I found something new. On 2 DCs I disabled SMB2. Now no open kix32.exe where found. Can this a problem with sm2 function durable_handle? But I didn't find a Reg-Key to disable only this function.