae Thank you for helping me out, good to hear (lucky) i am not the only one in this. Fact is, we have over 1500+ Windows machines that is functioning properly on SMBv3 so we cant turn it off.

I will check if we can find a workaround, hopefully Apple is quickly fixing this issue!

Cheers,
Thijs bol.com

Like
SOLVED Posted: by txhaflaire

Hi,

We are not alone, seems to be..

https://discussions.apple.com/thread/8191222

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by option8

I've replicated and tested this all afternoon, and it looks like the only workaround I can find is switching from smb:// to cifs:// - none of the other tweaks to SMB sharing I've found online made any difference.

Watching the console for log messages while invoking the bug by changing the name of a file on the server, I see the following messages on SMB connection:

default 15:25:19.151066 -0500 Finder Write options: 2 -- URL: <private> -- purposeID: com.apple.desktopservices.copyengine -- claimID: 414B91F0-D637-42BA-AAAA-D0643F98A239 default 15:25:19.151538 -0500 filecoordinationd Received claim 414B91F0-D637-42BA-AAAA-D0643F98A239 default 15:25:19.151628 -0500 filecoordinationd Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 granted in server default 15:25:19.151682 -0500 filecoordinationd Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 invoked in server default 15:25:19.151857 -0500 Finder Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 granted in client default 15:25:19.151882 -0500 Finder Claim 414B91F0-D637-42BA-AAAA-D0643F98A239 invoked in client

And this while connected as CIFS:

default 15:36:16.636776 -0500 Finder Write options: 2 -- URL: <private> -- purposeID: com.apple.desktopservices.copyengine -- claimID: DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 default 15:36:16.637052 -0500 filecoordinationd Received claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 default 15:36:16.637140 -0500 filecoordinationd Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 granted in server default 15:36:16.637185 -0500 filecoordinationd Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 invoked in server default 15:36:16.637346 -0500 Finder Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 granted in client default 15:36:16.637371 -0500 Finder Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 invoked in client default 15:36:16.663322 -0500 filecoordinationd Claim DA242FF2-84E3-4A4C-AC08-DFA75F9749B5 was revoked

Note, the last line, where the claim is revoked. That seems to be missing in a SMB connection, and I suspect is the step that's causing the Finder to lock up, waiting.

Maybe someone who knows what filecoordinationd is actually doing can clear things up, but I suspect it's to do with locking the file to changes while the Finder renames it, then releasing the lock. On an SMB2/3 connection the lock never releases, while on SMB1/CIFS, it does.

Anyhoo, I'm trying to install the 10.13.2 combo update on an effected machine, and I'll follow up if it makes any difference.

Like
SOLVED Posted: by andysemak

Seeing this also.

When Finder crashes, are you able to relaunch? I'm having to force power off .

Has anyone raised a ticket with Apple that can be duped?

Like
SOLVED Posted: by txhaflaire

@option8 T.hanks for the great logging and troubleshooting, will also investigate this.

@andysemak We also have to force power off.
Did not raise a ticket with Apple, is there a process for that?

Like
SOLVED Posted: by ch3valier

I am seeing identical issues to those expressed and have opened a ticket with apple. I encourage everyone to do so; generally speaking the more tickets the higher priority a patch becomes.

To wit:
Temporary fix is to use CIFS until this is patched.
Only occurs with workstations running 10.13.2 (with 10.13.1 this is not an issue)
I even formatted and did a clean install; issues remains
Appears to be only occurring when connecting to SMB3 shares
When this happens the Mac must be powered down; finder cannot be restarted or killed even via terminal with sudo privilages
I attempted some steps in this KB https://support.apple.com/en-us/HT208209 to see if it helped; it did not resolve this issue.

Like
SOLVED Posted: by powderspecial600

We had the same thing happen here as well. I was able to fix it by creating an nsmb.conf file to disable packet signing. Once I created the file and rebooted it was no longer an issue. Hope this helps until there is a fix.
https://support.apple.com/en-ca/HT205926

Like
SOLVED Posted: by pchadwick

I'm having precisely the same issue after upgrading macOS Server to 10.13.x

client machine finder crash on file move; must hard reboot.

thankful to have found this thread. reverting to AFP connections resolves problem which is less than ideal.

Like
SOLVED Posted: by swapdrive

I can reproduce the Finder crash.

Server: macOS High Sierra 10.13.2 with Fusion Drive and HFS+ Filesystem
Standard macOS SMB file sharing

Client System: macOS High Sierra 10.13.2
User has full file permissions via an ACL permissions group except „change permissions“ and „change owner“.

It happens when I move a file (drag'n drop) from one folder (same level) to another on the network drive. Finder can only be forced to quit and doesn't restart afterwards. System can only be shut down via holding the power button.

Like
SOLVED Posted: by txhaflaire

Reached out to Apple Enterprise support, they created a ticket and will come back to me soon.
If i have any intel on this, i keep ya posted.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by jmahlman

Glad to know I'm not the only one having there issue.

Like
SOLVED Posted: by txhaflaire

Created a big log file with the Enterprise Data Capture tool from Apple Enterprise support, just submitted it an they created an escalation.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by cbdilger

All of this is very familiar: moving a file on a shared volume leads to Bad Things which only a hard reboot fixes.

Thanks everyone for the work here.

Like
SOLVED Posted: by murphycoverdot

Having what sounds like the same problem in at least one of our branches. Nobody here has reported it, but then, not everyone is on 10.13.x. FWIW, 10.13.1 will lock up the Finder the same way if we push it hard enough (typically, this doesn't happen on the first(or even the second or third necessarily) operation (drag and drops), but it will happen. Not sure about 10.12.x as we haven't pushed it hard enough to see if we can lock up the Finder.

Hope to hear something good from Apple Enterprise via Thijs. FWIW, we've disabled SMBv1 on all our Windows servers due to vulnerabilities in the protocol.

Like
SOLVED Posted: by murphycoverdot

Wondering if this just started back in December? When I asked a user with the issue, they said it happened some time after an update to MS OneDrive for Business. Not sure if there is a real connection there or not.

Like
SOLVED Posted: by djjohns1

Experiencing the same issue here with 10.3.2. Coworkers have not had any problems with 10.3.1. Have worked closely with my IT department and no solutions as of yet.

Any time I'm moving a file, finder locks up (I have found that CTRL+C and CTRL+V'ing a file is a work around for the time being). Any time I'm renaming a file, finder locks up. And on and on. A hard reboot is the only solution I have to get things back up and running.

Looking forward to getting things back to norm.

Like
SOLVED Posted: by txhaflaire

@murphycoverdot It started happening since 10.13.2, We currently do not have MS OneDrive in our organization.

Like
SOLVED Posted: by MitchT11

This just started happening to us Wednesday. Finder crashes, if you try to Relaunch it just hangs. If you go to another app and get the Menu Bar back and Shut Down it doesn't shut down all the way. Hard shutdown required. Major pain. It's also preventing me from connecting to the Win 2012 server via our Sophos VPN. I have a Macbook sitting next to me running Sierra and it works fine. At least via the VPN using CIFS doesn't change anything, neither does changing SMB packet signing settings https://support.apple.com/en-ca/HT205926

Like
SOLVED Posted: by txhaflaire

Got a workaround that worked in our organization.

This changes for macOS the SMB behavior to v2
Changed beneath setting in the /etc/nsmb.con file.

#!/bin/sh echo "[default]" >> /etc/nsmb.conf echo "protocol_vers_map=2" >> /etc/nsmb.conf exit 0

For now, no more finder crashes.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by ch3valier

Thijs,

This is great - I wish that Apple had suggested this work around to me. I figured there was a way to disable SMB3 but couldn't find it. The docs I found on nsmb.conf on the Apple Developer site did not mention the protocol_vers_map feature. I've had to support and troubleshoot a number of issues with CIFS and software that is establishing/maintaining it's own connection.

So far this morning this one seems to resolutely resolve all issues until Apple has a patch for its broken SMB3 implementation with 10.13.2.

Like
SOLVED Posted: by txhaflaire

@ch3valier Great to hear!

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by andysemak

@txhaflaire Hi

Do you have an Enterprise Support case number?

Like
SOLVED Posted: by NaeemTHM

@txhaflaire

I created an account JUST to say you completely solved my issue!!

Thank you so much.

Like
SOLVED Posted: by txhaflaire

@NaeemTHM Great that it solved it temporary for you!

@andysemak Sure, what do you need it for?

Apple asked me to test 10.13.3 beta and verify if the problem still there, havent found the time to test the beta.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by anth0nys

I tested it last on 10.13.3 beta 2 and it was still broken, haven't had a chance to update to beta 3 (or 4 which I just found out was released). Forcing SMB2 worked for me in my test environment, which is a VM running Windows 2012 R2 server and a machine running 10.13.3 beta 2.

Like
SOLVED Posted: by mbeach

Apologies in advance. Noob here. I am a single MAC running in a windows environment and I am experiencing the Finder lock up with shares on the server described here. It is very much limiting my ability to work efficiently. Plus having to hard reboot is playing havoc with my attached USB Time Machine backup drive. Already had to erase it twice and I am having to disconnect it after a manual backup to maintain its integrity.

When I try to execute the code to limit SMB communications to SMB2 I get access denied. I have tried adding SUDO to each line but that doesn't work. I went to Apple support and tried to do it per this article https://support.apple.com/en-us/HT208209 but again access denied.

Can someone here tell me how to execute the commands properly and how I can check that they were done. I assume that the /etc/nsmb.conf is a hidden file in a hidden folder under /system/library/ but that is just an assumption on my part.

I do have Admin rights for my user. Do I need to enable and log in as the root user (having read that this is potentially a dangerous thing to do).

I know that I know enough to be dangerous but not enough to keep me out of trouble. Thanks in advance.

Like
SOLVED Posted: by jakobstockman

So the "protocol_vers_map=2" solution seems to work 50/50, the half that it doesn't work for receives an Access Denied when trying to authenticate against the server (Win 2012r2). In the server log I find the following message:

"SMB Session Authentication Failure

Client Name: \x.x.x.x
Client Address: x.x.x.x:49219
User Name: DOMAIN\user
Session ID: 0x1234567890
Status: The remote user session has been deleted. (0xC0000203)

Guidance:

You should expect this error when attempting to connect to shares using incorrect credentials.

This error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.

This error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled"

Any ideas?

Like
SOLVED Posted: by txhaflaire

@mbeach

To verify that the nsmb.conf file is changed do the following;

  • Finder > Go > Go to folder > /etc
  • Search for the nsmb.conf file
  • Open the file with textedit oi.
  • Check if the file has the value's in it.
  • If the file is not there, there went something wrong en let us know!

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by jutah

@txhaflaire

Can you give a little more detail? I have a few Mac's in our office doing this but making a nsmb.con file then pasting the code doesn't fix the problem for us.

Im using exactly what you posted.

!/bin/sh

echo "[default]" >> /etc/nsmb.conf
echo "protocol_vers_map=2" >> /etc/nsmb.conf

exit 0

Like
SOLVED Posted: by Tekniqueman

@thijs
Thanks Thijs,
Your solution was just what worked, now I can relax and my client is happy again. Thank you one more time, it really make my day

Like
SOLVED Posted: by mantos

Thanks guys for working on this. I have had the same issue since December.
@txhaflaire I can't find the nsmb.conf file when going into the /etc folder (hidden files are shown). Do you have any suggestion why that is? Thanks man

Like
SOLVED Posted: by cbrewer

@mantos nsmb.conf doesn't exist until you create it with the script above.

10.13.3 Beta 4 is supposed to fix these SMB3 problems.

Like
SOLVED Posted: by txhaflaire

@Tekniqueman Hmm can you verify the nsmb.conf file is created in /etc/ with its variables in it? screenshot oi.

@mantos No Problems! just remind your self when upgrading to 10.13.3 the fix will applied by Apple and you can remove that specific file on all your clients.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by mantos

@cbrewer & @txhaflaire Thank you, sorry for having to ask again: I pasted the code

!/bin/sh

echo "[default]" >> /etc/nsmb.conf
echo "protocol_vers_map=2" >> /etc/nsmb.conf

exit 0

in the terminal and this is what I get:

Last login: Mon Jan 15 15:47:46 on console
MacBook-Pro2:~ manu$ !/bin/sh
-bash: !/bin/sh: event not found
MacBook-Pro2:~ manu$ MacBook-Pro2:~ manu$ echo "[default]" >> /etc/nsmb.conf
-bash: /etc/nsmb.conf: Permission denied
MacBook-Pro2:~ manu$ echo "protocol_vers_map=2" >> /etc/nsmb.conf
-bash: /etc/nsmb.conf: Permission denied
MacBook-Pro2:~ manu$ MacBook-Pro2:~ manu$ exit 0

No file has been created. Seems like I have no permission even though I have admin rights.

Like
SOLVED Posted: by txhaflaire

@mantos No worries, we will help you out.
Currently you are trying to throw a complete shell script into the terminal.

If you want to do it directly via terminal do the following each line at a time.

sudo -s
echo "[default]" >> /etc/nsmb.conf
echo "protocol_vers_map=2" >> /etc/nsmb.conf
exit

If you want to create a script use a texteditor like TextMate / Textwranger and you can drag and drop it into the terminal.
First a sudo, than throw in in the terminal.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by anth0nys

10.13.3 beta 4 seems to have resolved the issue for me, anyone else? I don't know if I am jumping the gun and just got lucky that Finder didn't freak out.

Like
SOLVED Posted: by mantos

@txhaflaire you are fabulous, thank you! I did it and it created the nsmb.conf file which I then opened with text editor and pasted in it:

!/bin/sh

echo "[default]" >> /etc/nsmb.conf
echo "protocol_vers_map=2" >> /etc/nsmb.conf

exit 0

Like
SOLVED Posted: by mhastsum

@jakobstockman - we had the same issue: the protocol_vers_map=2 workaround was effective for some users but not others. Got exactly the same authentication failure you did, once set. Having removed the affected macs from the domain and readded them (and reset the user's password) the authentication failure went away and he could successfully connect to the share using SMB2.1 (confirmed with smbutil).

Like
SOLVED Posted: by mhastsum

@jakobstockman - We observed the same behaviour: forcing SMB2 on the client side sometimes works but sometimes produces the described authentication issue. (We're on Server 2012r2 for the domain controller and file servers.) We found you can fix the authentication issue by re-binding the affected machine to the domain (from Directory Utility, remember to reboot between unbinding and re-binding).

Like
SOLVED Posted: by ChrisRybin

Has anyone tried deleting the nsmb.conf file in /etc/ ? I've done this and then created a new one with the instructions from this somewhat old Apple support doc where it says 'If your macOS computer doesn’t have an /etc/nsmb.conf file'.

https://support.apple.com/en-us/HT205926

So far this seems to fix issues in my environment, but still to soon to say for sure. Still testing, but thought I would put this up.

Like
SOLVED Posted: by wpeacock

@txhaflaire

Just wanted to say thanks for being so dillegent about posting your findings and workarounds. Saved having to re-image some machines.

I hope that Apple puts out a fix soon that will address the problem, AND will let us know -- more worried about the second part than the first.

Like
SOLVED Posted: by txhaflaire

@all macOS High Sierra 10.13.3 just released, they mentioned the finder issue should be resolved.
If any outcomes, great to hear!

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by rluksiarto

Hi guys,

I've done all the steps above and now I'm having problem even just saving things on my desktop. Anyone can help?

Thanks.

Like
SOLVED Posted: by bentoms

@rluksiarto did you try with 10.13.3?

Like
SOLVED Posted: by ch3valier

10.13.3 According to the release notes from Apple:

Resolves an issue that could cause your Mac to stop responding when connected to an SMB server
Like
SOLVED Posted: by Antti_Heiskanen

10.13.3 solved this problem. Thank you txhaflaire.

Like
SOLVED Posted: by mvincenti

It seems that I'm experiencing the same problem but 10.13.3 did not fix the problem for me. However, I also have about 10 machines that are on Mavericks or prior! Only 2 clients are on 10.13.3 along with the server (also running the latest Server app). This problem definitely started when I upgraded the server to 10.13 in anticipation to accommodate the new machines that I'm installing tomorrow. I also forced everyone to use SMB instead of AFP because I thought AFP was going away. Tomorrow, I'll install the new machines and everyone will be on 10.13.3 and everyone will be using AFP again. After reading this thread, I feel confident that this will fix this issue. But on a side note... if Apple is going to be deprecating AFP, they really should have a smoother road map towards SMB.

Like
SOLVED Posted: by johnsonua

unfortunately on one client 10.13.3 seemed to make things worse, if anything. Now she'll get errors like this attempting to connect to shares...sometimes. This is on a mac bound to AD, with the user logging onto the system with her AD credentials. Sometimes it's thrown while connecting to her network home, sometimes it it happens while connecting to our shared workgroups fileshare. Stangely we have another fileshare on the same server as the workgroups and she CAN connect to it. We're using DFS to connect, but the same error gets through trying to connect to the underlying server share.

Her permissions are correct, and because it's intermittent I'm fairly certain it's her machine.

I've tried removing nsmb.conf and resetting it to what worked in 10.13.2 but no dice. I get the same error on her machine as myself or a test user, and that same test user has no issues logging on to my test machine.

Looking through a packet capture of an attempted connection I keep seeing Kerberos errors like this (from wireshark):

1163 17.300179 10.128.206.125 10.128.211.158 KRB5 173 KRB Error: KRB5KRB_ERR_RESPONSE_TOO_BIG

10.128.211.158 is the end user's machine, the source is one of our domain controllers.

Even tried removing it from our domain and setting her account as local...

looks for all the world like a bug, but I can't reproduce it; this is not a weirdly configured system, either, and it was just recently rebuilt from scratch.

Like
SOLVED Posted: by txhaflaire

@johnsonua Ouch! currently we are having like 80 devices already on 10.13.3 and havent heard this issue yet.. fingers crossed.
Keep us posted!

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by johnsonua

What worked, in this case, was replacing the existing /etc/nsmb.conf with:

[default]
signing_required=no

I'm still not sure why it fixed it, though, which bothers me.

Like
SOLVED Posted: by txhaflaire

@johnsonua keep in mind that

If you turn off packet signing, you lower the security of the SMB connection. Turn off packet signing only if both the client and server are on a secure network.

Cheers,
Thijs - bol.com

Like
SOLVED Posted: by traposama

Hi!!!

I have a similar problem!!! When find a file into DFS (2012R2) search showme files with date from 1969 and dont opened.

Have a tips for that?

Thx

Like
SOLVED Posted: by rakino

Quick question here in the ACL context: which app is the above screenshot from?

I will try and attach it to this post.

Thanks!

Robin

Like

Jamf wants to hear your general feedback around Configuration Profiles!