Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We're having some issues with Windows 7 Roaming profiles and I was reading here that the login process can be monitored using process monitor.

"There are a couple of ways to configure Process Monitor to record logon operations: one is to use Sysinternals PsExec to launch it in the session 0 so that it survives the logoff and subsequent logon and another is to use the boot logging feature to capture activity from early in the boot, including the logon."

How does one do either of these options using process monitor to find out what is happening during a user login?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

"There are a couple of ways to configure Process Monitor to record logon operations: one is to use Sysinternals PsExec to launch it in the session 0 so that it survives the logoff and subsequent logon and another is to use the boot logging feature to capture activity from early in the boot, including the logon."

I don't believe that either of the above are valid for Windows 7 for the following reasons:

  1. There's no session 0 in Windows 7, as far as I know.

  2. User environment debug logging (which is what it sounds like they're recommending) has been replaced/supplanted with the Group Policy event log.

So, my suggestion would be to start by looking at the Group Policy event log on one of the problem machines.

share|improve this answer
    
Is that in Event Viewer? –  leeand00 Sep 28 '12 at 15:39
1  
Yes. You should be able to find it at: Event Viewer>Applications and Services Logs>Microsoft>Windows>GroupPolicy>Operational –  joeqwerty Sep 28 '12 at 15:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.