Group policy printer preferences - Windows 7 - Issue overnight

[broadld]

I'm also having this issue this morning. Been a nightmare! Clients are Win7 x64. We also have Sophos installed on all clients. We use group policy to deploy printers.

 

Some are hanging on the "Deploying group policy printers" message, others are just sitting with a black screen and the cursor. Black screen ones hang for about 3-4 mins and then log in normally. Printer message clients are taking longer than this and I haven't yet sat there long enough to see whether they eventually log in.

 

Version of Sophos on clients is 10.6.3.537. Our server has updated itself at 11:15 this morning (03/05/2016) and says it's on version 1.5.8.11.

 

Anyone managed to find a fix yet?

 

Hi there no not got a fix yet but we have got a case logged with sophos regarding this. Ours started on Friday morning.

[callbe1]

We are experiencing the identical problem here.

 

We've had a handful of machines that are hanging on "deploying group policy printers" - after about 15 minutes they appear to be logging in. We're running Sophos as well and an update went down to our server at 11:05 this morning - now running (1.5.8.11) and the Clients are running 10.6.3.537.

 

We're testing a machine at the moment to see what log in times are like with and without Sophos running.

 

If anyone finds a fix that would be greatly appreciated.

[InspireICT]

We are having this same problem in multiple sites, all running GPP Printers and Sophos

[InspireICT]

If you click view product information the expand software section there should be a longer version number.

 

Mine is 10.6.3.537

 

I have been testing a few things and disabling behaviour monitoring on the Sophos policy seems to have good results. Can anyone else try this to see if it makes login times better. I don't think it resolves the issue completely though.

 

We've disabled Behaviour Monitoring from the console at a couple of schools and can confirm it seems to prevent the slow logins. Going to wait a little bit to see if Sophos come up with a fix before rolling out to all schools

[Network_Boy]

Update: It's definitely Sophos causing the issue. Disabling on a client removes the slow logon issue.

 

Have also had clients hanging on "Group policy registry settings" as well as group policy printing settings. Curiously the slow logon doesn't happen on all clients. Even more curiously on individual clients, the slow logon doesn't happen every time.

 

Will try disabling the behaviour monitoring. Can someone please instruct how to do this from the console? Thanks!

[Network_Boy]

Sorry - figured this out now.

[broadld]

Update: It's definitely Sophos causing the issue. Disabling on a client removes the slow logon issue.

 

Have also had clients hanging on "Group policy registry settings" as well as group policy printing settings. Curiously the slow logon doesn't happen on all clients. Even more curiously on individual clients, the slow logon doesn't happen every time.

 

Will try disabling the behaviour monitoring. Can someone please instruct how to do this from the console? Thanks!

 

Go to your antivirus and HIPS policy you are using. It may be called "Default" or you may be using a custom one you created. Edit this and untick "Enable behaviour monitoring"

 

It moght be worth everyone with the issue logging this with Sophos as the more cases they have the more resources they will put into fixing it. If they have only one case then they won't take it very serious.

[Network_Boy]

Update from Atomwide Support, which must be the same issue as all Sophos people on here are having:

 

[TABLE=width: 0]

[TR=bgcolor: palegoldenrod]

[TD]3rd May 09:54

 

We are aware of ongoing issues with DNS performance. Our analysis shows slow response times from Sophos thereby affecting access to websites, particularly from Schools running Sophos Live Protection.

 

While we continue to investigate this with Sophos, you may wish to temporarily switch off Sophos Live Protection.

 

This can be done by opening Sophos Enterprise Manager and under policies select your Anti-Virus and HIPS policy (most schools use the Default policy). Right click the policy and select "View/Edit Policy" From here select "Sophos Live Protection" and untick "Enable Live Protection"

 

Further updates to this issue, including when it will be safe to turn Live Protection on, will be posted to this case.

 

3rd May 11:48

 

Sophos have confirmed that they have been experiencing capacity issues with their service from the end of last week. They have advised that the performance issue should be temporary and they are actively working on a resolution.

 

A limit on the number of queries to the same server has been implemented on the LGfL DNS servers – we’re expecting this to stabilise other services, such as email, and internet access for schools who do not use Sophos.

 

Apologies for the inconvenience caused and we will continue to follow up with Sophos.

 

[/TD]

[/TR]

[/TABLE]

[Network_Boy]

Atomwide will be reporting this to Sophos - so they should be chewing their ear off already. You're right, though - more complaints the better.

[Network_Boy]

Atomwide will be reporting this to Sophos - so they should be chewing their ear off already. You're right, though - more complaints the better.

 

I should point out that Atomwide are a managed IT Support service, who serve all London schools who have their Internet connection from LGFL (London Grid For Learning). Is everyone else on here who's having an issue an LGFL school, or is this a national issue?

[eddyc]

I should point out that Atomwide are a managed IT Support service, who serve all London schools who have their Internet connection from LGFL (London Grid For Learning). Is everyone else on here who's having an issue an LGFL school, or is this a national issue?

 

We are a Bristol School here who use the LEA for the internet connection via Virgin Media.

 

We buy Sophos via SWGfL however.

[broadld]

We are from Leeds with Sophos purchased from YHGFL/ICT4C. Internet connection via Schools Broadband

[callbe1]

I have built up a test machine this afternoon to an identical spec to the stations we had issues with this morning. Its a basic Win7 64bit image and added the GPO Printer Assignments to it.

 

First login was fine (around the 45s mark) for a first time user. Printer installed as you would expect.

 

Installed Sophos, deleted the User Profile, and logged back in. Tried this about 6/7 times and login times were normal, tried once more to replicate the problem and hey presto, there I was sitting looking at "group policy printers" for a good 10 minutes.

 

I then disabled the GPO and rebooted the machine and I was being logged in again under a minute. Definitely seems to be an issue with Sophos and the Print Assignment GPO.

[eddyc]

I have built up a test machine this afternoon to an identical spec to the stations we had issues with this morning. Its a basic Win7 64bit image and added the GPO Printer Assignments to it.

 

First login was fine (around the 45s mark) for a first time user. Printer installed as you would expect.

 

Installed Sophos, deleted the User Profile, and logged back in. Tried this about 6/7 times and login times were normal, tried once more to replicate the problem and hey presto, there I was sitting looking at "group policy printers" for a good 10 minutes.

 

I then disabled the GPO and rebooted the machine and I was being logged in again under a minute. Definitely seems to be an issue with Sophos and the Print Assignment GPO.

 

We've also done this today - exactly the same. I have also seen it get stuck as registry settings policy for 10 minutes on one login attempt - It seems pot luck as to whether you get stuck and where you get stuck!

[Network_Boy]

Latest Atomwide update 17:33 03/05/16:

 

We made a number of adaptations to the DNS configuration on Friday to insulate the LGfL DNS servers from this type of third party issue, and monitoring over the weekend indicated that these were successful in achieving much improved performance. However, further changes had to be made this morning as the issue continued. LGfL monitoring indicated that Sophos had resolved the issue with their servers at 12.20 pm today, and we have now had formal confirmation from Sophos that the problem has been resolved.

Normal service has now been resumed.

The adaptations that were implemented will be left in place to ensure that we are protected from similar third party issues in the future.

We apologise for any inconvenience this issue may have caused.

 

Anyone tried logging in this morn? Problems gone away?

[broadld]

Latest Atomwide update 17:33 03/05/16:

 

We made a number of adaptations to the DNS configuration on Friday to insulate the LGfL DNS servers from this type of third party issue, and monitoring over the weekend indicated that these were successful in achieving much improved performance. However, further changes had to be made this morning as the issue continued. LGfL monitoring indicated that Sophos had resolved the issue with their servers at 12.20 pm today, and we have now had formal confirmation from Sophos that the problem has been resolved.

Normal service has now been resumed.

The adaptations that were implemented will be left in place to ensure that we are protected from similar third party issues in the future.

We apologise for any inconvenience this issue may have caused.

 

Anyone tried logging in this morn? Problems gone away?

 

Have you had sophos live protection disabled at your site? If so has this resolved your slow logins?

[Network_Boy]

Have you had sophos live protection disabled at your site? If so has this resolved your slow logins?

 

Yes I have disabled the live protection and behaviour monitoring on our Sophos policies. All clients are now logging in, but I would say that they are slower than normal - perhaps by about 15-20 seconds (although I haven't actually done any proper timing). I will re-enable the live protection and behaviour monitoring later and see if all clients still log in successfully.

[Darylrese]

Hello,

 

I have been having the exact same issues. All of a sudden a few weeks ago our PCs started taking 15 - 20 mins to boot. I enabled Verbose mode and the PC's affected are getting stuck on 'Applying Computer Settings'.

 

I have been playing around with all my policies, DNS and domain controllers slowly going grey in the process then someone pointed me to this thread.

 

We too have SOPHOS, however we are in the process of moving away from it. If i reformat a machine (new image doesn't have SOPHOS on it) the PC is much faster booting and has no issues. On effected machines during startup i also see a group policy called 'Wireless Group Policy Policy' which doesnt exist anywhere on my network! It only happens on effected machines and not ones working as expected.

 

I'm going to remove SOPHOS from all machines ASAP, however it seems to be a right pain to remove as often it wont uninstall saying Almon failed to respond or some such nonsense. I cant wait to see the back of SOPHOS.

 

I have reformatted about 20 machines today until i found this thread so thank-you for saving me a lot of time!

Edited May 4, 2016 by Darylrese

[Darylrese]

I can confirm the issue is with SOPHOS. After removing it from machines, boot times went from 10 - 15mins to 20 seconds (with SSD). Thank god we are ditching it.

[robyholmes]

Anyone got an update from SOPHOS about this? I've not really seen slow login times on the whole but it has been mentioned a few times.

[callbe1]

Having switched the GPO off (thankfully, it was only being used for a handful of machines) login times reverted back to normal.

 

Reading on here there could have been a Sophos update I re-applied the GPO late Tuesday evening. Had no reports yesterday of any login times taking any longer than they should have, fingers crossed that will be the same today (the phone hasn't gone yet!!)

[Boredguy]

Thankfully we've been back to normal as of Tuesday lunch time, so the changes made by Sophos at their end certainly worked.

[eddyc]

I've had a reply from Sophos on my call that I logged with them to say that this should now be resolved - I will turn everything back on over the weekend and cross my fingers for Monday morning!

[broadld]

Hi Eddy,

 

Has this issue now been resolved for you? I can't believe that an issue with Sophos DNS server could have such an issue with login times? I have a case logged with Sophos and it is going SLOWLY! I will get them to ask regarding sophos live protection and see why this should affect login times.

[eddyc]

Hi Eddy,

 

Has this issue now been resolved for you? I can't believe that an issue with Sophos DNS server could have such an issue with login times? I have a case logged with Sophos and it is going SLOWLY! I will get them to ask regarding sophos live protection and see why this should affect login times.

 

I would say it is better than it was but it still isn't 100% - Some machines do still seem to hang on login but it moves from machine to machine and affects different users, very frustrating!