Same here. Everything is gone.
Same here. Everything is gone.
So this tale is getting better. The LEA have been looking at some stuff and so far we have managed to get the logon time down for a cached profile to around 35-40 seconds depending on the machine. At the LEA centre the logon is around 15 seconds which they say is right as they map drives across domains.
Now this is our issue - the LEA have discovered an issue with mapping drives across domains. The LEA SIMS server is on a different network to the LEA Curriculum Domain. For some reason the drive mapping they have in place with a script is taking 15 seconds to connect. Thus adding this time to the logon - increasing it to the 30 or so seconds.
This weekend the LEA restarted their domain servers in the early hours of the morning as they had identified a couple of authentication issues during Friday. So hopefully this may solve something or other.
SO it's getting better. Myself and Richard (techie) are working on consolidating GPOs and cutting down the amount of individual/little GPOs we have on the network.
We have loads of GPO's and some did cause problems with slowing logon times.
The things we did that helped
1) Disable User/Computer configuration - If a GPO only has user settings then disable to computer settings(and vice versa), this is especially important for GPO's linked high up the tree.
2) Reduce Security filtering, ensure that GPO's are applied to the best OU's and don't use security filtering where possible. This can depend strongly on your OU structure
3) Don't duplicate settings between GP's that all apply to the same set of Objects, there is no need to set Hide the control panel 4 times in user policies
4) Remove ADM templates that aren't in use from each GPO, this took a while, but really made a difference, the ADM's get included in the GPO which increases the size and therefore the download time. we reduced our average GP folder from 2mb to under 500k. By default there are a bout 4 ADM's in each policy. if it is a software installation policy it doesn't need any of them.
5) WMI filtering really affects the processing speed of GPO, don't use it unless you really have to. Security filtering is OK and OU Targeting is best.
Hope this helps you out.
For testing purposes disable them and check how long it takes...
* The DNS errors can be skipped and should not be a problem. Normally they are generated by secondary programs that are not related to the login procedure (can't see for sure cause the excel sheet does not contain process id's)
* between 3016-3020 probably caused by enabling GPO logging
3385 - 3400 same as the DNS errors
The IE branding policy can really slow things down, there was a bug that MS fixed, broke and kinda fixed again that can add 20 seconds to your logon times :-O
Put verbose mode on to watch the policies applying then the logging methods above would be a good place to start.
We currently split the policies out for Users and Computers but when I rebuild the teaching machine GPOs in summer I'm going to split them out slightly for ease of management e.g.
Microsoft Office Policy
I agree what Bio says, when I looked at the file I saw the same.
@gareth - Can you enable logging for me as per KB and send/post me the logs. Do this on a problem machine.
Fixing Group Policy problems by using log files: Group Policy
Just looking at file Gareth what version of client was on that machine out of interest I think I remember conversation with dev team and they have changed few of start up things will have a word them tomorrow as if we can give you a even faster start up then heck see what can do... (even I wouldn't say impero is adding that much time to your login script). Would like to know why got two imperoclients running through will run tool over my test network to double check not normal behaviour through..
There is only one client on each workstation although it could be remnants of a broken 3036 many moons ago. We are waiting for the 310x version to arrive - thought it would have been there by now. We did log a call with you guys today - you may have seen it on your forums
Did see your call come through see Mike is dealing with it let me know if anything I can do. As for 310x going through final testing we did test document on Monday. Beta sites testing it at moment... Don't worry it is coming
Is there an easy way to export GPO's to another machine/domain?
mjs_mjs (13th May 2011)
Last edited by mjs_mjs; 13th May 2011 at 08:27 AM.
There are currently 1 users browsing this thread. (0 members and 1 guests)