Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Several users are reporting to the helpdesk that logins hang at the following stage:

enter image description here

What is happening at this point? I have searched extensively but can't find what this refers to. I have also run several GPResults and can't find anything relevant. The workstations are all Windows 7 x86, our DCs are Windows Server 2008R2.

share|improve this question
2  
You're not kidding. +1 for finding the least Google-able GP error I've ever seen. Anything in either the client or DC Event Logs? And, come to think of it, you don't have a GPO named "Environment policy," do you? –  HopelessN00b Aug 9 '12 at 1:23
    
No - but it doesn't refer to a specific GPO. The GP client does an RSOP on all GPOs and applies the result. E.g. you also get "Applying Group Policy Drive Maps policy..." etc. Also no nothing useful in the logs, looking into increasing the logging level. –  Matt Aug 9 '12 at 2:02
    
Yeah, I figured as much, but it never hurts to ask. That being the case, I guess it would be setting user or machine environment variables? You have any GPOs that do that? –  HopelessN00b Aug 9 '12 at 2:11
    
Yes, and in fact we had a conflict (2 GPOs applying the same environment variable) but we have since resolved that and the issue still occurs. There is one environment variable set by Group Policy and it is now only set by one GPO. Also it's a computer setting, and this issue occurs at login. –  Matt Aug 9 '12 at 2:33
    
Do you have Symantec Endoint protection installed? We are experiencing the very same issue after SEP 12.1. RU1 was installed. –  user132343 Aug 16 '12 at 7:19
show 1 more comment

1 Answer 1

I don't think anyone is going to be able to answer this without more information.

A few tools that will help you figure this out:

Sysinternals Process Monitor -> Options -> Enable Boot Logging

Reboot. Now you can evaluate that resulting ProcMon file, looking at the timestamps and looking for where the huge pause was. What was the system doing when that long wait started?

You can use Xperf to do a detailed boot trace as well:

http://blogs.technet.com/b/askpfeplat/archive/2012/06/25/becoming-an-xperf-xpert-the-slow-boot-case-of-the-nettcpportsharing-and-nla-services.aspx

You can also enable verbose logging of Group Policy Processing:

http://blogs.technet.com/b/askds/archive/2008/07/18/enabling-group-policy-preferences-debug-logging-using-the-rsat.aspx

Using these tools is probably the only way to begin to figure out what is causing this slow boot time.

Edit: Here is a fourth verbose logging method for you to look at:

http://technet.microsoft.com/en-us/library/cc775423(v=ws.10).aspx

share|improve this answer
1  
+1 for suggesting logging, we've actually already done that (see my comments above). We're now suffering from the observer effect - all users we have enabled logging for are saying the issue is resolved! –  Matt Aug 15 '12 at 2:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.