Windows 7 Slow Initial Logon from Cold Boot, Fast Second Logon

[netadmin]

We run Windows Server 2008 R2 domain controllers and Windows 7 Enterprise 64bit workstations, along with Deep Freeze (configured to reset on each restart).

 

When each Windows 7 computer starts up, the first user to logon takes about 60-75 seconds to logon. However, the second user (any user from the domain, not just the first user) logs on in no more than 25 seconds.

 

I setup group policy to 'verbose' and there is a slight extra delay for the first user in 'Please wait for the User Profile service' but most of the added time for the first user (at least 30 seconds) is at the final step, 'Preparing Your Desktop'. I have tried the group policy option to wait for network on startup, but that has not helped.

 

Does anyone have any ideas on how to get the first user to logon faster, like the second user does?

Thanks!

[Dos_Box]

Do you have mandatory or roaming profiles?

[netadmin]

We have roaming profiles, where everything except app data and cookies are redirected to user folders on the server (app data and cookies are stored locally on each machine and cleared on each restart by Deep Freeze).

[Arthur]

KB981830 or KB2617858 perhaps?

[netadmin]

Thanks Arthur.

 

I just tried both of those KB patches, but unfortunately, it did not improve our logon speeds.

[Archey]

Did you set at any time solid-color backgrounds for your computers? This is not a joke.

 

Ok I have a very informative URL but I'm not able to make a link since I subscribed just to reply, so please copy: itexpertvoice.com/home/get-rid-of-slow-logons-in-windows-7/

[netadmin]

Thanks Archey. I double checked and unfortunately all of our computers are set to use the default Windows 7 theme rather than a solid color background.

[Archey]

Hum, you can try logging on one of these computers and as soon as you logged on, press Ctrl+Alt+Del, then Esc, without needing to access the task manager.

It's possible that when you escape you will arrive directly to the desktop, much faster than usually. If it is the case, try the regedit fix in the link I posted.

 

In my case, I wasn't using the solid-color background anymore, but was still suffering the 30 seconds wait. As soon as I applied the fix it was gone.

 

Hope this helps, and good luck with your problem!

[glennda]

Have you tried enabling the wait for network in gpo? you may find the initial login is slow because the machine is actually giving you a login screen well before it is ready. It then spends the first little bit of time waiting for the network and then logs you in.

 

Try turning a machine on and typing a username and incorrect password and see how long it takes to return a this password is incorrect

[netadmin]

Well, I've gotten closer to a solution on this.

 

I applied the registry fix Archey linked and that sped up the logon time some. I then deleted the stubpath entries for some of the Active Setup items in the registry (Media Player, Internet Explorer) as these items are set through Group Policy anyways - this sped up the logon time significantly. I tried enabling the wait for network in gpo, but this did not speed up the logon time. I also removed the GPP printer mapping and used a vbscript instead, which sped up the logon time by about 15 seconds.

 

So, before the logon times for a new user were averaging about 60-75 seconds, they are now averaging about 25-30 seconds. However, what is strange is that if after any user has logged in and then logged out, if any other user logs in after them (on the same workstation, without restarting), logon only takes 7-10 seconds, even if they have never used that computer before. Any ideas why the logon for the second user would be so much faster than the first? I'd like to get the logon time for the first user down a bit more. Thanks.

Edited February 21, 2012 by netadmin

[Kogelkopper]

I think it has something to do with the moment you log on. What i mean is the following: When you directly press Ctrl+Alt+del when you see it, logon will go slow (with us it takes like 1 minute), when you wait a half a minute, the logon procedure will go much faster (about 20 second). I'm working on our migration to Windows 7, GPO, Mandatory profile and so on......

[netadmin]

Thanks Kogelkopper. I did some testing, but unfortunately for us, it does not matter if I logon immediately when Ctrl+Alt+Del appears or if I wait 30+ minutes.

 

I did a bit more analysis and it appears like the delay is only on the 'Please wait for user profile service' part of the logon now. If this is the first user to logon since the last restart, it takes about 24 seconds for complete logon. If this is the second (or beyond) user to login since the last restart, it only takes 7-8 seconds. Almost all of the extra logon time seems to be spent on the Please wait for the user profile service part (everything else takes about the same amount of time regardless of if this is the first user to login or not).

 

I dug down in the event log (the User Profile Service log) and found the following sequence of events on first user logon:

>(0 seconds) Received user logon notification on session 1.

>(12 seconds later) Registry key C:\Users\studentuser\ntuser.dat is loaded at HKU.....

 

For the second user, obviously the path on step two updates to reflect correct username, but the duration between the two steps is only about 2 seconds.

 

Now for my questions:

 

1. Even if I show all hidden files, I do not see a ntuser.dat file in either the user folders or the default user folder. Could this be part of the problem, or does Windows just always hide this file?

2. If I do a nslookup domainname.local, it shows all of our DNS servers for both our Data and VOIP vlans. The workstations only have access to the Data vlans. Could the fact that it displays the DNS server addresses for the VOIP vlans part of the problem?

3. Any other ideas on the difference in logon times?

 

Thanks for the continued assistance.

[glennda]

You have to untick show system files or something like that it's the second or third option below hidden files in the folder options list.

[ScottLogan]

Hi netadmin,

Just so you know there is a massive logon time hit with printers and windows 7 at the moment.

Basically delploying printers via GPO for windows 7 with item level targeting causes massive logon delays.

I am currently working on a solution to this.

My solution so far has made me scrap every single GPO and start again.

So far my basic setup has lead me to loopback proccessing for each computer room.

I then apply a vbs logon script for each room which i will paste an example of below.

I now have 11 second logons and 32 second logons for new profiles.

I also use delprof2 to delete old profiles on computer startup so these times are valid for each logon.

now to add to this use your computer logs to find out what is causing logon delays. Event viewer > Applications and services logs > microsoft > windows > group policy.

You will find some intresting times in there. Another logon delay on my network is IE client extensions. (please note IE extensions do not work for IE 9 unless you apply this update to your machine Internet Explorer Group Policy Preferences do not apply to Internet Explorer 9 in a Windows Server 2008 R2 domain environment)

this script below i simply apply to logon scripts. rather than upto 5 mintues of logon times to install printers this takes less than 1ms to run. you will need to modify for your network

 

On Error Resume Next

' Option Explicit

Dim network

Set Network = CreateObject("Wscript.Network")

set objShell = WScript.CreateObject( "WScript.Shell" )

'Calls the isMember function with the specified group to see if the current user

' is a member of that group.

'----------------------------------------------------

'Removes any existing networked printers

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colInstalledPrinters = objWMIService.ExecQuery _

("Select * From Win32_Printer Where Network = True")

For Each objPrinter in colInstalledPrinters

objPrinter.Delete_

Next

 

If isMember("FollowMe Printing") Then

Network.AddWindowsPrinterConnection "\\followme\FollowMe"

Network.SetDefaultPrinter "\\followme\FollowMe"

Else

Network.AddWindowsPrinterConnection "\\hecate\it2-colourlaser"

Network.SetDefaultPrinter "\\hecate\it2-colourlaser"

End If

' *****************************************************

'This function checks to see if the passed group name contains the current

' user as a member. Returns True or False

Function IsMember(groupName)

If IsEmpty(groupListD) then

Set groupListD = CreateObject("Scripting.Dictionary")

groupListD.CompareMode = 1

ADSPath = EnvString("userdomain") & "/" & EnvString("username")

Set userPath = GetObject("WinNT://" & ADSPath & ",user")

For Each listGroup in userPath.Groups

groupListD.Add listGroup.Name, "-"

Next

End if

IsMember = CBool(groupListD.Exists(groupName))

End Function

' *****************************************************

' *****************************************************

'This function returns a particular environment variable's value.

' for example, if you use EnvString("username"), it would return

' the value of %username%.

Function EnvString(variable)

variable = "%" & variable & "%"

EnvString = objShell.ExpandEnvironmentStrings(variable)

End Function

' *****************************************************

' Clean up

Set objShell = Nothing

[netadmin]

@glennda: Thanks for pointing me to that checkbox to show the system files. Not sure how I kept missing it, but now I see it.

 

@ScottLogan: I had noticed that GPO printer deployment seemed to add quite a bit of time to the logon process, so I switched to a VBScript similar to yours earlier in the month, which reduced logon time by about 40 seconds. I was not aware of the update needed to get IE9 extensions working though, so that is very helpful information. I'll dig down further into the Group Policy logs. Thanks!

[Mr_Jiminy]

Just letting you folks know - it gets no better with Server 2012. We've had to reconsider deploying network printer using the GP Preferences way. I'm going to be testing scripts next week.