Question : Why are Win 7 clients dropping connections, event 4634, laggy network, freezing clients

I have a customer who is having random network sharing issues.  They will open a file on the network (2008 std) and it will sit about a minute or so before opening the file. All Win7, all fresh installs.  Sometimes it's instant, sometimes they have to wait.  Its every user.  It seems to correlate with the security events  (destroyed sessions  type-3) so I have included that log to let you have a look.
Im wondering if it's a switch issue, because I haven't seen anything else that I know of that would cause this.  Any help would be appreciated.

Last night I swapped switches and it worked perfect for over an hour.  They came in today and had 2 users have the issue about 5 AM.  Around 2 they had another user have the issue, but this time it froze excel, and then again at 5 a user had a word document open from the server and  " Opened with an error message “  cannot be accessed. The file may be corrupted, located on a server that is not responding, or read only.”  And offered me a Retry button or Cancel button.  I hit retry, even though it was already open, and it kept popping up the same error message.  I hit cancel and the error message disappeared and the file stayed open." -User

It is dropping sessions for some reason that I cant figure out.  I have included a snippet of the 400,000 entries from the security log in a 24hr period.  ANY help would be appreciated!

----------------------------
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4634      Logoff      "An account was logged off.

Subject:
      Security ID:            TWIN\wsiegel
      Account Name:            wsiegel
      Account Domain:            TWIN
      Logon ID:            0x579dd45

Logon Type:                  3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4624      Logon      "An account was successfully logged on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

New Logon:
      Security ID:            TWIN\wsiegel
      Account Name:            wsiegel
      Account Domain:            TWIN
      Logon ID:            0x579dd52
      Logon GUID:            {81A0200B-EB47-B5C4-1609-522D8F9720C0}

Process Information:
      Process ID:            0x0
      Process Name:            -

Network Information:
      Workstation Name:      
      Source Network Address:      192.168.5.112
      Source Port:            49201

Detailed Authentication Information:
      Logon Process:            Kerberos
      Authentication Package:      Kerberos
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4624      Logon      "An account was successfully logged on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

New Logon:
      Security ID:            TWIN\wsiegel
      Account Name:            wsiegel
      Account Domain:            TWIN
      Logon ID:            0x579dd45
      Logon GUID:            {81A0200B-EB47-B5C4-1609-522D8F9720C0}

Process Information:
      Process ID:            0x0
      Process Name:            -

Network Information:
      Workstation Name:      
      Source Network Address:      192.168.5.112
      Source Port:            49200

Detailed Authentication Information:
      Logon Process:            Kerberos
      Authentication Package:      Kerberos
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4624      Logon      "An account was successfully logged on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

New Logon:
      Security ID:            TWIN\wsiegel
      Account Name:            wsiegel
      Account Domain:            TWIN
      Logon ID:            0x579dd35
      Logon GUID:            {81A0200B-EB47-B5C4-1609-522D8F9720C0}

Process Information:
      Process ID:            0x0
      Process Name:            -

Network Information:
      Workstation Name:      
      Source Network Address:      192.168.5.112
      Source Port:            49198

Detailed Authentication Information:
      Logon Process:            Kerberos
      Authentication Package:      Kerberos
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4769      Kerberos Service Ticket Operations      "A Kerberos service ticket was requested.

Account Information:
      Account Name:            [email protected]
      Account Domain:            TWIN.LOCAL
      Logon GUID:            {19157A5E-998A-7ABB-7076-240723D8ECDF}

Service Information:
      Service Name:            TWINDC$
      Service ID:            TWIN\TWINDC$

Network Information:
      Client Address:            ::ffff:192.168.5.112
      Client Port:            49199

Additional Information:
      Ticket Options:            0x40810000
      Ticket Encryption Type:      0x12
      Failure Code:            0x0
      Transited Services:      -

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4624      Logon      "An account was successfully logged on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

New Logon:
      Security ID:            TWIN\wsiegel
      Account Name:            wsiegel
      Account Domain:            TWIN
      Logon ID:            0x579dce3
      Logon GUID:            {2E0C65FC-A9D2-F398-4586-7EF942DBDC9F}

Process Information:
      Process ID:            0x0
      Process Name:            -

Network Information:
      Workstation Name:      
      Source Network Address:      192.168.5.112
      Source Port:            49172

Detailed Authentication Information:
      Logon Process:            Kerberos
      Authentication Package:      Kerberos
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4769      Kerberos Service Ticket Operations      "A Kerberos service ticket was requested.

Account Information:
      Account Name:            [email protected]
      Account Domain:            TWIN.LOCAL
      Logon GUID:            {19157A5E-998A-7ABB-7076-240723D8ECDF}

Service Information:
      Service Name:            TWINDC$
      Service ID:            TWIN\TWINDC$

Network Information:
      Client Address:            ::ffff:192.168.5.112
      Client Port:            49197

Additional Information:
      Ticket Options:            0x40800000
      Ticket Encryption Type:      0x12
      Failure Code:            0x0
      Transited Services:      -

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4634      Logoff      "An account was logged off.

Subject:
      Security ID:            SYSTEM
      Account Name:            TWINDC$
      Account Domain:            TWIN
      Logon ID:            0x579dcc3

Logon Type:                  3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4624      Logon      "An account was successfully logged on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

New Logon:
      Security ID:            SYSTEM
      Account Name:            TWINDC$
      Account Domain:            TWIN
      Logon ID:            0x579dcc3
      Logon GUID:            {C987ED0B-EECD-EEB8-7DB2-4AEB7E0F3D17}

Process Information:
      Process ID:            0x0
      Process Name:            -

Network Information:
      Workstation Name:      
      Source Network Address:      fe80::8de5:e439:1ad4:b665
      Source Port:            61872

Detailed Authentication Information:
      Logon Process:            Kerberos
      Authentication Package:      Kerberos
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success      5/10/2010 4:44:57 PM      Microsoft-Windows-Security-Auditing      4672      Special Logon      "Special privileges assigned to new logon.

Subject:
      Security ID:            SYSTEM
      Account Name:            TWINDC$
      Account Domain:            TWIN
      Logon ID:            0x579dcc3

Privileges:            SeSecurityPrivilege
                  SeBackupPrivilege
                  SeRestorePrivilege
                  SeTakeOwnershipPrivilege
                  SeDebugPrivilege
                  SeSystemEnvironmentPrivilege
                  SeLoadDriverPrivilege
                  SeImpersonatePrivilege
                  SeEnableDelegationPrivilege"

Answer : Why are Win 7 clients dropping connections, event 4634, laggy network, freezing clients

I think I've found the cause - I disabled TCP offloading and RSS on the NIC - we will do some testing and I'll post the results.