perfmon says that 'Kernel Current URIs Cached = 2 (average) and that 'Output Cache Current Items' = 3000-4000 (average) I think that this means that almost all of the objects are in the User Mode ...
I think I recall seeing somewhere that file and print sharing in NT is handled in kernel mode, not user. If not, thanks and you can probably stop reading here. <P>If yes (and I'm assuming yes since ...