I am having problems with slow login behaviour with roaming profile, usually varies from 2-10 minutes with no clear cause. I tested for forced update from several PC's and discovered gpupdate /force times out. There are no abvious DNS issues, all PC
are local to DC, which is PDC for the domain.
The UserEvn.log has not errors. RSOP has no errors, all appears correct, other then caching is enabled on roaming profiles.
How can I best debug gpupdate /force timeout?
Why would it timeout when login process GPO faster (OK, it does check changes rather then performing a full refresh). So, there is potentially a corrupt file, due to something timing out???
GPO has a limit on the Profile size which is enforced by proquota.exe executing on the client, set to 35 MB limit. The My Documents is redirected to the users home directory, so is not taking up space in the roaming profile.
I initially though proquota.exe was causing issues with the profile processing, but ProcMon.exe boot log has shown that proquota.exe is executing late the the boot process, after the delay in processing Profile.
Gpupdate /force is timing out after 10 minutes when executing on a client, after ten minutes. I am not sure this issue has the same cause as the slow login behaviour. I created a test user and PC without profile limit set and ran gpupdate /force. My current best theory is that since some roaming profiles have been deleted and recreated with the same behaviour re-appearing there must be some corruption/weirdness in the GP templates.
Without a way to resolve timeouts in GPO and Profile processing to a definite cause, at the moment, my best attempt to solve this is rebuild GPO from scratch (giving me a clean GPO) and retest the behaviour. Unless some else has a bright idea.
Any help would be very welcome, it is driving me mad.
I used Filemon to examine behaviour. GPUpdate seems execute without errors, but there is nearly 10 minutes between start execution and close.
Command prompt opened
11:14:19 cmd.exe:656 OPEN H:\ SUCCESS Options: Open Directory Access:
00100001
GPupdate begins process (is buffer overflow usual?)
11:14:19 gpupdate.exe:656 QUERY
INFORMATION C:\WINDOWS\system32\gpupdate.exe BUFFER
OVERFLOW FileNameInformation
11:14:19 gpupdate.exe:656 QUERY
INFORMATION C:\WINDOWS\system32\gpupdate.exe SUCCESS FileNameInformation
Last GPupdate log entry before 11:24:19
11:14:19 cmd.exe:656 OPEN C:\WINDOWS\system32\gpupdate.exe.Manifest NOT
FOUND Options: Open Access: 001200A9
9096 11:14:20 gpupdate.exe:1336 QUERY
INFORMATION C:\WINDOWS\Debug\UserMode\userenv.log SUCCESS FileBasicInformation
Last GPUpdate log, followed by timeout both Computer and User setting
displayed on CMD window.
35148 11:24:19 gpupdate.exe:1336 CLOSE H:\ SUCCESS 35149 11:24:19 gpupdate.exe:1336 CLOSE C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 SUCCESS
But this does not seem like simply locked file. Other processes do access
this path, but none seem to lock it. CSRSS.EXE does access this resource at
11:14, then 11:17 and then nothing until 11:24. What the hell is causing the
timeout/delay?
CSRSS.EXE processing is GPO related, this is same file gpupdate.exe closes.
11:14:20 csrss.exe:672 READ C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows. Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.Manifest END
OF FILE Offset: 1862 Length: 8178
8717 11:14:20 gpupdate.exe:1336 CLOSE C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll SUCCESS
26465 11:17:21 csrss.exe:672 OPEN C:\WINDOWS\WinSxS\Policies\ SUCCESS Options: Open Directory Access: 00100000
26469 11:17:21 csrss.exe:672 OPEN C:\WINDOWS\Assembly\GAC\Policy.6.0.Microsoft.Windo ws.Common-Controls\ NOT
FOUND Options: Open Directory Access: 00100001
26470 11:17:21 csrss.exe:672 OPEN C:\WINDOWS\Assembly\GAC\ SUCCESS Options:
Open Directory Access: 00100000
26473 11:17:21 csrss.exe:672 OPEN C:\WINDOWS\system32\ SUCCESS Options: Open
Directory Access: 00100000
31904 11:18:20 svchost.exe:1020 READ C: SUCCESS Offset: 128000 Length: 12288 33426 11:24:07 svchost.exe:1116 READ C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR SUCCESS Offset: 335872 Length: 8192
33590 11:24:07 verclsid.exe:2180 DIRECTORY C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2180_X-WW_A84F1FF9\ SUCCESS FileNamesInformation 34893 11:24:07 verclsid.exe:2180 CLOSE C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 SUCCESS
46811 11:29:28 DoT.scr:2328 QUERY
INFORMATION C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll SUCCESS Length: 1050624