how are the shared directories being accessed? UNC path? Try opening one of the files via UNC and via Word. Maybe something like word autosave is screwing something up.
We’ve tested access to the folders via DFS and via direct UNC- both ways produce the problematic results.
did you look at the security logs on the dc? There should be some events logged there, something like success audit for user name for service file server name. Post up anything you find.
edit: scratch that, that would only let you know if the user failed to log onto the share.
Just got escalated again with MS.
MS wants me to take the server down and boot it into safe mode w/networking and conduct testing then. They believe that the duplicate entries are caused by an aftermarket service (but they can’t fucking elaborate as to which one(s), which tells me that they are shooting in the dark).
Which means I’ll be coming in the middle of the night to do this shit. argh