2008 TS Remote Apps - 60 second login

[gjames]

Hi,

I have set up two terminal servers - one in a domain which is fully activated and licensed and one as a stand alone eval system for troubleshooting. I am not using web access - I am simply publishing RDP shortcuts. On both servers all remote apps have a 60 second login time. Once the user enters user & password it takes approx 60 seconds before the app actually runs. Clicking on the details button reveals that the first 10 seconds are very busy, at approx 10 seconds a message 'preparing your desktop' is displayed, after this just a blue desktop background is displayed for another 50 secs before the app actually appears. Subsequent logins for the same user are almost instant as the the session sits on the server.

I have searched the web and tried to troubleshoot but I am getting nowhere fast.

Has anybody come across this before and if so, is there anything I can do to reduce the login time? I am supposed to be rolling out a new system for a school but this 60 second login is going to kill it before its even off the ground.

Your thoughts and ideas on the above are very welcome.

Glenn

[linescanner]

First thing to check would be that you have working reverse DNS. Not having it is a prime reason for slow logons.

The other one to look at is profiles. Pathing, application data redirection etc.

Most of the schools we run on TS are at around 10 - 15 second logon

[gjames]

Thanks for the reply.

The two setups I have are as follows: -

1.TS part of domain but not DC
DC hosts DHCP and DNS (no reverse zone)
Profiles are stored on DC with alt location for TS

2. Stand alone server running TS only.
Uses local profiles with local admin

Both of these exhibit the same behaviour. I could perhaps understand config 1 being slower as it loads the profile across the LAN etc, but config 2 uses only local profiles and should be pretty rapid.

If I connect to the server desktop via RDP then access is very quick. It seems to be something to do with the remote apps or perhaps something I am missing?

Any more ideas?

[Oops_my_bad]

I'm having similar problems but more catastrophic.. are you running 64 bit 2008? How long does it take to for an app to appear to a user that doesn't have any group policies applied?

I'm using citrix on a 64bit server however I am publishing a server desktop and not apps. When a whole room is logging on it can take anything upto 10 minutes. I have noticed an individul logon can take anything upto 60 seconds. Profiles are being loaded locally (we dont use roaming/mandatory profiles). Logons which require a lot of group policy settings to be processed (ie students) seem to take the longest, whilst a user with no policies taking <10 seconds.

[linescanner]

Not a huge amount of experience using the MS stuff to publish apps/desktops. We use Sun Secure Global desktop for this and the performance is excellent.

I would go over your DNS with a fine tooth comb though, it is the root of all evil with this type of technology.

Andy

[Gatt]

I have played with TS 2008 RemoteApps

IMHO, The initial 60+ secs is due to the fact that the user still has to have a profile created on the TS for the remote app

It appears that they log in as with a standard RDP session, but everything except the app is hidden from view.

[gjames]

I have set up yet another 2008 TS and still I have a 60 second delay when running a remote app. There are no GPs applied, the user is local to the server, no AV installed, DNS not runnning on the server, no other roles or features installed. Logging into full desktop RDP takes a few seconds, remote app with the same account takes 60 seconds.

Once a session is created, running the remote app is nearly instant so it does look like it might be something to do with the profile loading, but why is the full RDP almost instant?

I am really struggling with this as I seem to be the only person in the world with this problem.

Help.

[Gatt]

How long does it take to log in to a full RDP session then open the App?

This should be equal, more or less, to the time it takes for the remote app to log in (to the desktop) and then launch the application.

[gjames]

Thanks for the reply.

I have just done a test: -

1. Create shortcut for calc.exe in all users startup group
2. Make sure no session exists for remote account
3. Login to desktop using remote account
4. Desktop and Calc appears after approx 2 seconds.

By comparison, running calc.exe via remote app

1. Make sure no session exists for remote account
2. run .rdp shortcut for calc.exe and login
3. Calc appears after 60 seconds.

I just don't get it. What makes it even more annoying is that I have now setup three servers and all do exactly the same thing!

[gjames]

I have been trying anything I can think of on one of my 2008 TS servers to get rid of the 60 second remote app delay and have made a bit of a discovery. I was looking at MSCONFIG to see if I could nobble a few more services and found the 'Disable UAC' command on the Tools tab. I disabled UAC, restarted the server and to my surprise found that the login time for a new, fresh session was down to about 5 seconds. It would appear that UAC on the server is causing my problems!

My questions are - if I am locking down users through loopback policy, do I need to have UAC on the server enabled? What are the implications of disabling UAC on the server? Why even have UAC on the server?

Your thoughts/comments on the above would be greatly appreciated.

[Gatt]

UAC (Or Yuck as I call it) is a nightmare

There are some security policy settings that can define how Yuck behaves with the likes of Admin's, etc..

If Yuck is enabled on a normal user account then it brings up a Dialog Box asking for an admin username & password
If its disabled then its just like XP/2003 - if the user has the rights - the user can do it - if not...

I tend to leave it enabled on Staff PCs - but disable it on Pupil PCs -as kids have all that they need and dont need anything installing ad-hoc..

Yuck on TS though would be disabled across the board...

[gjames]

I have just read a little more on UAC on server 2008 and apparently (in simple terms) it allows normal users to enter admin credentials for tasks if required. As the normal remote users will not be running any admin tasks, I guess that disabling will not have any ill effects?

Just to clarify, I am talking about UAC running locally on the terminal server. This is enabled by default which explains why all three of my TS's exhibit the same 60 remote app login delay.

Glenn