Any difference between C:\Shared\foo.exe and \\localhost\foo.exe?

[stevenkan]

Troubleshooting related to my other problem, but genericized as a general question.

Suppose I have:

C:\iERP90\iERP90_TEST\Server\

on a Server 2022 box named \\iERP90

shared as:

\\iERP90\iERP90_TEST\

where that directory contains ClientSetup.EXE

Is there any difference between running on the iERP90 box itself:

C:\iERP90\iERP90_TEST\Server\ClientSetup.EXE

and running on the same box itself:

\\iERP90\iERP90_TEST\ClientSetup.EXE

In the latter case does Windows say, "Oh, that's my own share, I'll treat it like a local file."

Or does Windows run it through whatever permissions and policies it has for a network share, despite it's actually local?

When I run it from the network share, it definitely launches slower than when I launch it locally, but when it's actually running I don't see any network traffic, other than typical "heartbeat" traffic:

This is via the Hyper-V Manager, not RDP, so there's no RDP traffic in there.

Thanks!

edit: fixed C:\ C

 

[Andrewcw]

It should run through permissions if it is accessing itself like a share.
So it follows whatever user or system permissions the program is running is running at accessing that share.

But I'm lost at the VM network traffic. The share is on the VM's "Local" drive so inside the VM there would be no network connection to access it's own share. It just follows the permission.

 

[stevenkan]

It should run through permissions if it is accessing itself like a share.
So it follows whatever user or system permissions the program is running is running at accessing that share.

But I'm lost at the VM network traffic. The share is on the VM's "Local" drive so inside the VM there would be no network connection to access it's own share. It just follows the permission.

The scale on the network graph is 100 Kbps. That's just background/heartbeat traffic. It didn't go up or down when the installer attempted to run. I had it displayed so I could check for new network traffic, and there was none.

 

[andrewme]

The scale on the network graph is 100 Kbps. That's just background/heartbeat traffic. It didn't go up or down when the installer attempted to run. I had it displayed so I could check for new network traffic, and there was none.

The point is, the graph cannot help answer your question. You're looking at a network adapter that connects to the outside world. If accessing an SMB/CIFS share on the current machine does go through the file-serving stack (and I'm pretty sure it does), you would not see network traffic going out to your local LAN, turning around, and coming back in. It's going to stay within the kernel / on Windows' equivalent of the "loopback" adapter (there might even be an optimization in the file-serving stack so it doesn't generate any TCP/IP socket traffic at all).

The graph would not look any different if Windows did treat the access as purely local and bypass the share permissions.

 

[PsychoStreak]

Is Windows Defender running? Check out the activity on it when you're trying to launch from the network share.
If it's your own code, you should be able to add an exclusion for it so Defender will not frisk it every time you launch it.