+ Post New Thread
Page 3 of 3 FirstFirst 123
Results 31 to 44 of 44
Windows Server 2000/2003 Thread, GPO Bloat in Technical; Same here. Everything is gone. GJE...
  1. #31

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,258
    Thank Post
    962
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    Same here. Everything is gone.

    GJE

  2. #32

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,258
    Thank Post
    962
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164

  3. #33

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,258
    Thank Post
    962
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    So this tale is getting better. The LEA have been looking at some stuff and so far we have managed to get the logon time down for a cached profile to around 35-40 seconds depending on the machine. At the LEA centre the logon is around 15 seconds which they say is right as they map drives across domains.

    Now this is our issue - the LEA have discovered an issue with mapping drives across domains. The LEA SIMS server is on a different network to the LEA Curriculum Domain. For some reason the drive mapping they have in place with a script is taking 15 seconds to connect. Thus adding this time to the logon - increasing it to the 30 or so seconds.

    This weekend the LEA restarted their domain servers in the early hours of the morning as they had identified a couple of authentication issues during Friday. So hopefully this may solve something or other.

    SO it's getting better. Myself and Richard (techie) are working on consolidating GPOs and cutting down the amount of individual/little GPOs we have on the network.

    Gareth

  4. #34

    Join Date
    Jan 2009
    Location
    Northants
    Posts
    135
    Thank Post
    3
    Thanked 11 Times in 10 Posts
    Rep Power
    13
    We have loads of GPO's and some did cause problems with slowing logon times.

    The things we did that helped
    1) Disable User/Computer configuration - If a GPO only has user settings then disable to computer settings(and vice versa), this is especially important for GPO's linked high up the tree.
    2) Reduce Security filtering, ensure that GPO's are applied to the best OU's and don't use security filtering where possible. This can depend strongly on your OU structure
    3) Don't duplicate settings between GP's that all apply to the same set of Objects, there is no need to set Hide the control panel 4 times in user policies
    4) Remove ADM templates that aren't in use from each GPO, this took a while, but really made a difference, the ADM's get included in the GPO which increases the size and therefore the download time. we reduced our average GP folder from 2mb to under 500k. By default there are a bout 4 ADM's in each policy. if it is a software installation policy it doesn't need any of them.
    5) WMI filtering really affects the processing speed of GPO, don't use it unless you really have to. Security filtering is OK and OU Targeting is best.

    Hope this helps you out.

    Skr

  5. #35
    bio
    bio is offline
    bio's Avatar
    Join Date
    Apr 2008
    Location
    netherlands
    Posts
    520
    Thank Post
    16
    Thanked 130 Times in 102 Posts
    Rep Power
    37
    Quote Originally Posted by garethedmondson View Post
    Here is the latest file taken from a machine today that is not my test machine.

    Here is what stands out to me - even though I do not understand everything..
    • 22 second gap between rows 614 and 621
    • Row 1877 - 59 seconds to reach logon box
    • Between 1878 - 1918 - no DNS
    • When the user logs on it takes 21 seconds between 3016 and 3020 - to do what?
    • No idea what is going on between 3385 - 3400
    Feel free to disect :-)

    Thanks everyone,

    Gareth
    * In my opinion you have 2 processes that slow down the startup procedure : the symantec AV (C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe) and the Imperoclient (c:\Program Files\Impero Solutions Ltd\Impero Client\imperoclient.exe)....
    For testing purposes disable them and check how long it takes...
    * The DNS errors can be skipped and should not be a problem. Normally they are generated by secondary programs that are not related to the login procedure (can't see for sure cause the excel sheet does not contain process id's)
    * between 3016-3020 probably caused by enabling GPO logging
    3385 - 3400 same as the DNS errors

    bio...

  6. #36
    gshaw's Avatar
    Join Date
    Sep 2007
    Location
    Essex
    Posts
    2,648
    Thank Post
    164
    Thanked 217 Times in 200 Posts
    Rep Power
    66
    The IE branding policy can really slow things down, there was a bug that MS fixed, broke and kinda fixed again that can add 20 seconds to your logon times :-O

    Put verbose mode on to watch the policies applying then the logging methods above would be a good place to start.

    We currently split the policies out for Users and Computers but when I rebuild the teaching machine GPOs in summer I'm going to split them out slightly for ease of management e.g.

    Shutdown Policy
    Microsoft Office Policy
    Netsupport Policy

  7. #37

    russdev's Avatar
    Join Date
    Jun 2005
    Location
    Leicestershire
    Posts
    6,915
    Thank Post
    708
    Thanked 549 Times in 364 Posts
    Blog Entries
    3
    Rep Power
    204
    Quote Originally Posted by bio View Post
    * In my opinion you have 2 processes that slow down the startup procedure : the symantec AV (C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe) and the Imperoclient (c:\Program Files\Impero Solutions Ltd\Impero Client\imperoclient.exe)....
    For testing purposes disable them and check how long it takes...
    * The DNS errors can be skipped and should not be a problem. Normally they are generated by secondary programs that are not related to the login procedure (can't see for sure cause the excel sheet does not contain process id's)
    * between 3016-3020 probably caused by enabling GPO logging
    3385 - 3400 same as the DNS errors

    bio...
    I doubt it is Impero service as that starts very quickly and also Impero is running at the login screen? However if is give us a call Gareth and will gladly help you through it.

    Russell

  8. #38

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    77
    I agree what Bio says, when I looked at the file I saw the same.

    @gareth - Can you enable logging for me as per KB and send/post me the logs. Do this on a problem machine.

    Fixing Group Policy problems by using log files: Group Policy

    Thanks
    Sukh

  9. #39

    russdev's Avatar
    Join Date
    Jun 2005
    Location
    Leicestershire
    Posts
    6,915
    Thank Post
    708
    Thanked 549 Times in 364 Posts
    Blog Entries
    3
    Rep Power
    204
    Just looking at file Gareth what version of client was on that machine out of interest I think I remember conversation with dev team and they have changed few of start up things will have a word them tomorrow as if we can give you a even faster start up then heck see what can do... (even I wouldn't say impero is adding that much time to your login script). Would like to know why got two imperoclients running through will run tool over my test network to double check not normal behaviour through..

    Russell

  10. #40

    garethedmondson's Avatar
    Join Date
    Oct 2008
    Location
    Gowerton, Swansea
    Posts
    2,258
    Thank Post
    962
    Thanked 324 Times in 192 Posts
    Blog Entries
    11
    Rep Power
    164
    Hi Russ,

    There is only one client on each workstation although it could be remnants of a broken 3036 many moons ago. We are waiting for the 310x version to arrive - thought it would have been there by now. We did log a call with you guys today - you may have seen it on your forums

    Gareth

  11. #41

    russdev's Avatar
    Join Date
    Jun 2005
    Location
    Leicestershire
    Posts
    6,915
    Thank Post
    708
    Thanked 549 Times in 364 Posts
    Blog Entries
    3
    Rep Power
    204
    Hi Gareth

    Did see your call come through see Mike is dealing with it let me know if anything I can do. As for 310x going through final testing we did test document on Monday. Beta sites testing it at moment... Don't worry it is coming

    Russell

  12. #42
    mjs_mjs's Avatar
    Join Date
    Jan 2009
    Location
    bexleyheath, london
    Posts
    1,018
    Thank Post
    37
    Thanked 111 Times in 95 Posts
    Rep Power
    37
    Is there an easy way to export GPO's to another machine/domain?

  13. #43

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    77

  14. Thanks to sukh from:

    mjs_mjs (13th May 2011)

  15. #44
    mjs_mjs's Avatar
    Join Date
    Jan 2009
    Location
    bexleyheath, london
    Posts
    1,018
    Thank Post
    37
    Thanked 111 Times in 95 Posts
    Rep Power
    37
    Quote Originally Posted by sukh View Post
    many thanks - will doing this on a live network cause any issues? // ignore this - read the MS doc wrong (fail)

    We have 59 GPO's - RM CC4 and about 6 of our own. RM use the security method to select GPO's in some cases (most i was told by rm) and no the OU method.
    Last edited by mjs_mjs; 13th May 2011 at 08:27 AM.

SHARE:
+ Post New Thread
Page 3 of 3 FirstFirst 123

Similar Threads

  1. GPO - How do you do it?
    By andy_whitlock in forum Windows Server 2008 R2
    Replies: 3
    Last Post: 15th July 2010, 01:48 PM
  2. Replies: 0
    Last Post: 6th July 2010, 08:45 PM
  3. [MS Office - 2007] .docx file size bloat when printing file with multiple pictures.
    By pete in forum Office Software
    Replies: 5
    Last Post: 29th April 2010, 10:03 AM
  4. EZ-GPO
    By pottski in forum Windows
    Replies: 3
    Last Post: 11th December 2008, 08:52 AM
  5. Removing a GPO
    By _Bat_ in forum Windows
    Replies: 12
    Last Post: 3rd May 2007, 04:27 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •