John- 20 seconds is not unheard of for something like IE maintenance. You can actually drill into the time taken within IE maintenance further by using its trace log, which you should find for a given user under %userprofile%\Application Data\Microsoft\Internet Explorer\brndlog.txt. That file should show exactly what is happening during IE Maintenance processing. As for the other error, that looks very much like a DNS issue, where the correct DNS names are not being found and the machine is defaulting to NTLM authentication. Does this happen on more than one client ? If so, then I would suspect DNS on the server side. If not, then something with this client. Maybe run DCDiag from the client and see if it shows any issues. Or try using netdom to test the client's secure channel connection to the domain. Maybe you just need to re-join the machine to the domain. Darren -----Original Message----- From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of John Bateman Sent: Tuesday, June 10, 2008 6:50 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Understanding GP Processing Hi, As some of you may know I've been posting a lot lately, mostly in relation to login times. I've been examining the userenv.log and am trying to understand why certain extensions take longer to process. I am also seeing a few errors which I'm not sure are causing an issue, are normal or maybe to blame for the longer processing times. For instance here is part of a log: USERENV(50c.bac) 08:55:35:513 ProcessGPOs: Processing extension Internet Explorer Branding USERENV(50c.bac) 08:55:35:513 ReadStatus: Read Extension's Previous status successfully. USERENV(50c.bac) 08:55:35:513 CompareGPOLists: The lists are the same. USERENV(50c.bac) 08:55:35:513 ProcessGPOList: Entering for extension Internet Explorer Branding USERENV(50c.bac) 08:55:35:513 UserPolicyCallback: Setting status UI to Applying Internet Explorer Branding policy... USERENV(50c.bac) 08:55:35:528 LogExtSessionStatus: Successfully logged Extension Session data USERENV(50c.bac) 08:55:40:787 ImpersonateUser: Failed to impersonate user with 5. USERENV(50c.bac) 08:55:40:787 GetUserNameAndDomain Failed to impersonate user USERENV(50c.bac) 08:55:40:803 GetUserDNSDomainName: Domain name is NT Authority. No DNS domain name available. USERENV(50c.acc) 08:55:41:394 PolicyChangedThread: Leaving USERENV(50c.bac) 08:55:42:576 ImpersonateUser: Failed to impersonate user with 5. USERENV(50c.bac) 08:55:42:576 GetUserNameAndDomain Failed to impersonate user USERENV(50c.bac) 08:55:42:576 GetUserDNSDomainName: Domain name is NT Authority. No DNS domain name available. USERENV(330.4ec) 08:55:46:502 LibMain: Process Name: C:\WINDOWS\system32\rundll32.exe USERENV(654.674) 08:55:48:048 LibMain: Process Name: C:\Program Files\Novadigm\AXF\Bin\XFSrvcNT.Exe USERENV(3e0.6e8) 08:55:52:580 LibMain: Process Name: c:\windows\system32\wscript.exe USERENV(50c.bac) 08:55:55:809 UserPolicyCallback: Setting status UI to Applying your personal settings... USERENV(50c.bac) 08:55:56:066 UserPolicyCallback: Setting status UI to Applying your personal settings... USERENV(50c.bac) 08:55:56:066 ProcessGPOList: Extension Internet Explorer Branding returned 0x0. USERENV(50c.bac) 08:55:56:066 ProcessGPOList: Extension Internet Explorer Branding was able to log data. RsopStatus = 0x0, dwRet = 0, Clearing the dirty bit As you can see the Internet Explorer Branding policy started at 8:55:35:513 according to the log and didn't finish until 8:55:56:066. That's over 20 seconds to apply this extension and the policy which has the IEB settings does not contain a great deal of IEB settings. This part here is also concerning: USERENV(50c.bac) 08:55:40:787 ImpersonateUser: Failed to impersonate user with 5. USERENV(50c.bac) 08:55:40:787 GetUserNameAndDomain Failed to impersonate user USERENV(50c.bac) 08:55:40:803 GetUserDNSDomainName: Domain name is NT Authority. No DNS domain name available. A net helpmsg 5 indicates 5 is access denied, however I'm not sure in what this means in this context. Can someone please shed some light on this supposed error? *********************** You can unsubscribe from gptalk by sending email to gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by logging into the freelists.org Web interface. Archives for the list are available at //www.freelists.org/archives/gptalk/ ************************ *********************** You can unsubscribe from gptalk by sending email to gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by logging into the freelists.org Web interface. Archives for the list are available at //www.freelists.org/archives/gptalk/ ************************