locked
Windows 7 delay logon RRS feed

  • General discussion

  • Hi,

    We are facing slow login performance on all Windows 7 machine. After analyzing I observed the following events logged on some common(Delay logon) systems.

    As soon as the user enters the credentials below are the events logged one after another.

    Log Name:      System
    Source:        EventLog
    Date:         11:52:52 AM
    Event ID:      6005
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      hostname.domain.com
    Description:
    The Event log service was started.

    Log Name:      System
    Source:        e1cexpress
    Date:          11:52:52 AM
    Event ID:      27
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      HostName.Domain.com
    Description:
    Intel(R) 82579LM Gigabit Network Connection
     Network link is disconnected.

    Even though the LAN cable was plugged in the event has been generated.

    Log Name:      System
    Source:        NETLOGON
    Date:          11:53:00 AM
    Event ID:      5719
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      HostName.Domain.com
    Description:
    This computer was not able to set up a secure session with a domain controller in domain "Domain" due to the following:
    There are currently no logon servers available to service the logon request.
    This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. 

    ADDITIONAL INFO
    If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

    Followed all the steps except the 5th one as per http://support.microsoft.com/kb/938449

    Log Name:      System
    Source:        Microsoft-Windows-Time-Service
    Date:          11:53:07 AM
    Event ID:      129
    Task Category: None
    Level:         Warning
    Keywords:     
    User:          LOCAL SERVICE
    Computer:      HostName.Domain.com
    Description:
    NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The entry is not found. (0x800706E1)

    I guess since the PDC is not able to communicate this event could occur.

    Log Name:      System
    Source:        Microsoft-Windows-GroupPolicy
    Date:          04/09/12 11:53:57 AM
    Event ID:      1129
    Task Category: None
    Level:         Error
    Keywords:     
    User:          Domain\UserName
    Computer:      HostName.Domain.com
    Description:
    The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

    Obviously if DC / DNS resolution / Time Sync / GPO FRS is nto available to client systems would have the event logged. I tried doing "PortFast" feature on Switch port where the system was connected and that didn't worked.

    Log Name:      Application
    Source:        SceCli
    Date:          11:55:49 AM
    Event ID:      1202
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      HostName.Domain.com
    Description:
    Security policies were propagated with warning. 0x534 : No mapping between account names and security IDs was done.

    Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".

    Error 0x534 occurs when a user account in one or more Group Policy objects (GPOs) could not be resolved to a SID.  This error is possibly caused by a mistyped or deleted user account referenced in either the User Rights or Restricted Groups branch of a GPO.  To resolve this event, contact an administrator in the domain to perform the following actions:

    We observed on User ID on GPO was added in to the option Logon As a Service but that user is nowhere in the Active Directory that's was it is not able to resolve as per the winlogon.log

    Log Name:      System
    Source:        Microsoft-Windows-GroupPolicy
    Date:          11:55:49 AM
    Event ID:      1502
    Task Category: None
    Level:         Information
    Keywords:     
    User:          SYSTEM
    Computer:      HostName.Domain.com
    Description:
    The Group Policy settings for the computer were processed successfully. New settings from 7 Group Policy objects were detected and applied.

    After few seconds there comes the events which states Network link is disconnected and above Group Policy objects were detected and applied.

    These system was able to login after approx. 5 mins but there are few systems when they enter the credentials the cursor keepings on moving and after 25-30 mins later it logs in, the user if logs in to other system he gets in less than minute or 2 but on the same system it takes long time(Approx 25-30 Mins).

    So further by renaming the user profile on the same system it worked very good but the problem is to understand was renaming the profile is solution to delay login and if yes what made it to got corrupted and what are the proactive steps/montioring required to avoid such scenarios.

    Thanks in Advance - Charles

    Tuesday, September 11, 2012 6:32 AM

All replies

  • Hi,

    You could refer to the following article to enable the spanning tree "portfast" setting on the switch:

    A “Netlogon event ID 5719” event message is logged when you start a Windows based computer

    http://support.microsoft.com/kb/247922

    Meanwhile, this would be related to the NIC card, please install the original driver from the computer CD.

    In addition, please refer to this link:

    Intel 82579V Issue

    http://communities.intel.com/thread/20429

    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    Alex Zhao

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Alex Zhao

    TechNet Community Support

    Wednesday, September 12, 2012 6:49 AM
  • Hi Alex,

    I did tried the port fast option as mentioned earlier - KB938449

    For some reason I did not look(as the firmware were common on affected and non-affected systems) at NIC driver but definitely have gone through the Intel thread as you mentioned. (I could see issues on both 100Mbps / 1Gbps systems, System Model - Dell Optiplex 390)

    I was wondering when I recreate the user profile works fine.  I would like to know(if any) what made the user to login as smoothly by recreating the profile and I do not see any events series as mentioned above further on the resolved calls at this moment.



    Wednesday, September 12, 2012 1:33 PM
  • Hi,

    It’s hard to say which part has gone wrong,  but you could get a look on the several factors cause slow logon:

    http://blogs.technet.com/b/askds/archive/2009/09/23/so-you-have-a-slow-logon-part-1.aspx

    http://blogs.technet.com/b/askds/archive/2009/09/24/so-you-have-a-slow-logon-part-2.aspx


    Alex Zhao

    TechNet Community Support

    Friday, September 14, 2012 7:26 AM
  • Thanks for the links.

    Truly speaking I realised later while reading the post, most of the troubleshooting steps I've been already performing to get the cause but wasn't able to conclude until I renamed the user profile.

    Just to add the same event series was also observed in Dell Latitude laptop E6420.

    Do you want to focus or hightlight on renaming user profile / points that affects / reason it gets corrupted so that I can have a look on that areas as well to see any signs.

    At the same time I do not confirm you that I have gone through ALL the steps as mentioned by the author in just 2 days from his experience / troubleshooting steps which Bob has gone through :)

    Friday, September 14, 2012 2:58 PM
  • Hi,

    As for my experience, I would suggest to  look into the following group policy:

    Computer Configuration\Administrative Templates\System\User Profiles\Set maximum wait time for the network if a user has a roaming user profile or remote home directory

    And change the status of  Network List Services service from "manual" to "automatic" and reboot the computer.


    Alex Zhao

    TechNet Community Support

    Monday, September 17, 2012 9:58 AM
  • Hi Alex,

    I was parallelly checking with Dell Support team for the link disconnection event id and I have tested in few systems by updating the network drivers.

    Now the N/w event id(1)  is stopped occuring but other events after that 5719/129 and so on still appears. (Dell Optiplex Desktops)

    Log Name:      System
    Source:        RTL8167
    Date:          20/09/12 11:34:20 AM
    Event ID:      1
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      HostName.Domain.com
    Description: Realtek PCIe GBE Family Controller is disconnected from network.

    The Laptops am looking for the updated drivers from Dell for event id 27. (e6420 model)

    I have gone through your suggestions but want to apply it somewhat at later stage & will update you further.

    Tuesday, September 25, 2012 12:57 PM
  • I wanted to chime-in and mention that we're seeing the NETLOGON event 5719 messages (along with a GroupPolicy event 1129) on roughly 100 OptiPlex 390's installed in August. These machines were installed on switch ports that were previously hosting Windows XP-based machines that weren't having problems. Spanning-tree "portfast" is enabled on these ports. Windows XP machines and other Windows 7-based machines (OptiPlex 320/360/380 machines) connected to the same switches aren't having problems. I'm tending toward blaming the crappy RealTek NIC that Dell has started using on these machines but I can't yet say for certain.

    So far, the only troubleshooting we've done is to set the "DisableDHCPMediaSense" setting, which has not resolved the issue (this has always been my "go-to" setting to change in the past w/ these kinds of problems on Windows XP, typically with RealTek NICs). We're looking into updating the NIC drivers next and possibly the hotfix in http://support.microsoft.com/?kbid=2459530 (we are using a non-Microsoft DHCP relay agent on these machines).

     



    • Edited by Evan Anderson Friday, September 28, 2012 11:37 AM Added hotfix reference back
    Friday, September 28, 2012 11:31 AM
  • We're finding that installing the hotfix for KB 2459530 is causing Group Policy to apply properly in our environment. We're using the DHCP relay functionality of Dell PowerConnect 6200-series switches, and the computers experiencing problems were our first Windows 7 machines deployed on subnets that used this DHCP relay functionality. (Our prior Windows 7 deployments did not seem to have these problems but, coincidentally, were computers on the same subnet as the DHCP servers.)

    Sunday, October 7, 2012 8:56 PM