locked
Windows 10 experiencing very slow login times in domain environment RRS feed

  • Question

  • We have begun deploying Windows 10 at our institution and the biggest issue we have is the time it takes to logon a new user for the first time (3 to 5 minutes). Even when we disable the "Show first sign-in animation" setting through GPO it still takes way too long to see the desktop.  It just sits on the 'Preparing Windows' phase of the logon process. We do not have a lot of Group policies running and since the process stays on 'Preparing Windows' I don't believe it is related to our login script. I work at a college where employees and students frequently bounce from one computer to another in lab environments and therefore many never use the same computer twice.  They login using their AD credentials. We have tested it on machines running AntiVirus and not running AntiVirus with the same results. Our domain controllers are not showing any taxation of system resources. There seem to be no network bottlenecks that we can tell either. The boot time is just fine (less than 20 seconds). The PCs are mostly brand new Dell machines purchased within the last 2 years (some are new Optiplex 5040s) that should have no issue handling Windows 10.  Is anyone else experiencing this with Windows 10 in a college/enterprise environment? Windows 7 logins were never what we would like to see in terms of login times (1 to 2 minutes) but Windows 10 is almost unbearable.  I've seen some other posts concerning this issue but there seem to be no solutions. We are not sure what to do at this point.
    Monday, May 2, 2016 1:53 PM

Answers

  • Is roaming profiles the recommended method from Microsoft for an enterprise/lab environment?

    It certainly used to be - in combination with folder redirection to limit the amount of sync activity on login. Requires a bit of fine-tuning, but works well with Win7 and earlier.

    We didn't go very far with our Win8/Win8.1 experiments, so I'm not sure exactly when things changed, but my impression is that since Win8, and the introduction of tiles etc, Microsoft no longer consider support for roaming profiles to be important. I'm not sure whether it's a deliberate attempt to get rid of them (along with a lot of other "legacy" features), or simply that they've forgotten that they even exist. I suspect it's part of a much greater focus on the consumer side, and a consequent assumption of a 1:1 relationship between users and devices.

    All of which is a great shame as this kind of enterprise or large environment support is the kind of thing MS used to be very good at. Given the current state of things, I wouldn't really recommend roaming profiles for Win10 use if you aren't already using them. That said, I don't have any better suggestions either.

    They keep talking about the June update as being much more enterprise focussed, but based on the previews, it's not looking very promising - roaming profiles are just as broken in 14332 as in earlier builds.

    On the login times question - are these machines with SSDs or traditional disks?

    • Marked as answer by Troy Stout Wednesday, May 18, 2016 7:39 PM
    Wednesday, May 4, 2016 11:52 AM

All replies

  • Hi Troy,

    In fact, as we know, first time logins always taking longer because the profile has to be created locally. Applications that load at startup can also compound the problem, prefetch information is also a contributor

    I appreciate your effort, disable Show first sign-in animation is a good way to reduce first login time, in general, it’s enough. I have tested a new domain user account on my Windows 10 computer, it takes about 2 minutes before desktop appeared.

    I notice your team use a login script, even though you don’t believe it will cause current situation, but it will influence first login speed actually, you could try disable this script temporarily to see the result.

    In addition, if your school don’t need to use OneDrive, disable it can also accelerate login speed, please find out Prevent the usage of OneDrive for file storage and enable it, which is located in Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > OneDrive.

    Hope my clarification is clear.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Tuesday, May 3, 2016 3:26 AM
  • The 'Modern' apps seem to be a culprit here. Remove these from your image or use LTSB (which doesn't have them in the first place), and first logon times improve considerably - not great, but comparable with Win7.

    Roaming profiles also help in that a roaming user gets the first logon delay once, and once only, and thereafter gets faster logon even on machines they haven't used before. Combined with folder redirection, this can get to a point where normal logon times are well under a minute.

    Tuesday, May 3, 2016 9:52 AM
  • Thanks everyone for the responses. These were helpful. We do have the 'Prevent the usage of OneDrive for file storage' setting enabled in GPO as well which doesn't seem to make a difference in speed. Our login script maps some network drives and lab printers which is about all it does. It is the same script that runs on Windows 7 machines as well. We will try removing the 'modern' apps to see if that improves the response. I found the PowerShell commands below which is supposed to uninstall all apps and disable them from getting created during first login. We will give it a try and let everyone know the results.

    Get-AppxPackage -AllUsers | Remove-AppxPackage

    Get-AppXProvisionedPackage -online | Remove-AppxProvisionedPackage –online


    Tuesday, May 3, 2016 12:40 PM
  • In reporting our latest findings, our computer technicians removed all the Apps on a Lab machine and unfortunately it did not improve the login time (still runs about 3 to 5 minutes). We also tested a AD user that does not have a Login Script in their user profile with the same results. I'm guessing at this point that the use of roaming profiles may be the only other method we can try in order to improve login times. This however does have its drawbacks as it adds costs to our infrastructure requiring a large file server and could cause quite an increase in network traffic on our campus. Is roaming profiles the recommended method from Microsoft for an enterprise/lab environment?
    Tuesday, May 3, 2016 8:58 PM
  • Is roaming profiles the recommended method from Microsoft for an enterprise/lab environment?

    It certainly used to be - in combination with folder redirection to limit the amount of sync activity on login. Requires a bit of fine-tuning, but works well with Win7 and earlier.

    We didn't go very far with our Win8/Win8.1 experiments, so I'm not sure exactly when things changed, but my impression is that since Win8, and the introduction of tiles etc, Microsoft no longer consider support for roaming profiles to be important. I'm not sure whether it's a deliberate attempt to get rid of them (along with a lot of other "legacy" features), or simply that they've forgotten that they even exist. I suspect it's part of a much greater focus on the consumer side, and a consequent assumption of a 1:1 relationship between users and devices.

    All of which is a great shame as this kind of enterprise or large environment support is the kind of thing MS used to be very good at. Given the current state of things, I wouldn't really recommend roaming profiles for Win10 use if you aren't already using them. That said, I don't have any better suggestions either.

    They keep talking about the June update as being much more enterprise focussed, but based on the previews, it's not looking very promising - roaming profiles are just as broken in 14332 as in earlier builds.

    On the login times question - are these machines with SSDs or traditional disks?

    • Marked as answer by Troy Stout Wednesday, May 18, 2016 7:39 PM
    Wednesday, May 4, 2016 11:52 AM
  • Thanks Mike. We have HDDs on these machines.
    Wednesday, May 4, 2016 1:07 PM
  • Hello Troy,

    Thanks for reminding me.

    As you said, roaming profile can also influence first login speed because it changes the way group policy processing is performed. When roaming profiles are configured the processing is changed from “asynchronous” (background processing or multiple at a time) to “synchronous” (foreground processing or one at a time). This disables “Fast logon Optimization” which will delay the user getting the desktop by waiting for the network to initialize first.

    This is really important to understand that when roaming profiles are implemented, group policy software installations and folder redirection requires that the user is NOT logged on before the network is initialized and processes policy synchronously- ONE AT A TIME. This is the default behavior and changing it could cause inconsistencies with your logon.

    To my knowledge, we could try to enable Set maximum wait time for the network if a user has a roaming user profile or remote home directory and Wait for remote user profile to 0 seconds.

    Both of above GPO are located in: Computer Configuration\Administrative Templates\System\User Profiles.

    What’s more, I find out a good blog for you, please refer to it for assistance.

    https://blogs.technet.microsoft.com/askds/2009/09/23/so-you-have-a-slow-logon-part-1/

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, May 9, 2016 8:29 AM
  • We are seeing incredibly slow logon times here as well with Windows 10 1607.

    We don't use roaming profiles but do use folder redirection and many of our users do have remote home directories, this was never really a problem in Windows 7, it was never lightning quick but we are seeing logon times exceeding 5 minutes here on Windows 10 and our users (staff and students) aren't happy about it. Our group policies are quite complex but again they haven't changed massively since we were using Windows 7.

    Anti malware seems to obliterate the local disk on clients when they are logging in as does the App readiness service. One drive setup seems to take a lot of CPU and disk as well. It isn't as noticeable for obvious reasons on newer SSD disks but some of our 3 year old hardware which should be fine to run W10 really clugs away (HP EliteDesk 800 G1 for example).

    I think like Mike says this is a consequence of Microsoft focusing more towards consumers than enterprises or large schools, colleges or universities.  The post Teemo mentions looks very interesting and I am going to have a good read of it.

    Tuesday, November 22, 2016 12:54 PM
  • Check out this article:

    https://4sysops.com/archives/improving-windows-10-logon-time/

    We are working through the same issue at our college. Brand new Dell's imaged with our Windows 10 image got wiped out by the Anniversary update. Ever since then, horribly slow first-time logins. Why? Windows 10 modern app creation during login. This article explains it and gives a couple solutions. 

    I am going to try the default profile in the netlogon folder.

    Tuesday, December 6, 2016 4:18 PM
  • Let us know how that goes, because I'm considering the same thing. 
    Saturday, December 17, 2016 12:34 AM
  • This is a pretty complicated issue, and it becomes very readily apparent when dealing with older hardware. Most of the PCs at my university are from 2012 and earlier, and I have observed that as additional profiles are added (and removed through GPO policy), the system becomes progressively slower -- to the extent that login times exceed 20 minutes!

    This was always an issue, even with Windows 7: after N number of users logged in to the machine, even though we had removed the profiles, the system became unusable. 

    I believe that we have a problem with our policies that may be exacerbating the issue but perhaps there is a fundamental flaw in Windows that it simply doesn't handle multiple profiles well?

    Enabling roaming profiles is simply not an option for us -- our network and servers would not be able to handle the hit.

    Saturday, April 1, 2017 8:06 PM
  • I've been wrestling with this for over a year now.

    My users are very unhappy about it, most morning users can take 5 minutes plus to login.

    My hardware is up to three years old and some of it is brand new, even the new machines still take minutes to log in.

    Our GPOs aren't massively complex, we do use some folder redirection and only a few groups use very minimal login scripts for some legacy stuff.

    This has wasted hundreds of man hours this year alone, I'm desperate to get something fixed.

    Thursday, April 27, 2017 9:37 AM
  • I'm seeing the same issues in our computer labs. We have labs that serve an Engineering College so we have images that take up 400GB on the HDD once they are installed due to both the large number of applications we make available to students for classwork (over 100) and the size of some of the CAD and graphics suites. I've done everything listed here so far; removing the login animation, removing windows provisioned applications, using GPOs to disable all consumer experiences and we still often see login times in excess of seven minutes on magnetic disks (5 minutes with an SSD for comparison) on one year old Dell desktops with Xeon processors and 16GB RAM. We do not use a roaming profile, just remapping file storage to a network location. In Windows 7 the first login was about 45 seconds with this setup, if I could get anywhere close to that I'd be happy. We don't see the same logon issues on systems that are installed with only a few dozen programs so my working theory is that it is due to the shear volume of applications installed on the computer the system spends a ton of time cataloging icons and such for each user but I haven't been able to confirm that. We're currently running 1703, has anyone had any additional luck reducing login times? Thanks.
    Thursday, June 8, 2017 3:10 PM
  • I've struggled with this for years!! I cant explain to you how many hours and different things ive tried. This issue first arrived in Windows 8.  Our Windows 7 machines log in super fast (under a minute). We got 24 windows 8 machines and it takes anywhere from 3-5 minutes. To make things worse our school uses Deep Freeze which is a program that wipes the computer clean when its turned off. This essentially means every log in is a first time log in. I just upgraded these machines to windows 10. Praying Microsoft fixed the issue (because they gave up on it in windows 8 and 8.1) and was sadly disappointed. 

    It sucks. The only work around I have found is if you hit Control+ ALT+ Delete while its logging in and then hit the back button It will take you to the desktop. But how am i supposed to let 500+ students and teachers know they have to do that because Windows 10 has a flaw. 

    If anyone can solve this pleaseeeeee let me know.


    Friday, June 16, 2017 5:04 PM
  • Yep Win10 first logons are a crap experience compared to Win7.  For our 1607 deployments I followed that sysop article by James Rankin & created a custom "default user" profile - it improved things a lot (around 1 minute compared to 2-5 mins), however those same steps don't appear to work with 1703 (broken start/search, etc).  Shouldn't have to do these types of hacks to get basic stuff like user logon experience to work!  

    With Win10 we sure get the feeling MS doesn't care about the Enterprise any more.

    Sunday, June 18, 2017 12:40 PM
  • It is just awful. How one can expect users to be happy when on each login on a different machine they have to wait X amount of time?

    Seb

    Friday, July 21, 2017 7:36 AM
  • We have discovered that by turning off the Fast Boot feature in Windows 10, our domain logins have become about 5 seconds or less.  Prior to that we were seeing ridiculous 5 minute login times.  

    1. To turn it off at the workstation level you go into Power Options in the classic control panel. (Bring up a run window and type control, if you can't find the classic control panel.)  Once you are in Power Options on the left click "Choose what the power buttons do."

    2.  Towards the top choose "Change settings that are currently unavailable"

    3.  Look under "Shutdown Settings" and un-check the box next to "turn on fast startup."

    4.  Do a shutdown and then power up again, your boot time may slow a bit but your login time should speed up considerably if this is what is behind your problem.  Of course the next build update will turn it on again, but you can just do a GPO to enforce your will.  Hope this helps.  

    FYI - I also turn off Fast Boot because some customers are in the habit of simply shutting down and starting up when a print job hangs up to break the log jam, but Fast Boot breaks that process since it hibernates services on shutdown rather than shutting them down.  Fast Boot should be removed from Windows 10.

    Friday, August 18, 2017 3:04 AM
  • In our environment for public (classroom) computers (redirected folders, no roaming profile) I seem to be having good results with a logon script that kills and starts the explorer.exe process during logon.

    Windows 10 creators

    Before: logon time between 2:00 and 2:30 minutes.
    Sometimes it just got stuck on "preparing windows" for 10 minutes until the user got fed up and rebooted after which the second logon goes very fast.

    with logon script restarting explorer.exe: logon time between 1:15 and 1:30

    feels like a timeout of something.

    anyone else seeing this?

    $procesnaam = "explorer"
    stop-process -processname $procesnaam
    
    start-sleep 3
    if (-not (get-process $procesnaam)){
    	start-process $procesnaam
    }
    else {
    	write-output "process restarted automatically"
    }
    I used to fix the logon time with citrix profile manager which reduced logon times dramatically as well. However, it's hard to keep it well configured as it can break things very easily especially with the quick pace of windows upgrades (start menu, taskbar icons etc)

    Wednesday, December 13, 2017 2:58 PM
  • Our University has reached out to Microsoft for this issue. We have public computers where even on our fastest computers take 2-3 minutes to login on Windows 10 vs 30 seconds for Windows 7 for a new user profile. Here is there response:

    LTSB is not the recommend path for lab/library computers as it is only updated every 3 years or so.  This means that app compatibility issues aren’t corrected, new security features aren’t installed, etc.  As you have seen, what is causing the boot times to be so long for new users of the machine with other versions of Windows 10 is the time it takes to create the user profile and load all the Windows 10 University Apps.

    My Windows 10 specialist recommends that you look at using Shared PC Mode rather than LTSB:  https://docs.microsoft.com/en-us/windows/configuration/set-up-shared-or-guest-pc.  He recommends setting this up on a standard Windows 10 image (non-customized) and testing the login times for new users to see if they are acceptable.  If so, then try again with your customized image (if you are using a custom image) and test the login times for new users.  If neither of these options provide acceptable login times for new users, please let me know and I will set up a meeting for you to work with him to review your config and see if we can bring those times down.

    We have not tried Shared PC Mode yet, but we will give it a shot. I wanted to throw this out there and see if anybody else has tried this and gotten any traction?

    Wednesday, April 18, 2018 5:49 PM
  • Thanks for the information about 'Shared PC Mode'. I had not heard about this and will definitely give it a try. I originally posted this question 2 years ago and we are STILL having ridiculously slow login times in our student lab environment with Windows 10. I have tried just about everything mentioned in this thread and nothing seems to work for us. Windows 7 login times are fine so we have delayed moving completely to Windows 10 in our labs until this issue can be resolved.
    Wednesday, April 18, 2018 8:41 PM
  • Just to add our 2p...

    We've looked briefly at Shared PC Mode, and it seemed to be rather simplistic. There's very little that it does that you can't do anyway via group policy, or via your own or third party mechanisms (which are often more powerful or flexible). If you're setting up your first computer lab from scratch and don't already have systems in place for, e.g., power management or profile deletion, then it's probably useful, otherwise not so much.

    MS recommend not to use LTSB for labs, but having done exactly that for 2 years and intending to do so again for at least the 2018/19 academic year, there really isn't a better option out there, especially as far as initial logon times and profile creation are concerned.

    If you have users moving between devices as the typical case, and no requirement for UWP apps, there's very little downside to it in practice. Obviously, MS may try to fence it off even more, but if they do that's for their own (percieved) benefit not ours. As things stand, for the kind of issues our lab environments produce, it works well.

    Monday, April 23, 2018 9:43 AM
  • Mike and Troy,

    Thanks you so much for your input. 

    We tried a Shared PC Mode and so far it is a bust. It doesn't really change the login times. I would like to make sure this thread is alive and kicking since I can use the experiences everybody is having to show Microsoft they are not listening to it's university customer base. I understand they need to keep up and push Metro apps which is the core of the slow login times, but it isn't really working with public environments where new users need to login fast. They are not getting that when a professor logs in to Windows 10 machine in between classes it need to be fast. They don't care about Metro apps. 

    If anyone else please share your experiences.

    Wilson

    Wednesday, April 25, 2018 10:22 PM
  • Try changing the value of the key below to 0.  It's not really documented anywhere, and when we raised it with MS they gave us vague statements like "you shouldn't touch it", but I've noticed it speeds up 1st logons for us by 30-60s.

    Seems to be an arbitrary 60s "wait" setting for 1st logon, so win10 can do all that 1st logon stuff with the new crappy app/start menu model.

       Key : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

       Value: FSIASleepTimeInMs 

    (default is 60000)

    Thursday, April 26, 2018 12:07 AM
  • Having the same issue here with domain logins. Windows 10 with latest updates. Login takes at least 10mins. 

    Have tried all the things in this thread and more to no avail

    It appears microsoft is turning a blind eye to this issue and thats just not good enough.

    Monday, May 14, 2018 4:24 AM
  • I have the same issue.  Brand new surface takes 3 minutes to <g class="gr_ gr_49 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" data-gr-id="49" id="49">login</g> to <g class="gr_ gr_48 gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar only-ins replaceWithoutSep" data-gr-id="48" id="48">domain</g>.  A local login completes in 5 seconds.  Nothing in the error log.  This has got to get better.  The MAC users laugh while <g class="gr_ gr_287 gr-alert gr_tiny gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" data-gr-id="287" id="287">i</g> wait for the fancy surface to <g class="gr_ gr_286 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" data-gr-id="286" id="286">login</g>.  Half the meeting is over before I can pull up the presentation.
    Thursday, May 31, 2018 10:06 PM
  • It is caused the PPR (Window that appears that asks you to Accept or Decline that you agree).

    This window is opening behind the Welcome screen and holds the process up.

    It is really easy to fix you just need to add the following Registry key.

    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DelayedDesktopSwitchTimeout" /t REG_DWORD /d 0 /f

    Thursday, June 14, 2018 3:29 AM
  • It is caused the PPR (Window that appears that asks you to Accept or Decline that you agree).

    This window is opening behind the Welcome screen and holds the process up.

    It is really easy to fix you just need to add the following Registry key.

    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DelayedDesktopSwitchTimeout" /t REG_DWORD /d 0 /f

    That worked perfectly for us, with one issue we're still working on: apparently, setting timeout to 0 as you suggest, prevents Windows to

    1. Connect Printers (via simple logon.cmd script set in gpedit.msc, on local machine)

    2. Place "Documents", "Download", "Pictures", "Videos" in a network drive, also configured in GPEDIT.MSC via Office 2016 ADMX. 

    So, it seems the above settings prevents the machine from applying settings in gpedit.msc . Does it make sense? 

    We're experimenting with progressively higher timeout values. 

    Friday, July 6, 2018 12:15 AM
  • Actually, I am going to correct my previous message. It works perfectly and the other issues I mentioned were unrelated.

    So thank you so much for pointing that out!
    Friday, July 6, 2018 12:17 PM