Slow Logons (Event 6005)

[Jambo_C]

Hi,

 

I've recently been experiencing some slow logons across my site. The user logs on and the machine stays on the "Welcome" part for up to 10 minutes. These were users who up until now have been logging on in under a minute. My machines are Windows 7 on a Server 2008 R2 domain. The users have roaming profiles but Documents, desktop etc (ie all the things that can get big) use folder re-direction so the profiles should be small. Once the user has logged on if they then log off subsequent logons are at the normal speed. When the logons are slow I have checked Event Viewer and there is the following event:

 

"Winlogon notification subscriber is taking a long time to handle the notification event (logon)" Event code 6005.

 

This has just started happening for no obvious reason. The only changes made to the network have been a migration from Exchange 2003 to Exchange 2010 which shouldn't do anything to effect logon times.

 

I've done various Google searches and there are numerous suggestions but none of them seem relevant to my case.

 

Has anyone experienced similar? Any help would be appreciated.

 

Thanks.

[Jambo_C]

Bumping an old thread because this problem has returned. It had gone and appeared to have fixed itself but now I'm getting the slow logons and the messages in event viewer again. Once more I've changed nothing, it appears to be doing it out of the blue.

[win]

Enable the verbose setting in GPO so you know where it hangs

[Jambo_C]

Thanks, does it matter which policy I enable this on? If I just enable it on the default domain policy will that show me everything?

[win]

You only need to enable it on the OU housing the computers that are affected. Then when you log in it will show you what it is processing, and eventually it will stop, informing you what is causing the hang e.g. deploying printers.

[Jambo_C]

Hi, cheers for that. I'd not come across the verbose setting before, very useful. I ended up setting it locally on one of the machines and it appears that it's something to do with the printers, at least that was the longest displayed thing. The only printers I had in GP were some set in GPP and all still exist. I've deleted them all though and the performance seems better on the machine I tested. I guess I'll see for definite after a reboot when the next class go in.

[Meldrew]

Is it always 10 minutes and no longer? If so that sounds like a printer connection timeout issue. If its sometimes much longer, it may well be a WMI repair caused by the previous user forcibly shutting down the PC by holding down the power button. That would make sense with it being fine after a reboot or logoff/on.

 

To confirm in our case we took over an IT room, logged on to them all and waited for the desktop (some took up to 45 mins), then switched off properly and then booted up and logged on which was quick as anything (we then repeated this again to be sure). Then we held the power button down on all PCs and although they boot to logon screen quick enough, logon took ages again, proving (to our minds) that students hodling in the power button was the root cause of slow logons in our case.

 

Meldrew.

[Chuckster]

have a look here

 

http://www.edugeek.net/forums/windows-7/47835-windows-7-gotchas-tips-fyi-2.html#post825156

[win]

No problem, another tip i've learnt is that HP printers take longer to deploy than others. Think it is to do with the universal drivers, brother seems to be ok though.

[Jambo_C]

It doesn't always take 10 minutes, the machines seem to vary, in fact the longest this time around has been about 8 minutes.

 

After getting rid of the printers policy it seems to have improved slightly, it's still not as fast as it should be though and seems to spend a long time waiting for the user profile service.

[Jambo_C]

I'm still getting the issue I'm afraid. It seems to have improved slightly but it's not fixed. The errors don't appear as often but they're still appearing. With the verbose settings on it takes longest waiting for the user profile service.

[CyberDrac]

We had exceptional logins with SCCM wanting to carry out checks after nasty shut downs, it closed down the login service while it did its checks before resuming normal operation after around fifteen minutes ... any similarities?

[Jambo_C]

We had exceptional logins with SCCM wanting to carry out checks after nasty shut downs, it closed down the login service while it did its checks before resuming normal operation after around fifteen minutes ... any similarities?

 

I don't think so, I'm pretty sure all these have been shutdown cleanly, the kids are actually pretty good at doing that.

[itgeek]

I had a problem with ie branding. What version of ie you running? I would try to downgrade to 10 seems to be ok? When we applied ie11 it didn't like our roaming profiles!!!

[Jambo_C]

It is IE11 that we're running but we've been running that a while and it's been OK up until the last few weeks.