Win 7 64x Hangs on login -waiting for group policy

[mattianuk]

Hi all.

 

Weird one this.

 

Our new IT room is causing a few last minute headaches, so much so I went in today to try and tackle the issues head on but to no avail.

 

It is a windows 7 64x only domain, with server 2008r2.

 

On logging in, approx 10 out of 34 machines take an age, waiting for the group policy service. These 10 are no different in terms of machine, build, ou group or software. They go through 3 separate switches each with a different link back to a central network switch.

 

I have tried quite a few things - and sometimes I can get the whole room to login in 13 seconds. Other times, most do bar this 10. These 10 dont change, but they do sometimes work, and this happens nowhere else in the school.If I move the machines elsewhere they work, if I swap their cables in the switch with a working one, they still wont work.

 

Any ideas?? I have checked the error log. Not a lot there that is relevant - but perhaps Im not looking for the right thing. One thing I did notice today - when doing a GPUpdate today, most did it, including some of the 10 not working, but a few others told me they could not apply policies because they could not verify the location (the exact error message alludes me at this time)

 

I was thinking it was down to switches, but 2 are brand new HPs,and it doesnt happen to all the machines on one switch...

 

Im fresh out of ideas, it is as random as it sounds.

[mgs1990]

are these machines patched directly into the switch or via a patch panel then linked into a switch? as if this doesn't happen elsewhere in the school it maybe due to faulty wiring to the sockets from the patch. if you move the machines to use a different socket preferably a known working socket in the same room. does the machine work?

 

Also have you tried uninstalling the network card drivers as sometime these have a tenancy to cause issues even if the rest of the machines use the same driver.

Edited September 3, 2012 by mgs1990

[themightymrp]

What shows up in the following Event Log:

 

Applications and Services --> Microsoft --> Windows --> GroupPolicy --> Operational

 

Any warnings or errors that you could post up here? Have you tried enabling verbose logging so that you can see what part of the login is sticking?

[mattianuk]

Hi

 

These are some extracts from that (thanks for the useful info!)

 

"Completed Group Policy Drive Maps Extension Processing in 127312 milliseconds."

"Group Policy received the notification Logon from Winlogon for session 2." Withj different session numbers

"Completed Folder Redirection Extension Processing in 530 milliseconds."

Completed Registry Extension Processing in 1357 milliseconds.

Estimated network bandwidth on one of the connections: 0 kbps.

Estimated network bandwidth on one of the connections: 1000000 kbps.

The loopback policy processing mode is "No loopback mode".

"Account details:

Account Name : CN=HWEST,OU=Teaching,OU=STB Staff,DC=stb,DC=local

Account Domain Name : STB.LOCAL

DC Name : \\hypervhost01.stb.local

DC Domain Name : STB.LOCAL"

"Computer details:

Computer role : 2

Network name : "

Group Policy successfully discovered the Domain Controller in 843 milliseconds.

"The system call to get account information completed.

CN=HWEST,OU=Teaching,OU=STB Staff,DC=stb,DC=local

The call completed in 126173 milliseconds."

[mattianuk]

On a machine that works, I have noticed the following:

 

Completed Group Policy Drive Maps Extension Processing in 218 milliseconds. compared to Completed Group Policy Drive Maps Extension Processing in 127312 milliseconds." (But they are in the same OU? And Im using the same user?!

 

And: Completed Folder Redirection Extension Processing in 62 milliseconds. compared to 530 on the broken machine,

Registry extensions, 250ms compared to 1357ms?

 

Both are actually using the same DC as well.

 

Both go through the same switch back to a central switch (and some go through different switches but get the same results.)

 

I cant work it out... tried rebuilding. Tried changing over links. It is not happening anywhere else!!!

[mattianuk]

are these machines patched directly into the switch or via a patch panel then linked into a switch? as if this doesn't happen elsewhere in the school it maybe due to faulty wiring to the sockets from the patch. if you move the machines to use a different socket preferably a known working socket in the same room. does the machine work?

 

Also have you tried uninstalling the network card drivers as sometime these have a tenancy to cause issues even if the rest of the machines use the same driver.

 

Have just tried plugging one broken machine into one working ones socket, no difference. Have rebuilt machines but still no difference

[mgs1990]

Have just tried plugging one broken machine into one working ones socket, no difference. Have rebuilt machines but still no difference

 

This is a strange one. Have you tried replacing the network cable from the back of the machine into the socket? Also is the firewall running, if so disable it and see what happens.

[mattianuk]

Yes, brand new cable used to patch in. Firewall turned off, but it's the same settings as the working ones anyways!

[themightymrp]

I think this is more down to the drive mapping policy you have in place, what drives do you have mapped and over how many policies are they spread?

[mattianuk]

 

This is the only file map to that staff user. Students have only the top one

[mattianuk]

Anyone else with any ideas? Im getting a bit beyond desperate now!!

[themightymrp]

Try this.

 

Instead of deleting and re-creating the S: drive each time, remove the delete option completely. Now change the S: drive from 'Create' to 'Update'. On the second tab of that drives settings, use Item Level Targetting and set it to only map if the condition of user group = staff (or your equivelant).

 

I had similar problems with very long logins with drive maps when it spent ages searching for a drive to delete when it wasn't actually mapped!! I have all my mapped drives set to Update and then filter it with the targetting feature

[psydii]

In addition please see:

http://www.edugeek.net/forums/windows-7/97140-windows-7-location-not-available-logon.html#post868272

 

The listed hotfixes included this one:

Long logon time on a Windows 7-based or Windows Server 2008 R2-based client computer in a domain that uses Group Policy preferences to manage drive mappings