Case of the 30 minute Windows 7 Logon

After following a similar approach as below:

I still hadn’t found any obvious cause of slow logon, except that it was in Win Logon Init phase.


CPU, Storage, Memory, and Disk usage are all low:


Expanding Generic Events, looking at Microsoft-Windows-GroupPolicy section we could see delays of 2,000 seconds apart. Another big clue was servers started with SYD prefix for SYDNEY, but these clients were located in Melbourne.


The Microsoft-Windows-GroupPolicy/Operational event log showed frequent delays, and repeatedly contacting the wrong domain controllers, and we also saw many delays in here. There is a ton of useful diagnostic info in this log, so in Domain Environments you should be well acquainted with it Smile

Using a quick PowerShell script we can check domain controllers, this machine has connected to, and sort from most popular to least popular.

$xpath=@' <QueryList> <Query Id="0" Path="Microsoft-Windows-GroupPolicy/Operational"> <Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System[(EventID=5310)]]</Select> </Query> </QueryList> '@ $DCs=@{} $events=Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" -FilterXPath $xpath ForEach ($event in $events) { $DCs[$event.Properties[2].Value]++ } $DCs.GetEnumerator() | Sort-Object Value -Descending

Here we saw frequency of going to domain controller in another site. On top of this DFS was in use, and was resulting in unnecessary WAN traffic due to wrong Active Directory site detection.


The root cause was the Melbourne site had new subnets added to it, but the Active Directory Sites & Services had not been updated, so the machines were frequently in the wrong site. Once this was corrected Windows logon times improved to more normal levels.

Well normal for the amount of crap they were required to have running at logon to meet business requirements.

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Active Directory, Group Policy, Windows 7, Windows Performance Recorder, Windows Performance Toolkit and tagged , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s