SMB NT Notify returning too soon
When many Windows clients have an "explorer" window open on some directory,
where they all have an SMB NT Notify operation pending to watch for changes on
that directory, the server will sometimes get into a mode where these notify
operations all return almost immediately. This causes the clients to essentially
"spam" the server with directory listing requests.
Typically the first observation that "something is wrong" is that server load is higher than expected, or that directory listings are taking longer than expected. A network capture taken during such an episode will show floods of FindFirst/FindNext calls, interspersed with occasional NT Notify calls, where the NT Notify calls return almost immediately.