locked
Winlogon Event 6005 and slow logon RRS feed

  • Question

  • Dear All,

    in the last days, on several machines the logon process takes too long time.

    In the Application event log, is reported this warning:

    The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (Logon).

    There is a way to fix this problem?

    Tuesday, April 1, 2014 6:33 PM

Answers

  • Hi,

    Sorry for my late response.

    How is the result of the long logon process after you move to a new environment?

    Meanwhile, please run this Hotfix for these problematic computers:

    Unexpectedly slow startup or logon process in Windows Server 2008 R2 or in Windows 7

    http://support.microsoft.com/kb/2617858


    Karen Hu
    TechNet Community Support

    • Marked as answer by 暁北 Monday, April 14, 2014 1:30 PM
    Wednesday, April 9, 2014 2:35 AM

All replies

  • Hi,

    Was your computer in the domain environment?

    If yes,  move your computer to a test OU that doesn't have any GPO's applying to it and then link them one by one until you locate the one that contain the problem settings (and run gpupdate /force between each reboot to make sure the GPO's are reapplied at reboot).

    Meanwhile, please refer to the following article:

    http://www.hass.de/content/applying-software-gpo-takes-20-minutes-and-times-out-rodc-site

    If no, follow this blog to get Gpsvc.log file to help identify further which settings in the problem policy are taking a long time.

    http://blogs.technet.com/b/mempson/archive/2010/01/10/userenvlog-for-windows-vista-2008-win7.aspx


    Karen Hu
    TechNet Community Support

    Wednesday, April 2, 2014 7:17 AM
  • I will try to move 1 PC to a new GPO.

    Also, on serveral machines, there are a lot of WMI error 63 like this:

    Windows Management Instrumentation (WMI) Service is starting to restore the WMI repository

    A provider, AMTProvisionProvider, has been registered in the Windows Management Instrumentation namespace root\CCM to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

    A provider, PolicyReplicationConsumerProvider, has been registered in the Windows Management Instrumentation namespace root\ccm\policy to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

    Also a lot of WMI error 24 like this:

    Event provider $Core attempted to register query "select * from __SystemEvent" whose target class "__SystemEvent" in //./root/cimv2 namespace does not exist. The query will be ignored.

    One for each application that uses WMI.

    ay that these errors has appeared after latest windows updates.

    Wednesday, April 2, 2014 11:00 AM
  • Hi,

    Sorry for my late response.

    How is the result of the long logon process after you move to a new environment?

    Meanwhile, please run this Hotfix for these problematic computers:

    Unexpectedly slow startup or logon process in Windows Server 2008 R2 or in Windows 7

    http://support.microsoft.com/kb/2617858


    Karen Hu
    TechNet Community Support

    • Marked as answer by 暁北 Monday, April 14, 2014 1:30 PM
    Wednesday, April 9, 2014 2:35 AM
  • Hi,
    I have investigated on other machines with same problems, and also installing the Hot Fix, some machines had continued taking a lot o time to logon.
    Looking at the event log, I seen 2 warning related to event id 65 and 66.
    Looking around the web, I found other people with same errors and something related to the SCCM client 2012.
    Now, on these PC there is the SCCM client 2012, so I removed it on one PC and at the following reboot, the logon process has been very faster.
    I will inform you if the problem is fixed also for the other PCs.

    Monday, April 14, 2014 2:25 PM