Slow Group Policy processing

[penfold]

We have a set of machines that are having an issue when starting up and it is taking 15-20 mins for them to get to the logon screen. It doesn't matter what group policy is applied there is always a delay on the first Policy it tries to apply. If you remove all computer policies the delay is then applied on the user logon. There is nothing (as far as I can see) wrong with the policy as we are using it in other groups without issue. Looking at event viewer I can see an Event ID 5017- the system calls to access the specified file completed in 1021042 milliseconds.

 

I have looked at the log file in Policy reporter and can see that the pause is

Found file system path of

Delay

Found Common name of {Policy no}

 

There are no errors reported just a long time to complete the stage "Found common name of {policy}"

 

The particular machines which are having problems are in multiple locations but all have the same image. Other machines with a different image are fine. Policies are being applied fine with other computers so my guess would be something on the machine itself. Short of re-building the machine from scratch has anyone got any suggestions to try? I've removed/rejoined domain, updated NIC Drivers and still the same thing. Initially it seems the image was OK but something has changed to cause the delay.

[Steve21]

Have you tried the WMI patches at all? https://support.microsoft.com/en-us/kb/2617858 (Bit of a different direction but might be worth a check on one machine?)

 

We had the same kind of issue before that when dirty shutdowns are down it's corrupting the WMI databases and takes 10-15 mins per logon to fix them. As you said either happens at start if GPOs applying, or at logon if no GPOs before.

 

Patch resolves it to 2-3 mins.

 

Would normally show up in the local event logs though that it took ages on WMI

 

Steve

[Oaktech]

Apologies if teaching to suck eggs..

 

Do you have verbose messages turned on in GP so you can see what it is doing?

 

Have you done a manual check for windows updates to make sure something isn't stuck?

 

Just thoughts.

[mikeyd101]

I have noticed an increase in our default domain policy (upto 34000ms), it seems to have increased, now machines are taking a couple of minutes to login. I started drilling into this problem yesterday but got sided tracked with something else.

 

I did recently make a change on our DC to NTLM to increase the number of synchronous logins as were only running with 1 dc atm (other one blew its psu) and receiving lots of login server not available.

 

I started receiving errors from grouppolicy about client side extension software must be applied before login and may result in slow boot. I also noticed loads of 1085 events on dc but these seemed to have cleared up since deleting grouppolicy history yesterday.

 

Im starting to wondering if there wasn't a recent patch that is causing issue we have autodates enabled.

 

Hopefully im going to get into it a bit more today, and i'll report if I find something.

[penfold]

Versbose messaging is on and it gets stuck either on applying computer/User settings. It's basically the first Group policy it hits. I have just noticed there is something not quite right with the image as the windows updates are not configured correctly. But I'm going to run windows updates and I'm also just downloading WMI Hotfix now, as there are a couple of warnings, but none that match the problem. But at this point I'm willing to try anything.

 

I have a feeling something has gone wrong on the image and it will be time to start from scratch.