gashmore

We can see the registry entry being applied at "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" with registry value "SyncForegroundPolicy"=dword:00000001 We have found you cant enter this manually before joining to a domain as the keys aren't there when its not joined to a domain. I am currently looking at your suggestion of the registry .pol viewer.

Thank you for your post, I have actually tried that and as you say it works, but we have never done this before on any of our previous builds (I build them personally) and it has been working which has us all stumped! Do you experience the same issue of it taking two logons to process software installation settings if this is not changed on the image and only on the domain GP?

We have tried that registry tweak, but alas no change - this is happening on brand new Viglens and other machines of varying ages across site

We have 3COM switches, what is portfast supposed to do? We haven't changed anything else other than raised the domain functional level and changed to DFRS for sysvol, all the DCdiag and repadmin tests result in no issues.

In the past we have had "Always wait for the network at computer startup and logon" set at the default domain policy, this has meant immediately after a machine has been imaged and ran through sysprep the machine reads any MSI installation GPO's and installs them immediately (not after the second reboot) since we upgraded our Domain Functional Level to 2008 R2 (we are still using Win XP SP3 clients) this settings appears to be ignored and is taking 2 or more restarts to install MSI GPO's - We cant seem to track down the issue and have spent hours trying to sort the issue, Win 7 clients (which are in test phase, apply the software installation on first boot into windows) I have tried everything I can think of including: Fresh install from non patched Win XP SP3 Fully patched Windows XP SP3 Isolated test domain with Server 2003 R2 << this is what we had before and it *used* to work! and Server 2008 R2 Domain Functional Level Registry setting to disable mediasense Registry setting to delay the group policy processing (waiting for network card) Remove, re-apply the setting Recreate the policy Delete the OU and recreate Different NIC card/Updated drivers Applied the setting directly on the OU and blocked inheritance All of the above tests result in the machine applying policies *whilst* at the login prompt not delaying the login prompt and processing the software installations first, resulting in two sometimes three reboots needed to install software. We are now looking at paying for Microsoft Support, but I am just wondering what happens with other peoples experience of this setting? Is it only supposed to work after the second reboot and somehow its been working after the first reboot for us? Attached is a screenshot of the error, which to me means its ignoring the setting to disable fast login optimisation, I have also enabled full verbose logging on the client but the userenv.log isnt proving very helpful HELP!