Two Issues with Windows 7 logins

[Bestbett]

First, and I have seen and tried multiple "solutions" for this one with no change; is the very slow logon issue for windows 7 clients logging in with local profiles through active directory. I have from 1 min - 3 min of the spinning welcome screen before kids get a desktop. I have tried the registry fix for DelayedDesktopSwitchTimeout, I have a jpg as the background, I have disabled the DesktopManager whatever service all with no effect. The only solution that looks plausible is to stop remapping my documents, but should I really have to do that, surely there is a better solution?

 

Second, I have trouble finding others with this issue but about every third or fourth student complains that after typing in their name and password, they get put back at the Press CTRL ALT DEL screen, no error or password issue displayed just flipped back to the screen for no apparant reason, they try again and go in but it is annoying for them. Anyone else seen this... fixed it?

 

 

Thanks in advance.

[Bestbett]

I found that for me , even removing my Redirected My Documents Folder didn't improve login times very much, it may have went down to 40-50 seconds from over a minute but still not tolerable.

[featured_spectre]

Is it wired or wireless? Also how big are your profiles? Anything bigger than 1.22mb and you are looking at over 30-40 seconds per login session...i have managed to cut mine down to 1.29 but cant shave any further, i am looking but struggling. Also if you redirect stuff, you will be adding roughly 2 seconds per redirect...

[Bestbett]

Well I guess that could be the issue, mine are 260MB, that is the size of the Default Profile as well though. I didn't do anything really to the profile when I created it; just added my programs and sysprep'd, sent it down and boom, giant Default Profile. And I can't copy anything over the default profile in windows 7 so I am unsure where to go from here... should I reload the image, delete tons of random stuff out of the profile and then re-image?

[featured_spectre]

All I left in my mandatory profile was shortcuts, redirected My Documents (which goes to H:\) and that is it. Everything else is locked down via GPO.

[Bestbett]

I guess that is what I will do, I didn't know it was going to make a huge profile like that off the get-go, wish I would have checked that before rolling it out, may have to find a way to use a network-Default Profile now. Thanks a lot.

[featured_spectre]

No worries....a 260mb profile is insane...i'd leave the image as it is, but create a supermandatory profile....

[mac_shinobi]

Not sure if this will help at all seeing as your profiles are quite large and may not even be related ( just a thought though )

 

To start with on one windows 7 machine you could try

 

1. changing the authentication method from NTLMv2 to use NTLMv1 and only use NTLMv2 if negotiated - you can do this on the local win 7 machine through the security settings ( control panel --> administrative tools --> security policy or local security policy )

 

2. Use Petri's method to disable SMB Signing Version 2.0 - I would try the above one first but just as a test to see if this helps

 

I normally reboot after making changes to either one of the above as you defo need a reboot after number 2

 

How to Disable SMB 2.0 on Windows Vista/2008

 

Just 2 things that I normally change ( well at least point 1 ) when doing scan to folder to the Ricoh copiers as they dont support NTLMv2 or SMB Signing to a certain degree or DFS unless the firmware has been updated on the MFD and supports these items as they are releasing firmware updates for the MFD line to support these.

[jsnetman]

We had a few problems with the default profile when first setting up win 7 through deployment. Same sort of slow response to logons. After some digging around we determined it was because we weren't using true in the unattend.xml file for the image. Which copies any modifications you do with the profile that you ran sysprep through, and sets up required security on the profile. It also applies to to anyone copying the default profile to a network share and using it for mandatory/superman profiles. This could be the problem.

 

Never had to do anything that mac_shinobi says to do but I'm not saying it's wrong, I would just add the copyprofile command then see if that makes a difference first, before messing with SMB (as you are using local profiles it should not be an SMB issue) and authentication.

Edited October 26, 2010 by jsnetman

[Ric_]

260MB for a default profile is crazy! The default profile that windows ships with is 1.68MB! Did you follow the guide at How to customize default user profiles in Windows 7 and in Windows Server 2008 R2 to create your new default profile?

 

Also check out my blog entry at Ric's Blog: Windows 7 Profile Woes for a couple of other tips.

[jsnetman]

The local default profile could be big depending on how you set the image up. If you pre-installed some apps then the default profile will grow, but this should not affect logon times drastically. If it were a server based profile then yes. Our default local profile is 26mb which is because I got so damned frustrated with deploying office 2007 I stuck it on the image.

[Arthur]

There are a few more tips on what to exclude and redirect on the website below...

 

http://blog.stealthpuppy.com/virtualisation/reduce-logon-times-by-excluding-the-bloat/

[markwilfan]

Hi bestbett

 

your second problem is a problem we came across too. It is relating to the setting of requiring a password after sleep

 

There is a gpo setting for that - computer configuration > policies > admin templates > system > power management > sleep settings > require password on wakeup.

 

Good luck with the quicker log ons. ours seem random in length with "preparing your desktop" being the crux

[Dave84]

Microsoft have recently introduced a hotfix for the login problem:

 

The logon screen appears two times when you resume a Windows 7-based or Windows Server 2008 R2-based computer from Sleep (S3); or from Hibernation (S4)

[ZeroHour]

Microsoft have recently introduced a hotfix for the login problem:

 

The logon screen appears two times when you resume a Windows 7-based or Windows Server 2008 R2-based computer from Sleep (S3); or from Hibernation (S4)

 

Have you tried that yet?

Did you use the LDR or GDR version?

[Dave84]

I havent had chance to test it yet, Ill give it a go tomorrow.

 

winlogon is the GDR version but I have no idea what that means!

[ZeroHour]

I havent had chance to test it yet, Ill give it a go tomorrow.

 

winlogon is the GDR version but I have no idea what that means!

 

Because this patch has come out after previous hotfixes it will include those previous fixes as well. GDR means critical previous patches and LDR includes that plus more less critical generally tested patches I *think*

[maxvre]

Hi there,

Part of the reason the default profile grows if building a reference machine is because the default location for %TEMP% and %TMP% is actually in the profile (APPDATA folder) and the contents of this folder gets copied to any newly created profiles if you dont empty it before running sysprep. It fills up because it is used by program installers to copy the installation files to temporarily during an install. The more programs you install on your reference machine the more files and msi installers are left behind in the temp folder of the default user profile.

 

%USERPROFILE%\AppData\Local\Temp

 

Before you run sysprep be sure to delete everything inside this folder and you will see your profile size shrink dramatically. Also watch out for plugin msi installers that leave an msi backup file of themselves within the profile in case they need to "heal" themselves by doing a re-install/repair.

 

Offenders include the Adobe Reader plugin and the Sun Java JRE or JDK. These guys copy 100+Mb msi files into your default profile appdata folder and balloon its size away up.

If you have a fixed software profile for your student machines and you wont be repairing apps during term time etc then it is ok to delete these msi files from the appdata folder before running sysprep. It's worked for me to reduce the profile size from several hundred Mb's down to 55 Mb.

 

ps I'm not talking about the temp folder above I'm talking about their respective installation folders under appdata. They are in either locallow or roaming, I can't remember which.

 

 

Another tip I would give you to narrow down your slow logon would be to turn on the verbose logon / logoff status messages group policy. (It's in the computers section under system.) This will tell you what windows is doing in the background instead of just the "welcome" message and spinning circle.

 

I find that "waiting for user profile service" and "preparing desktop" seem to take the longest time for new profiles being set up.

 

Another issue I have seen is that user accounts with a network home folder take longer to log in (can be up to a minute longer) than an account with no network home folder. There is a group policy which is set to a 30 second wait by default for the network home folder to become available/ready. Reducing this value "may" reduce your logon time.

I can't remember what exactly it is called right now sorry.

Edited December 2, 2010 by maxvre

[burgemaster]

If you are sat there with a rotating "welcome", maybe you could turn on Verbous Logging, so you can see what it is actually doing instead of the "welcome" ?