Windows 10 21H2 is getting stuck during login authentication

[Pyno78]

Hi,

Since the upgrade of Window10 from 1909 to 21H2 we are incurring a problem during login authentication. This problem is not consistent I haven't been able to replicate it yet on my devices and it is just affecting random users. The workaround is to force the restart of the computer, but the same user can incur this problem again randomly in the future.

Below there is an example of how this problem will manifest on the user's PC:

 

1. The user logs into a windows device let's say at 9:08 am
   
2. The user is waiting for the GPO to finish applying but it is not, it has gotten stuck;
   
3. It is now 9:20am still stuck applying GPO so the user forces the shutdown;
   
4. At the restart he manages to log in fine;
   
5. Randomly the same user can be affected by this problem in the future
   

In the EventViewer, I can see that he logged in at 09:08 and the GPO applied correctly at 09:10:21. In total all the GPO policies applied in 83 seconds.

I can then see a Winlogon Warning at 9:11 "The winlogon notification subscriber is taking a long time to handle the notification event (Logon)", after that, I cannot find anything on the main System and Application logs between 9:11 and 9:20 while the computer was stuck on applying policy on the user side, I can just see a log after 9:20 that is telling me that the computer has been forced to restart.

I am not sure that there is a problem with the GPO because each user got stuck on different GPO Policies and the logs are telling me that the GPO has applied correctly. In the beginning, we believed that was a user profile problem but this is not the case because we reset a profile and the error re-occur.

Any help from the community will be appreciated.

 

Thanks,

Pino

[mjhardisty]

Have you executed a Group Policy Results report on the device for a user?

[Pyno78]

Hi,

Thanks for your response. The problem is that, usually the user reports this problems after it has forced the shutdown and restarted the device, after that this problem disappear and maybe the problem will appear again in few days or weeks. If I run the Group Policy result what I am looking for?

 

Regards

[mjhardisty]

The results report will provide you any errors in processing Group Policy, will show you any delays in processing policies, which policies were applied and denied, etc.

[Pyno78]

Thanks,

I have checked that yesterday to one of the affected device all the policies applied successful the only warning on the summary was:

As I mentioned before:

"In the EventViewer, I can see that he logged in at 09:08 and the GPO applied correctly at 09:10:21. In total all the GPO policies applied in 83 seconds.

I can then see a Winlogon Warning at 9:11 "The winlogon notification subscriber is taking a long time to handle the notification event (Logon)", after that, I cannot find anything on the main System and Application logs between 9:11 and 9:20 while the computer was stuck on applying policy on the user side, I can just see a log after 9:20 that is telling me that the computer has been forced to restart."

 

Thanks,

Giuseppe

Edited January 26, 2023 by Pyno78

[mjhardisty]

In User Details in the report does it give a Time Taken result? It may be worth creating yourself a test OU that has no polices and gradually add them in to see if there is a culprit. We've occasionally had slow User Profile processing due to printer mappings, etc, or resources that are not available.

[PotNoodleTech]

We've seen this very occsionally on random pcs and random users. Imossibl to replicate and as you say a reboot always cures it. It doesnt even happen once per day across 500 pcs - maybe once or twice a week?

 

I don't believe it is a 21H2 issue as it's been doing that for a couple of years.

 

Never got to the bottom of it, just put it down to yet another "windows 10 thing"

[Pyno78]

Yesterday I got more information. One of our customer has waited for 12 minutes after login on on the pc " It was stuck on applying GPO" but it didn't force the restart and eventually managed to login fine.

From the log I could see that:

 

It looks like that for 9 minutes the system has repeatedly scheduled Software protection. I am just wondering if this problem is just happening when the users are shut down and not when restart the device, a full restart would properly clear the previous session but performing a shutdown maybe is creating problems on the next login because of the Fast start-up setting that is applied by default.. I could disable it if I change this registry key Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Power\HiberbootEnabled from 1 to 0. I have changed on my laptop now but the time to reach the login page is around 1:30- 2 minutes. I have a very good internet connection and I suspect this will not go well with our customers if this time increase, currently with the fast startup enabled, it takes 10 seconds to reach the login page. I could try with the Task Schedule to force shutdown without Start-up enable once a week to reduce the chance that this problem will re-occur but I need to figure it out how to do it and if this will improve the situation If you have any advice on how to create this Task Schedule or if you think of a better solution please let me know.Thanks a lot for your help.Kind regards

[mjhardisty]

I wonder if this isn't GPO related. It might be an issue with something else. In the User Details in the report does it give a Time Taken result that matches the 9 minutes or does it show GPO has been fully processed and then you get the software protection errors as Windows logs in?

 

https://learn.microsoft.com/en-us/answers/questions/749452/restart-in-100-years-successfully-scheduled-softwa

[Pyno78]

Hi, unfortunately the customer had this problem yesterday but it has reported today. I asked and she performed a restart last night so I suppose that now it would be useless to get the GPoreport form the device because it has logged pretty quickly this morning. I will try to gather this from the next customer.

 

I will have a look at the link that you have sent to me.

 

Thanks

[mjhardisty]

Its worth running the GPO Report out of curiosity. Like I hinted above, it may be that the GPO is not causing the issues at all, but its an issue on the machine (a service, etc that the restart fixes). If it was a GPO fault, generally you'd get the same reason over and over again - especially being part of the User GPOs.