GPO Processing -Allways wait for the network at computer startup - What do you choose

leonard.powers · July 22, 2010

Hi All,

We're using Windows XP SP3 and are experiencing very long boot times. I've managed to narrow it down to our GPO for "Allways wait for the network at computer startup / logon".

We currently enable this option. This has worked well since all our GPO's will be processed as we would expect before logon. However things have moved on since I implemented this over 4 years ago. We use Scriptlogic as our login script processor and this can do pretty much anything we want in terms of mapping drives, printers, running software etc.

With the option enabled as I said above, our boot times from powering on to displaying the Ctrl Alt Del page was 4mins 10 secs on an Dell Latitude D530 laptop (2GB Ram).

If I disable that option, the boot time decreases to an impressive 35 seconds. A significant difference.

I understand that if I move to this setting certain GPO's might take 2 reboots before they become active. My question is;

1) What do you do? Do you wait for the network or let the GPO's process in the background?

2) Any gotcha's I need to watch out for if I move to this quicker boot. I know that if a students profile doesn't exist, their login will take longer first time around.

Many thanks for any help you can give.

Regards

Leonard

srochford · July 22, 2010

I'd really want to look at what it is about your GPOs which is taking so long - you really want them to complete quickly rather than letting them carry on in the background.

sted · July 22, 2010

you havnt got a script being applied with a pause command in it have you?.. M ight be worth setting startup scripts to visible and enabling verbose messages computer config\admin templates\system i believe

sparkeh · July 22, 2010

If I disable that option, the boot time decreases to an impressive 35 seconds. A significant difference.

Sure but you have to ask yourself what settings have actually been applied in that 35 secs? Allowing someone login before all the security settings have been applied is (in my book) not a great idea.

1) What do you do? Do you wait for the network or let the GPO's process in the background?

*always* wait for network. Before I started here the previous incumbent left this unset and the pupils knew they could login and quickly make a mess of things before all the restrictions were in place. Once this was altered they couldn't do that anymore

Brpilot99 · July 22, 2010

My kids would be climbing up the wall waiting for 4 mins login times ... Mine is enabled and my boot times are 5-10 seconds. I have the DNS settings in the workstations pointing at the local domian DNS server (makes a big difference in login times) and mandatory profiles. Is it the domain policy or one of your own thats causing the problem? try disabling all gpo's exept the default domain policy and work upwards from there by reenabling a policy at a time until you identify the one thats taking the time ... (it could be the default domian policy of course)

sted · July 22, 2010

you havnt got dns pointing at your isp servers have you rather than using dns forwarding on the server?

July 22, 2010

Always wait is enabled - and probably always will be.

Before this was enabled we were getting issues reported (can't remember exactly what they were as this was a long time ago) that were down to XP not being fully ready when the user was logged in.

ICT_GUY · July 22, 2010

We had amazingly long login times due to redirected start menus with broken shortcuts.

Cools · July 22, 2010

Allways wait for the network at computer start-up - i turned it off and the login went from 10min to 2min.. been testing with samba PDC login time 10 sec.. but not a viable option

sparkeh · July 22, 2010

Allways wait for the network at computer start-up - i turned it off and the login went from 10min to 2min.

10 mins!

There has to be something up with that surely?

My CC4 school can boot and login and be working in much less than that, and that's saying something.

Cools · July 22, 2010

had it all checked and tested the GOPs take so long on 2008 Logs are all fine DNS is fine the DHCP is Fine.. , it just takes 10 min.. will have to install 2008 R2 and upgrade form 2008.. unless any can help with any ideas... im up grading to 8g ram in the server from 4GB as the DNS is eating 200MB at a time. ?? that's not right i know, even my perv company server DNS don't eat that much ram..

i have all the computers in the school WOL at 8 am.

July 22, 2010

had it all checked and tested the GOPs take so long on 2008 Logs are all fine DNS is fine the DHCP is Fine.. , it just takes 10 min.. will have to install 2008 R2 and upgrade form 2008.. unless any can help with any ideas... im up grading to 8g ram in the server from 4GB as the DNS is eating 200MB at a time. ?? that's not right i know, even my perv company server DNS don't eat that much ram..

i have all the computers in the school WOL at 8 am.

That is horrendous!

How many GPO's apply?

Do you use filtering?

Do you disable Computer / User settings if the policies only apply to the opposing option?

Did your testing narrow it down to a particular one?

Cools · July 22, 2010

i have 29 GPOs (not all of them are used.) just what's listed next.

1 x for all users and extra ( sets basic set-up) 1 for staff (icons and power man) 1 x for students (same as staff and restriction settings) , User settings

1 x all computers 1x staff and 1 x students , Computer Settings

Do you use filtering?

No

*** Do you disable Computer / User settings if the policies only apply to the opposing option? *** Yes i have done this.

testing did not narrow down any thing every thing worked fine..

im now going to disable the GPOs and rebuild them with fresh ones..

July 22, 2010

Did your testing show which policy took the longest to apply though? They may work but it sounds like something is timing out but not causing a fatal error.

So for boot up you have two policies applying to computers, and logging in two policies applying to users.

Filtering should be avoided if at all possible, good news there you aren't using it.

Good practice with disabling the unused settings.

Cools · July 22, 2010

I will run a test to see what ones takes the longest i cant remember off hand..

July 22, 2010

I will run a test to see what ones takes the longest i cant remember off hand..

Good place to start, then you can rebuild that one first and see if there's any improvement.

ricki · July 22, 2010

Hi

I dont know if this will help but I have come across a couple of things in the last 12 months that will cause this.

When I have a server go off line we get this because either a script or a group policy is looking for a server that is not accessible. The machine then spends ages looking for the server and eventually gives up. This does have the cause that startup and log on times can be huge, but it also causes the problem that group policies dont apply correctly.

Have a look at all your group policies and scipts and look for things pointing at the wrong place.

Have a look in the event viewer and see if it has anything. This can lead you to shares being pointed at the correct place but permissions on files and shares set wrong.

Do you point redirects and paths through DFS if so point them directly at the share. DFS can be broke and cause all sorts of hastle.

Have a look at DNS and dhcp and check all the entries are correct. For example say you replaced a server in the past and did not set the DNS ips to the new server it will have to wait a bit for the computer to try the next one.

Have a look at replication on the servers and check its all working.

Try dcdiag and netdiag and see if errors come up.

Good luck with this one.

Richard

Cools · July 22, 2010

I disabled student user GPO and and reset it up from Base line GPO now its 3 min from boot.. that's better..

I did not enable all the GOP settings as some are not needed any more..

I did migrate from 2003 to 2008 so it must have picked up a BUG.. Well I was rushing last yr to get it up and running.

see if can get it faster..

I got my students roaming profile down to only 1.43mb

ricki · July 22, 2010

Hi

Sorry I forgot is this on all of the network or just part or just one. I have had it in the past where a switch is wonki and needs rebooting or replacing.

Richard

July 22, 2010

I disabled student user GPO and and reset it up from Base line GPO now its 3 min from boot.. that's better..

That's a nice improvement.

Mr.Ben · July 22, 2010

Have you looked at the policy that allows sycronous or asyncronous GPO processing?

As I understand it, the wait for network GPO literally waits until it has confirmed it's IP then gets on with it.

If you process the policies async, The GPO processing can occur after login (although software installation before login still works), giving the users the impression that logon is quick. Once the GPO's have been processed once they will stick around until you change them.

Whiterussian · July 22, 2010

Hi Guys,

The first thing I would check is which DC is authenticating the workstation. To check which Server has authenticated the workstation you can use the LOGONSERVER environment variable. To list the environment variables use the SET command from DOS prompt (CMD).

e.g. LOGONSERVER=SERVER1

If this DC in not the local machine you will need to check that all your subnets are configured correctly in sites and services.

Option 2

--------

Mark Russinovich has a good blog entry which details how to use Process Explorer to identify processes that might be taking excessive amounts of time to execute. (The Case of the Slow Logons)

Sorry I cant post links because this is my first post

Good luck.

SpuffMonkey · July 22, 2010

There's a patch for XP SP3 that fixes a login problem (usually after a password change) that really slows down logins - sorry - can't remember the link at the mo

Cools · July 22, 2010

Netdiag.exe tool has been deprecated in Vista and Windows Server 2008. It's not supported.

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

Home Server = DARKSTAR

* Identified AD Forest.

Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\DARKSTAR

Starting test: Connectivity

......................... DARKSTAR passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\DARKSTAR

Starting test: Advertising

......................... DARKSTAR passed test Advertising

Starting test: FrsEvent

......................... DARKSTAR passed test FrsEvent

Starting test: DFSREvent

......................... DARKSTAR passed test DFSREvent

Starting test: SysVolCheck

......................... DARKSTAR passed test SysVolCheck

Starting test: KccEvent

......................... DARKSTAR passed test KccEvent

Starting test: KnowsOfRoleHolders

......................... DARKSTAR passed test KnowsOfRoleHolders

Starting test: MachineAccount

......................... DARKSTAR passed test MachineAccount

Starting test: NCSecDesc

......................... DARKSTAR passed test NCSecDesc

Starting test: NetLogons

......................... DARKSTAR passed test NetLogons

Starting test: ObjectsReplicated

......................... DARKSTAR passed test ObjectsReplicated

Starting test: Replications

......................... DARKSTAR passed test Replications

Starting test: RidManager

......................... DARKSTAR passed test RidManager

Starting test: Services

......................... DARKSTAR passed test Services

Starting test: SystemLog

An Warning Event occurred. EventID: 0x800007DC

Time Generated: 07/22/2010 14:36:09

EvtFormatMessage failed, error 15100 Win32 Error 15100.

(Event String (event log = System) could not be retrieved, error

0x3afc)

An Error Event occurred. EventID: 0xC0000010

Time Generated: 07/22/2010 15:09:58

EvtFormatMessage failed, error 15100 Win32 Error 15100.

(Event String (event log = System) could not be retrieved, error

0x3afc)

......................... DARKSTAR failed test SystemLog

Starting test: VerifyReferences

......................... DARKSTAR passed test VerifyReferences

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom