locked
Elevated programs hang for 10 seconds before Account Control Message appears RRS feed

  • Question

  • Hello all,

    after some changes to Security settings of folders within a "user" (with admin rights) directory tree, all programs, that have been setup to start elevated hang for 10 seconds or more before the programs start executing. During the "hang" there is only minimal disk and CPU activity. The AppData tree was also affected by the Security Settings changes. So Security settings might be the reason for the problem. But they look quit normal with "Full Control" given to the the owning user and groups Administrators and System.

    The system is W7 x64 Ultimate with actual maintenance. Windows and all applications reside on Intel SSDs. I already tried switching off virus scanner and the like. No change. Programs w/o elevation start fast. Disk mark shows unchanged performance.

    Some more observations:

    1. All functions protected with Account Control seem to be slow.
    2. Only the Account where the Security Settings were changed hangs. Other account show the elevation message promptly.
    3. After having done some more "research" I suppose that the consent.exe process hangs for 5 - 7 seconds after accessing ...\My\Certificates in the HKCU hive. I used Sysinternals ProcMon to trace that and the hang seems to be reproducible.

    Ideas how to fix that or for additional investigation are very welcome.


    Regards Uwe



    • Edited by Jörg Debus Wednesday, April 10, 2013 6:19 PM
    Tuesday, April 2, 2013 6:29 PM

Answers

  • Hello folks,

    after some hours of tracing and analyzing with the great ProcMon from Sysinternals, I'm now able to present an answer to the problem reported in my original post:

    The UAC-process hung for 7 seconds after repetitive tries to perform an  IRP_MJ_CREATE filesystem call from SYSTEM user to create a container for one certificate (C:\Users\....\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E...EE) which was already there and should be replaced with new content. Because of bad security properties of the file, the access was denied. After setting those properties to proper values, the hung has disappeared and the UAC-prompt works as snappy as before the problem. This also explains, why other accounts did not experience a similar hung.

    Only the programmer who wrote that piece of code will know, why consecutive "Access Denied" results hang a process after the third for 1, then 2 and then 5 seconds instead of a real message to the logs. This added up to 17 seconds total "hanging-time" for the whole UAC-process regardless of what function was selected to elevate. Now 'm back to 1 second again :-))

    19:47:14,9511817 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.3129171 0.0000264
    19:47:14,9604167 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.3221521 0.0000249
    19:47:14,9760133 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.3377487 0.0000258
    19:47:15,0853084 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.4470438 0.0000441
    19:47:15,6001887 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.9619241 0.0000648
    19:47:16,6141562 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:02.9758916 0.0000660
    19:47:21,6216855 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:07.9834209 0.0000663

    I hope that this post may also help others with similar symptoms.


    Regards Uwe


    • Edited by Jörg Debus Thursday, April 11, 2013 1:47 PM Typos
    • Marked as answer by Jörg Debus Thursday, April 11, 2013 1:48 PM
    Thursday, April 11, 2013 1:46 PM

All replies

  • Hi,

    Please check out this article:

    Why Does It Take So Long to See the UAC Prompt Sometimes? (Diagnosing Slow UAC Prompts)

    Hope the information helps.


    Tracy Cai
    TechNet Community Support

    Wednesday, April 3, 2013 7:34 AM
  • Hi Tracy,

    thanks a lot for this hint. Unfortunately my symptoms are totally different:

    1. The problem started after I changed Security Settings in the AppData user-tree,
    2. All elevated functions (those with the little shield on the icon) and even the smallest EXEC have the same hanging time and they hang each time when called.
    3. The hangs disappear when I configure NO-UAC.
    4. The hang appears only within the one user (additional admin) where I fiddled around with the AppData Security Settings.

    So I think the problem clearly originates from the UAC components and something is waiting for a timeout in there.


    Regards Uwe


    • Edited by Jörg Debus Wednesday, April 10, 2013 6:15 PM
    Wednesday, April 3, 2013 7:52 AM
  • Hello folks,

    after some hours of tracing and analyzing with the great ProcMon from Sysinternals, I'm now able to present an answer to the problem reported in my original post:

    The UAC-process hung for 7 seconds after repetitive tries to perform an  IRP_MJ_CREATE filesystem call from SYSTEM user to create a container for one certificate (C:\Users\....\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E...EE) which was already there and should be replaced with new content. Because of bad security properties of the file, the access was denied. After setting those properties to proper values, the hung has disappeared and the UAC-prompt works as snappy as before the problem. This also explains, why other accounts did not experience a similar hung.

    Only the programmer who wrote that piece of code will know, why consecutive "Access Denied" results hang a process after the third for 1, then 2 and then 5 seconds instead of a real message to the logs. This added up to 17 seconds total "hanging-time" for the whole UAC-process regardless of what function was selected to elevate. Now 'm back to 1 second again :-))

    19:47:14,9511817 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.3129171 0.0000264
    19:47:14,9604167 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.3221521 0.0000249
    19:47:14,9760133 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.3377487 0.0000258
    19:47:15,0853084 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.4470438 0.0000441
    19:47:15,6001887 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:01.9619241 0.0000648
    19:47:16,6141562 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:02.9758916 0.0000660
    19:47:21,6216855 consent.exe 3692 IRP_MJ_CREATE	C:\Users\...\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5E..EE ACCESS DENIED 00:00:07.9834209 0.0000663

    I hope that this post may also help others with similar symptoms.


    Regards Uwe


    • Edited by Jörg Debus Thursday, April 11, 2013 1:47 PM Typos
    • Marked as answer by Jörg Debus Thursday, April 11, 2013 1:48 PM
    Thursday, April 11, 2013 1:46 PM