GPO Processing on Termianl Services 2000

[ScottC]

Experiencing 7 second delay during logon.

Have narrowed it down to the computer GPO in AD 2003.

Environment: Citrix MF XPe FR3, Windows 2000 Server SP4.

Have confirmed it is NOT profile related, or login script, Anti-Virus, or even Citrix.

Have used GPMC to to backup GPO's and apply the settings to GPO's in another AD Domain, after which NO 7 second delay in the lab.

More details: Total login time is 11 -14 seconds, the 7 second delay happens just after the authentication box pops and after the login script box completes, both are very fast. Policy processing is set to asynconous, etc...

Any wild guesses would be appreciated.
ScottC

Try:

1) Making sure the computer is in a DEFINED AD-SITE with IP subnets defined and active
and
2) Make sure the computer is able to QUICKLY locate a DC via nslookup. ie: Verify the heck out of your DNS

If you think it's a GPO processing problem keeping things hanging,
I suggest turning on USERENV logging which will detail by the MILISECOND just what the heck is going on.

Keep us posted!

[ScottC]

Jeremy

Thanks for the suggestions.

Have turned on userenv logging in verbose. it all looks good. I had Microsoft consulting Services look at the logs. They could not see anything wrong.

gpresults looks good too. DNS checks out ok. I will investigate the site thing you suggested.

Have 90 Citrix Servers this is happening on.

If I remove the computer policy, logins are super fast.

The GPO's are configured by the book for Terminal Services, using lookback, in replace mode. asynchonous processing. With no override and blocking turned on for the OU.

However, a few months ago, someone turned on the No Override on the Default Domain Policy. Could that be causing this wierd delay.

ScottC.
www.thin-world.com

I don't think that should cause any delay.

[gary Olsen]

ScottC,
I had an issue like this once and found it was due to some unresolved SIDs in the user rights settings. In our case it was a bad deployment of SMS where the default SMS accounts were hosed and it took a long time to try to resolve the SIDs. We also traced periodic temporary hangs that occurred during policy refresh. Since your problem goes away when removing computer settings, you might check for unresolved SIDs.

Also I'd start with a clean computer policy and if the problem goes away, start adding the settings one by one to see where it chokes.

GaryO

Gary... your knowledge of wierd problems never ceases to amaze me. :-)