none
Users have to logon and off twice before gpo will map drives

    Question

  • I've been reading about GPOs vs login scripts and thought I would give it a try. It works for the most part, but users have to logon and off twice before the gpo for mapped drive/printers works. Not sure what to do. I tried gpupdate /force, throwing it under the domain, and users. Thanks in advanced.
    Tuesday, June 07, 2016 6:03 PM

Answers

  • Hi,

    Thanks for your post.

    The issue seems to be caused by a delay in initializing network and locating domain controllers. Enabling "Always wait for the network at computer startupand logon" via group policy should resolve it as we need to give system more time to initiate network before proceeding with the logon process.

    We could also enable "
    startupPolicy Processing Wait Time" and setting wait time to an appropriate value to let the software installation GPOs working with minimal boot delays. We could know the accurate policy processing time via the Group Policy Operational Log Event. Please refer to the following article to get more details:

    Optimizing Group Policy Performance

    https://technet.microsoft.com/en-us/magazine/2008.01.gpperf.aspx
    There are two ways to enable this option:

    Group Policy
    Computer Configuration > [Policies] > Administrative Templates > System >Group Policy > Startup Policy Processing Wait Time – Enable the option and set wait time to 10 - 60 seconds
    Note 1: This option is only supported by Windows Vista and later clients and may be not present on Server 2003 domain controllers
    Note 2: Group policy description tells that the default wait time is 30 seconds, which obviously raises the question how setting time-out to less than 30 seconds can fix the problem. It seems that default 30 seconds interval is not always used and Windows often employs its own algorithms to calculate the time-out (if it's not enforced by Group Policy or Registry)

    Registry
    On Client Computer:

    1. Start > Regedit.exe

    2. Navigate to  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

    3. Create New DWORD value with name GpNetworkStartTimeoutPolicyValue and set Value data (decimal) to the required timeout interval in seconds

    4. Restart the computer

    More articles for your reference:

    Understand the Effect of Fast Logon Optimization and Fast Startup on Group Policy

    https://technet.microsoft.com/en-us/library/jj573586.aspx

    Control How Group Policy Is Applied At Logon

    https://technet.microsoft.com/en-us/magazine/gg486839.aspx

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 08, 2016 5:49 AM
    Moderator

All replies

  • depending upon your scenario (and the timing of things), this is to be expected.

    do you users typically logoff or shutdown at the end of each day?

    do you have periodic/background GP refresh enabled and the period set to a useful value?

    one cycle will cause the client machine to detect that there are new GPOs to be processed, and the second cycle will actually execute the newly acquired settings (map the drive)

    the first cycle can be assumed to occur via background refresh (or at the normal start-of-day startup/logon), depending upon your environment/scenario


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Tuesday, June 07, 2016 9:40 PM
  • Hi,

    Thanks for your post.

    The issue seems to be caused by a delay in initializing network and locating domain controllers. Enabling "Always wait for the network at computer startupand logon" via group policy should resolve it as we need to give system more time to initiate network before proceeding with the logon process.

    We could also enable "
    startupPolicy Processing Wait Time" and setting wait time to an appropriate value to let the software installation GPOs working with minimal boot delays. We could know the accurate policy processing time via the Group Policy Operational Log Event. Please refer to the following article to get more details:

    Optimizing Group Policy Performance

    https://technet.microsoft.com/en-us/magazine/2008.01.gpperf.aspx
    There are two ways to enable this option:

    Group Policy
    Computer Configuration > [Policies] > Administrative Templates > System >Group Policy > Startup Policy Processing Wait Time – Enable the option and set wait time to 10 - 60 seconds
    Note 1: This option is only supported by Windows Vista and later clients and may be not present on Server 2003 domain controllers
    Note 2: Group policy description tells that the default wait time is 30 seconds, which obviously raises the question how setting time-out to less than 30 seconds can fix the problem. It seems that default 30 seconds interval is not always used and Windows often employs its own algorithms to calculate the time-out (if it's not enforced by Group Policy or Registry)

    Registry
    On Client Computer:

    1. Start > Regedit.exe

    2. Navigate to  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

    3. Create New DWORD value with name GpNetworkStartTimeoutPolicyValue and set Value data (decimal) to the required timeout interval in seconds

    4. Restart the computer

    More articles for your reference:

    Understand the Effect of Fast Logon Optimization and Fast Startup on Group Policy

    https://technet.microsoft.com/en-us/library/jj573586.aspx

    Control How Group Policy Is Applied At Logon

    https://technet.microsoft.com/en-us/magazine/gg486839.aspx

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 08, 2016 5:49 AM
    Moderator
  • Thank you for the help! Enabling Always wait for the network at computer startup and logon seemed to do the trick.
    Wednesday, June 08, 2016 6:43 PM
  • Hi,

    I am glad to hear that the information is helpful to you. If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 10, 2016 1:53 AM
    Moderator