Antivirus software may cause Event ID 2011

After you install Norton AntiVirus for Windows or IBM AntiVirus 3.01N (Build 301.590), you receive the following error messages: Clients cannot access network shares. Additionally, Event Viewer on the Windows server may log one or more of the following event messages in the system log:

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: To resolve this behavior, increase the IRPStackSize value in the registry:

1. Click Start, and then click Run.
2. Type regedit, and then click OK.
3. Navigate to the following key:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
4. In the right pane, double-click the IRPStackSize value.
   
   NOTE: If the IRPStackSize value does not already exist, use the following procedure to create it:
   1. In the Parameters folder of the registry, right-click the right pane.
   2. Point to New, and then click DWord Value.
   3. Type IRPStackSize.
      
      IMPORTANT: Type "IRPStackSize" exactly as it is displayed because the value name is case-sensitive.
5. Change the Base to decimal.
6. In the Value Data box, type a value that is larger than the value that is listed.
   
   If you created the IRPStackSize value using the procedure described in step 4, the default value is 15. It is recommended that you increase the value by 3. Therefore, if the previous value was 11, type 14, and then click OK.
7. Close the Registry Editor.
8. Restart the computer.

If the problem persists after you complete the preceding procedure, try to increase the value of IRPStackSize even more. The maximum value for Windows 2000 is 50 (0x32 hex).

If you are running Windows NT 4.0, and the problem persists after you complete the preceding procedure, you may have to apply Windows NT Service Pack 4 or Service Pack 5.

In Windows NT 4.0, the default value of IRPStackSize is 0x4, and the range is from 0x4 to 0xC (4-12). Windows NT 4.0 with Service Pack 5 or later ignores values less than 0x7.

In Windows 2000, the default value of IRPStackSize is 15, and the range is from 11 to 50. In Windows XP, the default value for IRPStackSize is 15, and the range is from 11 to 50.

NOTE: The default and range of Microsoft Windows Server 2003 is the same as that for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base: NOTE: The preceding article recommends that you increase the IrpStackSize value; however, if you increase this value to its maximum (for example, if you increase this value to the maximum value of 12 on a computer that is running Windows NT 4.0, or to the maximum of 50 on a computer running Windows 2000), this behavior may still occur.

For more information, click the following article number about IRPStackSize to view the article about IRPStackSize in the Microsoft Knowledge Base: For more information, visit the following Symantec Web site:NOTE: The locations of these documents are subject to change without notice. Symantec provides these links as a convenience only. The inclusion of such links does not imply that Symantec endorses, recommends, or accepts any responsibility for the content of such sites.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.