您好，
一般来说，您可以使用NETLOGON, USERENV and GPSVC logs, Process Monitor, NETMON traces, ETL traces (like profile and Winlogon) and memory dumps等一类的工具来追踪用户登录活动。您也可以参考下面的这个博客里面的工具来对系统登录慢进行排错， 以下是链接地址：
Tools for Troubleshooting Slow Boots and Slow Logons (sbsl)（仅英文版）
http://social.technet.microsoft.com/wiki/contents/articles/10128.tools-for-troubleshooting-slow-boots-and-slow-logons-sbsl.aspx
谢谢
Wendy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
