I have come across dozens of user installations of Windows (XP) where, after logging in, the system stays stuck on this screen for a very long time.

What are the possible causes? How can I diagnose this? What solutions are there? Are there any utilities that can help find and/or fix it?

  • 2
    So far none of 4 answers provided a tool diagnose the problem. Does anyone have any tools to figure out this issue?
    – dance2die
    May 17, 2009 at 20:46
  • Uh, well... If it's a roaming profile thing with a lot of data in the profile any file system inspector will help.
    – squillman
    May 17, 2009 at 21:50
  • Surprised no one mentioned this, have you tried looking into the GPO that are loaded? try gpresult /H report.html. Do a registry scan and remove any issues, check how large the NTUSER.dat file is and if it is roaming users, good luck!
    – Cold T
    Feb 14, 2012 at 13:09

14 Answers 14


A lot of times this is caused by the user having a roaming profile and tons of files saved in their profile somewhere, especially compounded with a slow network connection.

  • We see this most often with slow networks connections as mentioned. If a user logs in at a remote site, across a WAN, with a roaming profile, it can take hours before their profile is loaded.
    – Aaron
    May 18, 2009 at 13:21

Often, this occurs when you have persistent network shares (especially connections that don't exist any longer) or other application configuration that relies on network acess that is either slow or non-existant.

Probably other answers as well.


You could try turning on the Userenv debugging and reading the logs on what is happening behind the scenes. I had an issue with a program that had hooked into the logon event but was timing out during its run. This was causing Windows to wait for the dll to finish up before timing out.

You can find information on turning on the userenv debug logging and how to read it at the Microsoft Directory Services team blog (Understanding how to read a userenv log - Part 1 and Understanding how to read a userenv log - Part 2.

Hope this helps!

EDIT: I found another helpful article on Technet: Interpreting Userenv log files


If you're behind an authenticating proxy, McAfee AV 8.7 will increase boot time by 5-10 minutes. Patch is due in early June.


Check the end user's profile size. Computer properties -> advanced -> User Profiles.

Try to log on with the virus scanner disabled.

Check other software that runs, especially auto-updaters and rollout utilities.

Read the Windows event log.


Xperf utility are the keywords you are looking for. msdn link


If Connected to a domain check that the dns servers are pointing to your server(s) not an external dns. Next Update your NIC Drivers if available. Make sure your PC is virus free, Run TFC.exe by old timer a program to delete all temp files. If this doenst work then i would try as Josh stated try turning on the Userenv debugging and reading the logs.


I use WinDirStat to see what's taking up space in a user profile folder. In the case of roaming profiles on a domain, I usually see this happen when a user has set a large bitmap (.BMP) as their desktop background image, or some application such as a CD/DVD ripper has written an enormous file to their Application Settings or My Documents folder.


To check for large roaming profiles, go to the location where they are stored and do a "properties" on the folder.

If the problem is large roaming profiles some of the following may help :

1) Use GPOs to redirect Home Folder, Application Data, Desk Tops and Start Menus to network locations - this should stop large files being downloaded when logging on (especially the desktop!). Redirect anything you can away from "documents & settings", cookies** and Internet Explorer cache are two big offenders.

2) Use a mandatory profile - this would probably be completely unpopular, but it makes support far easier and stop NTUSER.dat from growing in size.

3) Regularily purge all NTUSER.DAT files - these files can become huge. In fact just delete all the profiles, only a temporary measure but it'll speed up in the short term.

** How long does it take to download 20,000 cookies from a remote location to a local computer?


Unchecking Restore previous folder windows at logon (Folder options -> View) solved this problem on my XP system.


I've seen a case where all workstations used Symantec Endpoint Protection and its Network Thread Protection module was preventing access to newly updated files after Patch Tuesday. These files that were being restricted were required to complete the log on. Simply enough, yanking the ethernet cable, then logging in, plugging the cable back in and then telling SEP that the updated files were okay to run did the trick.

May not be your exact same problem, but may spark an idea or two when you're troubleshooting.


Is the user in question connected to a domain (or not anymore?)

Does disabling the network connection (eg. pulling the cord) improve times?

As said in other answers, check the event log, double check your DNS is set up correctly (if connected to a domain), use Wireshark to see what network traffic is happening, etc.

Roaming Profiles can take an obscenely long time depending on their size - I've had one user's profile take 3 hours to log in (~1GB in size due to Thunderbird). After moving her Thunderbird folder to an automounted share it now takes ~25 seconds to load her profile.


I've experienced this myself on both Windows 2000 and Windows XP. In both cases, the Microsoft User Profile Hive Cleanup Service resolved the problem.

Download from http://www.microsoft.com/download/en/details.aspx?id=6676


In a large majority of cases, the root cause is a few highly fragmented files in your hard drive. When a file is stored in many pieces, at boot time , the system takes time to find and and arrange them , so that they can be made ready for use. Here are steps to rectify the situation: Some degree of comfort level with using tools on a computer is required,- so seek help from the local geek for following instructions given below, if you wish.

  1. You need to have 'administrator' privelege or log in as administrator to do below steps. Also, it is desirable that at least 25-30% of your hard drive is free space.

  2. Defragment your hard drive. Control panel => all programs => accessories => system/ system tools => disk defragmenter. Please ensure that there are no other programs running when this is in progress (can be 15 min to 2 hours), not even email. If your system is windows XP or earlier, at the end of the defrag session, do a 'view report' and then save the report in a folder of your choice. Go to the saved file and observe, at the last section of the file, the names and locations of files that have many fragments. These are the culprits. Do NOT delete these fragmented files even if you think you don't need them. If you did not create those files, they are likely to be very important files that the system uses, unseen to you. The right thing to do is to make them less fragmented, - so proceed to step 2.

  3. Step 1 will not solve the problem, it just prepares the ground. You will need to download a program by the name "contig" from microsoft-approved site. It is free. Go to social.technet.microsoft.com and give search for 'contig'. OR, you can directly use technet.microsoft.com/en-us/sysinternals/bb897428.aspx, if the link is functioning. If you desire to know why and how contig works, read the information given in the same page. Download the zip file and unzip it in a folder of your choice. Do not download from sites not approved by microsoft, you may download something undesirable. The procedure you are doing is equivalent of a surgical procedure, so use only certified doctors' tools!

  4. Bring up the command prompt, or the black DOS prompt shell screen. Start => all programs => accessories => command prompt {if not logged in as administrator, but having admin priveleges, right click on command prompt and choose 'run as administrator'}.

  5. From windows explorer, drag the contig file from the folder you kept it, on to the command prompt and press enter. It takes a bit of practice so that the DOS prompt window does not run away, such that you can place the link of the contig file on the prompt. You will see the usage modes of the contig program displayed on the screen. Do not dismiss the command prompt shell now, just 'minimize' it.

  6. Now, in explorer, go to the folder where the culprit files are kept. You will get the location from the file you saved in step 1. 5A. Bring up the command prompt shell, and by using the 'up' arrow, get the previous command. Type -v beside that, with space on either side. 5B. From explorer drag the first of the culprit files on to the command prompt shell, such that it appears as "c:..." etc beside the -v (and space). now press enter. If you have done the dragging and dropping right, you will see contig is doing something. Please wait till the process finishes, do not use the computer for any other task in the mean time. This may take a few minutes- please be patient. [Advanced user may use contig -q for quiet mode].

  7. You will know that the task is complete when the dos prompt returns. Repeat above procedure for all the culprit files.

  8. This should solve the problem in a large majority of the case.

  9. If the culprit list of step 1 says somewhere that pagefile has more than 5 fragments, an addtional procedure is necessary. Pagefile is something that is always in use by the system, so a different method is required. Download page defrag tool from social.technet.microsoft.com/Search/en-US?query=page%20defrag&ac=1. See information given in the page.

  10. Unzip the pagedefrag zip file in a folder of your choice. Double click the exe to run it. When a screen comes with 3 radio button options, select to page defrag at next boot. Log off and shut down the machine and then restart. This time you will see a blue screen informing you page defrag is working. Be patient and let the process complete.

  11. Once above completes and you can log in, go and run de-fragment again , as in step 1.

  12. Thereafter, shut down and restart and enjoy your now faster machine.

  13. If you are using windows vista you will not have access to the nice defragment report of step 1 that helped you identify the culprits in the first place. In such a case , you will have to physically find the files that are fragmented, and it is not easy. What I do is, I give a search for all files greater than 500 mb and contig them one by one. Or they can be placed in a folder and you can ask contig to defragment them all at one go. Do this only for user-owned files though. For files under c:\windows and other system / application software files, do not shift files. Just ask contig to recursively defragment files it finds in the folder in-situ.

  14. Following files are the usual culprits in terms of getting fragmented : Video files, image files, large zip files, lotus notes .nsf files etc.

  15. I take no liability if any loss is incurred in doing above steps. I am sharing what worked for me.

  • no, no no. Fragmented file is hardly ever a problem. Ever. Ever.
    – Rob
    Feb 16, 2015 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .