7

I've been trying to diagnose slow logins to my domain. One of my first stops was Domain login very slow 10+ minutes.

So far I've been able to tell it has to do with my policy that applies folder redirection and administratively assigns offline files. Enabling this policy reliably adds from 30 - 90 seconds to the login.

This happens even on profiles that only have 20 megabytes in the redirected folders.

I went through a number of articles including suggestions of using procmon to see if a hangup is occurring. I did find and fix a few second hangup on an old scheduled task, but nothing near explaining this long of a lag.

I also looked at a couple of the active installer suggestions - such as the mail app.

What else can / should I check out before I break out Wireshark?

Edit for the questions:

  1. This is occurring every log on. Software settings / etc persist as they should. There are no temporary, mandatory, etc profiles in the mix.
  2. I see activity via procmon, but nothing that indicates a gap. No gaps event times, no processes with extended duration.
  3. I previously turned up the verbosity on the file redirection logs. Based on the folder redirection operational logs it takes under 1 second for the policy to process (event 1000 to event 1001)
  4. The group policy operational log shows a couple of my more complex policies clocking in at about 1 second each.
  • 3
    Folder Redirection is adding 30 - 90 seconds to every logon, or just the initial logon where the policy applies for the first time? You're not trashing the user's profile or using a mandatory profile, are you? The Folder Redirection client-side extension (CSE) annotates the policy information in the user's registry and, after the first time it runs, as long as there isn't a change to the GPO it should process much faster. If the user's registry isn't persistent, though, it will be slow to process every time. – Evan Anderson Jun 26 '14 at 19:07
  • @Tim You should be able to see what's going on with Procmon. Are you saying you actually can't see the delay itself in ProcMon? – EliadTech Jun 26 '14 at 19:09
  • A check of the Folder Redirection and Group Policy event logs on one of the affected clients might yield some clues. – joeqwerty Jun 26 '14 at 19:38
  • I suggest opening procmon and configuring it to run while booting, and rebooting and logging in, this way you can catch everything, and it might give you something you missed. There should be activity between the time you enter your creds and the time the desktop appears. – MDMoore313 Jun 26 '14 at 20:10
  • 1
    @BigHomie - this happens even on workstations that have only had a single active user (such as my test VMs). Also happens on new systems. – Tim Brigham Jun 26 '14 at 20:21
3

I tracked down the culprit. The same group policy that applied the folder redirection / offline files also took care of drive mappings.

We had set up a mapped drive that only was supposed to map to certain people, and then only from specific workstations. The server in question started using IPsec a while ago. Instead of the mapping failing silently it was taking 30 seconds to time out each time someone tried to map it, longer if the user had recently tried accessing a resource on that server.

Adding a improved conditional logic to my gpp targeting fixed it - 3 seconds to log in instead of 90.

Hopefully this will help someone else in the same boat.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.