[gptalk] Re: GPO and Login Times

  • From: "Cruz, Jerome L" <jerome.l.cruz@xxxxxxxxxx>
  • To: "gptalk@xxxxxxxxxxxxx" <gptalk@xxxxxxxxxxxxx>
  • Date: Tue, 15 Apr 2008 09:32:42 -0700

Be careful not to trust that the display of the "Applying Security Policies" 
message has much to do with what's going on underneath the hood. Microsoft 
displays only certain messages in that interface. During the time that message 
is displayed, there are many other system services "starting up" whose actions 
are NOT represented in the Windows Logon display. Microsoft's built-in services 
along with other 3rd party services and drivers may behave differently between 
reboots depending upon many factors. Perhaps an anti-virus service is 
initiating an update during one startup session, but not another.

To find out what is really happening, take a look at the detailed GPO logs to 
see how long the various client side extensions are really taking to process 
their settings. Then compare those results to logs from other services and the 
event logs for them as well. You can activate verbose GPO logging on a few test 
systems and/or use tools such as the Event logs or Process Monitor 
(http://technet.microsoft.com/en-us/sysinternals/default.aspx) to perform these 
evaluations. "Then" you'll have a better idea where your time needs to be spent 
investigating.

Here's how to activate verbose GPO logging on Windows XP and earlier devices 
(C:\WINDOWS\Debug\UserMode\UserEnv.Log and in the UserEnv.bak). [Can someone 
post/point to similar for Vista systems (I don't have it handy at the moment).]

Verbose GPO Logging On (Windows XP)
=================================================================================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserEnvDebugLevel"=dword:00030002
=================================================================================

Verbose GPO Logging On (Windows XP)
=================================================================================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserEnvDebugLevel"=dword:00000000
=================================================================================


-----Original Message-----
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On 
Behalf Of Jonathan Finkbiner
Sent: Monday, April 14, 2008 12:05 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: GPO and Login Times

I think one of the biggest issues I am seeing occasionally is an odd
amount of time is spent by certain computers hanging out on the
"Applying Security Settings" aspect of login. It may not be related to
GPO, but I want to try troubleshooting the aspects that I am a little
more familiar with first. Thanks for the help Darren.

Jonathan Finkbiner

-----Original Message-----
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Monday, April 14, 2008 1:19 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: GPO and Login Times

The part of the article that talks about the impact of GPOs that
implement multiple CSEs is important for performance if you make regular
changes to your GPOs. Beyond that the biggest impact will be the  kinds
of things you do in your GPOs. Namely, things like re-permissioning
large file or registry trees can really slow things down. But again
remember that GP does nothing during a given cycle if nothing has
changed, so relatively static environments should not have performance
issues related to GP.

Darren
-----Original Message-----
From: "Jonathan Finkbiner" <JFinkbiner@xxxxxxx>
To: gptalk@xxxxxxxxxxxxx
Sent: 4/14/2008 8:29 AM
Subject: [gptalk] Re: GPO and Login Times

Brown noser.



Just kidding of course. Thank you very much. I am going through it now.



Any other suggestions are appreciated.



Jonathan Finkbiner

________________________________

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of mike kline
Sent: Monday, April 14, 2008 11:17 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: GPO and Login Times



In terms of good reading material Darren's article from the January
issue of TechNet Magazine is the best thing out there in my opinion

http://technet.microsoft.com/en-us/magazine/cc137720.aspx
Optimizing Group Policy Performance


Thanks
Mike




On Mon, Apr 14, 2008 at 10:58 AM, Jonathan Finkbiner
<JFinkbiner@xxxxxxx> wrote:

I am trying to troubleshoot/optimize login times across the network. I
have done some work to our login scripts and I feel like I have them
optimized to the point where they can't be made faster. Since the change
there have been fewer reports of long login times but I have heard, and
observed some of issues still occurring. I was wondering if anyone had
some tips or some good reading material relating to optimizing GPOs for
quick logins. I feel like the GPOs that we have setup here may be the
issue. Maybe I have too many? Maybe I don't have policies grouped
together appropriately? Any help would be appreciated.



Thanks in advance.



Jonathan Finkbiner <mailto:jfinkbiner@xxxxxxx>


[truncated by sender]
***********************
You can unsubscribe from gptalk by sending email to
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR
by logging into the freelists.org Web interface. Archives for the list
are available at http://www.freelists.org/archives/gptalk/
************************

***********************
You can unsubscribe from gptalk by sending email to 
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by 
logging into the freelists.org Web interface. Archives for the list are 
available at http://www.freelists.org/archives/gptalk/
************************
***********************
You can unsubscribe from gptalk by sending email to 
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by 
logging into the freelists.org Web interface. Archives for the list are 
available at http://www.freelists.org/archives/gptalk/
************************

Other related posts: