none
Processing of Computer branch of GPO on W10 clients

    Question

  • My understanding is that W10 (and I guess, 8.1) fast boot does not process shutdown or startup scripts, push installs etc in GPOs: a restart or shift-shutdown is required before a full boot runs the scripts.  Testing on my one W10 client confirms that repeated restarts do not apply changed policies in GPO Computer Configuration nodes that require foreground processing.

    While fast-boot can be disabled by GPO, I find it strange that MS would not provide the ability to retain the benefits both of the W10 fast start "user experience" and the management capability of computer GPO processing.  Is the W10 client GPO not able to set a flag to force a full reboot when background GPO processing notes a change that require foreground processing?  From https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/22/group-policy-basics-part-3-how-clients-process-gpos/ it seems that the GPO client knows that foreground processing is needed.

    Happy for my ignorance to be pointed out if I'm missing something.  Thanks in advance.

    Friday, March 18, 2016 3:45 PM

Answers

  • Hi,

    Thanks for your reply. I understand that the issue brought some trouble to you. Sorry for all these inconvenience.

    Below is the explanation of this behavior:

    “Starting with Windows 8, Microsoft introduced this notion of "fast boot", where, when you shut down the OS, they hibernate OS memory footprint just like Hibernate works in normal hibernation scenarios. This results in the OS coming up faster, but it also has the side effect of disabling per-computer GP processing on startup.

    If disabling Fast Logon doesn't solve the problem then it is most likely a network stack timing issue, where GP processing for the computer is kicking off before the network stack is fully initialized. This has been around since XP and starting in Windows 7, Microsoft added a policy under Computer Configuration\Policies\Administrative Templates\System\Group Policy\Startup Policy Processing Wait Time where you can increase the time that GP waits before initiating.”

    I am afraid to tell that we cannot make any change to this behavior at this time. But I will watching closely to this issue, If there is any related update, I will let you know.

    Thanks for your understanding.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Andy_of_MERL Thursday, March 24, 2016 9:44 AM
    Tuesday, March 22, 2016 2:58 AM
    Moderator

All replies

  • Hi,

    Thanks for your post.

    Actually, this behavior is pretty commonly seen with software installation and folder redirection policies more than any other. This delay is caused by a “feature” called “Fast Logon Optimization”. This means that group policy is processed at the same time as when the processor is performing other tasks to get the computer booted up into a usable state.

    The solution to this problem is disabling fast logon optimization with another GPO. You can find this setting under Computer Configuration\Administrative Templates\System\Logon. Here, you can enable “Always wait for the network at computer startup and logon”. This could potentially increase the time it takes for your computers to log on, but it will also ensure that group policy gets its chance to be applied.

    More articles for your reference:

    Understand the Effect of Fast Logon Optimization and Fast Startup on Group Policy

    https://technet.microsoft.com/en-us/library/jj573586.aspx

    Control How Group Policy Is Applied At Logon

    https://technet.microsoft.com/en-us/magazine/gg486839.aspx

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 21, 2016 2:42 AM
    Moderator
  • Hi Alvin,

    Appreciate the response. I have had that specific policy set on for a very long time as we have synchronous sign-in scripts.  The issue is the "Fast startup and Group Policy processing" as per the first link above.  IMHO Windows 8.1 and 10 should be able to work out for themselves that a full shut-down is required and to force one to occur: disabling the one feature of W10 that my users think is the only good reason for moving on from W7 wouldbe counter productive.

    Andy

    Monday, March 21, 2016 9:05 AM
  • Hi,

    Thanks for your reply. I understand that the issue brought some trouble to you. Sorry for all these inconvenience.

    Below is the explanation of this behavior:

    “Starting with Windows 8, Microsoft introduced this notion of "fast boot", where, when you shut down the OS, they hibernate OS memory footprint just like Hibernate works in normal hibernation scenarios. This results in the OS coming up faster, but it also has the side effect of disabling per-computer GP processing on startup.

    If disabling Fast Logon doesn't solve the problem then it is most likely a network stack timing issue, where GP processing for the computer is kicking off before the network stack is fully initialized. This has been around since XP and starting in Windows 7, Microsoft added a policy under Computer Configuration\Policies\Administrative Templates\System\Group Policy\Startup Policy Processing Wait Time where you can increase the time that GP waits before initiating.”

    I am afraid to tell that we cannot make any change to this behavior at this time. But I will watching closely to this issue, If there is any related update, I will let you know.

    Thanks for your understanding.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Andy_of_MERL Thursday, March 24, 2016 9:44 AM
    Tuesday, March 22, 2016 2:58 AM
    Moderator
  • Hi,

    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, March 24, 2016 9:39 AM
    Moderator
  • Alvin,

    I think you confirmed what I stated in the first post, and that disabling Fast Start up is the only solution.  Not a happy result, but thanks for your support.

    Andy

    Thursday, March 24, 2016 9:44 AM