Group policy printer preferences - Windows 7 - Issue overnight

[eddyc]

Hi all,

 

I am hoping that someone might be able to help me as I am rapidly running out of ideas.

 

We run Windows 7 x64 across the site and have done for some time. We have always deployed our printers using GPP without an issue.

 

Today I have come in and most computers across the site hang on the "Applying Group Policy Printer Preferences" for approximately 10 to 15 minutes before logging in.

 

Nothing has been changed in group policy overnight and this issue has suddenly come on.

 

The print server hasn't been patched for a month either so it isn't a hotfix causing the issue.

 

GPresult /h hangs and takes ages to generate a log file, but does eventually.

 

If I look in the event logs on a local client I get

 

6005: The winlogon notification subscriber is taking long time to handle the notification event (Logon).

 

Then 9 or so minutes later;

 

6006: The winlogon notification subscriber took 581 second(s) to handle the notification event (Logon).

 

If I use item level targeting on the printers and do not apply to my user, I log in in around 1 minute 30 (around 1 minute 10 sat on preparing your desktop).

 

I have rebooted both DCs and the print server. Short of removing all of the mappings to reduce the login times I am running out of ideas.

 

Any suggestions would be gratefully received.

 

Kind regards, Ed

[eddyc]

I should add, we use a follow me printing solution so there is just the two printers - one mono, one colour that is assigned to admins \ staff and student GPOs.

 

It is affecting all three user groups.

 

Thanks, Ed

[Sagima]

I know we moved back to printer script because of the slower logins with gpp but we did notice it was a bit faster if create was changed to update (that might have been the other way around - this is me remembering from two years ago).

I was talking about it adding 30 seconds or so to login time though your problem seem a bit bigger than ours so that may not help noticeably. You might want to check dns (both primary and secondary) is accurate for your dcs and print server or just delete and recreate the gpp that adds the printers.

Edited April 29, 2016 by Sagima
misspelled accurate

[Boredguy]

Hey we have the same issue today... time to go looking at WSUS logs to see what changed....

[Boredguy]

.. doh only Defender updates been applied to our stations this week.

[eddyc]

Hey we have the same issue today... time to go looking at WSUS logs to see what changed....

@Boredguy - Did you find anything interesting? I thought it could be on the print server itself but that hasn't been patched in a month (2012 R2 box).

 

I'm running out of ideas. I did reimage a few machines that now seem okay. In the update history there is nothing recent listed so the puzzle grows.

[broadld]

This is very strange we have exactly the same issue. We have made no changes at all in terms of policy changes, windows updates on clients or servers. What antivirus product do you use? Wondering if an update to that has somehow caused this behaviour. It seems completely random too sometime there is a short delay on logon other times it can be 10 mins plus.

[eddyc]

This is very strange we have exactly the same issue. We have made no changes at all in terms of policy changes, windows updates on clients or servers. What antivirus product do you use? Wondering if an update to that has somehow caused this behaviour. It seems completely random too sometime there is a short delay on logon other times it can be 10 mins plus.

 

We are on Sophos antivirus here.

[broadld]

Yes we have sophos too. Might be a coincidence but thats the only thing i can think of that might of changed in terms of updates that we have not initiated as we are very strict at thorough testing and change control.

[broadld]

I have tested on a couple of machines removing sophos and retrying logging in. With sophos removed the clients login very quick and there is no hang at applying printers. Need to try and work out what is causing this in Sophos. Is anyone else experiencing this issue?

[eddyc]

I have tested on a couple of machines removing sophos and retrying logging in. With sophos removed the clients login very quick and there is no hang at applying printers. Need to try and work out what is causing this in Sophos. Is anyone else experiencing this issue?

 

I have written a batch file that I added as a part of our machine start up script to kill all of the Sophos services to see if the issue disappears.

Sure enough, with the Sophos services stopped, all of the machines return to a normal login time.

I think I will log a call with Sophos in the morning. I am not happy about leaving the machines running with no antivirus so might remove the printers GPO from students as a temporary fix until they can address the issue.

 

The batch file in case anyone is interested contains;

@echo off

net stop "Sophos Agent"

net stop "Sophos Anti-Virus"

net stop "Sophos Anti-Virus status reporter"

net stop "Sophos AutoUpdate Service"

net stop "Sophos Message Router"

net stop "Sophos Network Threat Protection"

net stop "Sophos System Protection Service"

net stop "Sophos Web Control Service"

net stop "Sophos Web Intelligence Service"

net stop "Sophos Web Intelligence Update"

exit

[eddyc]

Oh and the issue is growing - I am now having the issue as domain admin, trying to log into a domain controller. As soon as the Sophos services are stopped remotely, the login unhangs and continues as normal.

[chris_uk]

Can confirm we have the same issue, printers through GPP. Same fix for us, disable Sophos and it logs in normal time. With Sophos enabled it takes forever to login. Appeared on Friday mid afternoon for us as well.

No Windows updates recently, no system changes.

[broadld]

What version of Sophos are people on client side?

[eddyc]

We are on this version

 

[broadld]

If you click view product information the expand software section there should be a longer version number.

 

Mine is 10.6.3.537

 

I have been testing a few things and disabling behaviour monitoring on the Sophos policy seems to have good results. Can anyone else try this to see if it makes login times better. I don't think it resolves the issue completely though.

[eddyc]

If you click view product information the expand software section there should be a longer version number.

 

Mine is 10.6.3.537

 

I have been testing a few things and disabling behaviour monitoring on the Sophos policy seems to have good results. Can anyone else try this to see if it makes login times better. I don't think it resolves the issue completely though.

 

We are also on 10.6.3.537

 

I will try changing the policy and report back.

[broadld]

This is very strange indeed. I wonder if there is any way to fin out when it actually updated? If there is like a Sophos release timeline.

[chris_uk]

Seems like they have released an update, with Sophos enabled it is back to logging in at the usual speed. Check when your server last got an update and also your clients.

[broadld]

We are also on 10.6.3.537

 

I will try changing the policy and report back.

 

Did you try changing this policy? What were the results?

[Boredguy]

The only thing that had updated was Sophos.

 

Had a few stations show the same problem this morning, (different ones to last Friday) and all of them are showing as on the latest version so here is hoping it was just because the staff had just turned the PC's on before Sophos had updated...

[chris_uk]

Seems like they have released an update, with Sophos enabled it is back to logging in at the usual speed. Check when your server last got an update and also your clients.

 

I take this back, the problem is still happening with Sophos enabled.

[eddyc]

Did you try changing this policy? What were the results?

 

 

Seems to be a bit hit and miss. Some machines that were hanging don't but others that weren't hanging now do!

[eddyc]

I have now logged a call with Sophos and will let you know what they say when they come back to me.

[Network_Boy]

I'm also having this issue this morning. Been a nightmare! Clients are Win7 x64. We also have Sophos installed on all clients. We use group policy to deploy printers.

 

Some are hanging on the "Deploying group policy printers" message, others are just sitting with a black screen and the cursor. Black screen ones hang for about 3-4 mins and then log in normally. Printer message clients are taking longer than this and I haven't yet sat there long enough to see whether they eventually log in.

 

Version of Sophos on clients is 10.6.3.537. Our server has updated itself at 11:15 this morning (03/05/2016) and says it's on version 1.5.8.11.

 

Anyone managed to find a fix yet?