I have setup users to log in through active directory setup on windows server 2008. When they try to login in to their machines it takes two minutes just to log on. What could be the problem?

The machine only runs active directory no other network services.

3 Answers 3


Usually "slow logon" problems are DNS resolution problems at the client's side. Check if the clients are using AD DNS servers (AD DNS servers only, not your provider's DNS servers, not your router's DNS service - really just the ones of your AD).

Also check if the name registrations for your DC(s) are correct - use the dcdiag test utility for this. dcdiag is already preinstalled on all Windows Server 2008 DCs.

From the Microsoft documentation about dcdiag:

The following steps summarize how to interpret the results provided by DNS-enhanced dcdiag:

  1. Run dcdiag test:DNS /e /f:dns.txt. Microsoft recommends always using the /v switch to obtain verbose information.

  2. Open the report in Notepad or a compatible editor.

  3. Scroll to end of the report and read the summary table.

  4. Identify servers that returned "warn" or "fail" status for any subtest in the summary table.

  5. Review the section of output for that server to see what problem was detected (hint: use the Find command on the Edit menu to search on the string "DC: DC_computername" (without quotes) to locate the detailed section for a given DC.

  6. Resolve problems on DNS clients or DNS server(s) as required.

  7. Run dcdiag /test:DNS /v /e (or /s:DCName) again to verify the fix. Repeat steps 1 through 6 as required until all failures are understood and reconciled.

  • 2
    +1 slow logon 99% of times is because computers use ISP DNS servers and not AD DNS servers. Sometimes users tend to set 1 AD+DNS and add another 1 ISP DNS just in case which is bad practice.
    – MadBoy
    Commented Jul 8, 2011 at 7:35

You can get an extremely detailed log of every single event involved in a user login by enabling user environment logging.

Userenv log files contains information about the following:

  • Group Policy settings that are not processed or not applied as expected
  • Folder redirection that does not occur
  • Profile or registry hive load, unload, or deletion failures
  • Logon script, or script not applied as expected
  • Default behaviors occurring because a slow link was detected
  • Roaming profile issues
  • Slow logon issues
  • Whether a given GPO is accessible, and if not, why access was denied.
  • The name of the domain controller that is accessing SYSVOL.

The link above details how to interpret the logs; this is how to enable it for pre-Windows Vista/Server 2008 and post.


There's also the possibility of the profile sizes to consider as well. If the users are storing large amounts of data within their profiles, it can impact logon performance too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .