The case of the mysterious Alternate Data Stream query


A customer was running Windows Server 2003 ("Still in support until 2015!") and they have some custom application that monitors all disk accesses. They noticed that there were a lot of failed Alternate Data Stream queries coming from Explorer, and that was causing the custom application's logs to fill with largely useless information.

These Alternate Data Stream queries are being made in order to extract file metadata for the pop-up infotip. (Windows later abandoned the use of Alternate Data Streams for file metadata since Alternate Data Streams were so fragile and were easily damaged or lost.)

The customer found that if they unchecked Show pop-up description for folder and desktop items, this solved the problem on some of their machines, but not all of them. They asked the Explorer team what else needs to be done to stop the ADS queries.

The piece they were missing was the status bar. If the status bar is enabled, then it shows the same information that would have appeared in the infotip.

Turning off the status bar fixed their problem.

Comments (12)
  1. Joshua says:

    According to our benchmarks, W2k3 outperforms all others right up to the point where hardware support for newer hardware is missing.

  2. Azarien says:

    Still I think that filtering the logs is a better solution than fragile UI tweaks that limit OS usability. PS. Win2k3 forever!

  3. AC says:

    First thing I always do starting explorer on a new machine is ENABLE the status bar. Same thing with browsers, if they even still have status bar.

  4. Fleet Command says:

    God, I miss those blog posts that started with "The case of …" made by a certain person. (I am to name no names, right?)

    @Azarien: Not really, no. Windows Server 2003 most of the times runs unattended.

  5. Raphael says:

    If the server runs unattended, who's opening the explorer windows?

  6. Fleet Command says:

    "…most of the times".

  7. xpclient says:

    I see a new change in Windows 8.1 – that the icon of a custom library is stored in an Alternate Data Stream and not in the XML file of the Library when the icon is changed using Windows dialog. But if the XML is manually edited, the icon in the XML takes priority. Any reason why it is stored in an Alternate Data Stream?

  8. Anon says:

    @Fleet Command

    If you're talking about Russinovich's "Case of the Unexplained" series, I believe he only posts them when he gets a good submission. They're (almost) entirely submitter-driven.

  9. Evan says:

    "…since Alternate Data Streams were so fragile and were easily damaged or lost."

    It makes me really sad that's the case. I really wish that you could use xattrs and ADSs as reliably as the main data streams.

  10. Azarien says:

    @Fleet Command: no one expects that such a pure UI setting would affect the business process. Imagine a new admin, logging to the server – and the first thing he does is to enable Explorer's status bar. "what did you do!?" "um… nothing?"

  11. Fleet Command says:

    @Anon: Close, but no cigar. (And you named him, not me.) I meant "The Case of …" posts which were awesome… until a certain event in his life (in our lives) came to pass. I am not saying they are cause and effect; just a time ref.

  12. Aaron Margosis says:

    @Fleet Command – I don't know what you're referring to.  Mark continues to deliver new "Case of the Unexplained" cases at every TechEd which you can see on Channel9, and we'll have a bunch of new cases in the next edition of the Sysinternals book ( blogs.msdn.com/…/redefining-what-quot-never-doing-that-again-quot-means-troubleshooting-with-the-windows-sysinternals-tools-second-edition.aspx ).

Comments are closed.