samba - May 2014 - Samba 4.1.7 seems slow when calculating access rights

Hello everyone,

I am not sure if I phrased the subject properly, but that's basically how I
understand what's happening.

What I have is a CentOS 6.5 box with the Sernet samba-4.1 repository and Samba
4.1.7 AD DC installed and up and running. I have a couple of Windows XP clients
connected to the active directory.

We used to have the original CentOS-packaged Samba3 on this particular server,
but because we would like to migrate our Windows XPs to something newer and
going for AD before doing the client upgrade seemed like a good idea :), we went
for that. So, this weekend I've completely reinstalled Samba (uninstalling
Samba 3, installing Samba 4.17 and manually recreating all our users and groups
in the new AD). Currently everything seems to work fine - my users are able to
log in, get their roaming profile and use all the resources they used to use
before, BUT...

Our IS (information system) which is hosted on one of the Samba 4.1.7 shares,
seems to be now running terribly slow. For example, the startup time with our
old Samba 3 used to be up to 10 seconds. Now, with Samba 4.1.7 it takes up over
1 minute (and my users hate me for that). I've been doing some debugging and
unfortunately I did not find any error message anywhere. What I gathered so far
was that the IS is during the startup fetching a lot of smaller files (icons I
think) and when it's starting up, the associated smbd process eats a lot of
CPU during that time. By looking at network utilization and disk utilization,
they are hardly doing anything during the startup, so it seems like smbd is
slowing things down just by calculating stuff, but why and what? :)

When I (out of desperation) set the force user = root on the particular share on
which the IS resides and restarted Samba, voila - the smbd processes now eat way
less CPU and the startup time for the IS is not back at about 5 secs.
Interestingly enough, our old Samba 3 on the same server, used nt acls and posix
acls (which I think I have kind of overridden when I forced all users to act as
root) and all that too, so even though those features seem like something to
blame, they were present before and they were not causing any havoc at all.

I understand that anyone willing to help me will require a lot of information
from me, please don't hesitate to ask for anything. Even though I don't
like it, I can keep the force user = root parameter on the share for a while,
but I want to get rid of that as soon as possible, on the same hand. So I will
try to provide as much detail as you guys want.

Thank you all and have a nice day,
Petr MOTEJLEK