preferences | Todd's Blog

Just before Christmas holidays, we started receiving calls about sporadic slow logins in our schools. Now slow logins can be a real pain to troubleshoot and somewhat difficult to replicate the issues. We also noticed it was only student logins with the issue. Staff and admin logins were not affected.

We headed to one of the elementary schools and started investigating. I used wire shark to sniff the port of the computer we were testing with and I used the Sysinternal tools. We were able to replicate a slow login and started using gpupdate /force. If it updated with one specific DC, it would take somewhere in the neighbourhood of 10 minutes to update. It would take 45 seconds against the rest of the domain controllers. I also noticed the workstation was receiving the policy file 2 bytes at a time.

This was odd, so we decided to vMotion the virtual machine which is the DC to a different host. This fixed the issue and the updates were about 45 seconds now. So wanting to know if the problem was a host problem, we moved the virtual machine back to the original host and it still worked keeping our logins at 45 seconds. Not entirely sure what was happening but happy to have fixed the problem, we headed back to the office.

We checked in with Tier 1 support and let them know we solved it, not certain it would be a long term fix and wanted to made aware of any further calls.

The next day the calls were back. So I used the IT techs favourite troubleshooting tool.

Google.

I found this KB article. http://support.microsoft.com/kb/319440. The machines that were affected were for sure Windows XP machines. I can’t remember now if we saw this behaviour on our Windows 7 computers. But at that point, we had just began our 11,000 seat Windows 7 deployment.

I added the entry I typed up here to the Group Policy preference to the GPO that was applied against the computers being affected.

Registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: BufferPolicyReads
Type: DWORD
Value: 1

Once this change was made, we update Group Policy and then headed to a school. It also had the benefit that good gpupdates went from 45 seconds to 15 seconds.

I have upgraded two of three domain controllers to Windows Server 2008 over the last couple months. The install went smooth and I will admit, Windows Server 2008 does seem like a rather nice OS. One of the new features of having a Windows Sever 2008 domain controller is the group policy preferences. Preferences will let you do things like create desktop shortcuts, printer mappings and map network drives along with many other things.

I decided to use it to do two things, the first being map network printers and the second create desktop shortcuts. Group Policy in 2003 R2 had the option to push printers based on linking policies to OUs. Group Policy preferences had the benefit that I could create on Policy, and have printer maps based on the computer’s subnet. For example, machines with 42 in the third octet would be given printers local to that site, computers in 40 subnet would be given a different set of printers, but I wouldn’t need to have multiple policies, nor would I have to worry about moving the computer between OU’s. I could also push desktop icons to users who say belong to a certain group , relatively quick and painless. Basically, the new features match things I have seen in the past with Scriptlogic which is a product I was very pleased with when I used it at the City of Kingston, back when I worked there.

Once you create your settings, you need to ensure the patch to use group policy preferences is applied to the computer. You can download the patch from Microsoft’s site and is available for XP, 2003 and Vista. I applied the patch to test the machines, rebooted and the machine came up, I logged in as the patron and the computer froze, would no longer log in. It would try but go nowhere. Remove the group policy from being applied, the machine logs in.

I don’t know what the problem is yet, but I narrowed it down to adding the printers and I am guessing it is driver related. The computers I tested on where Vista and needed the driver installed, so UAC could have also been hanging it up. The printer is applied as a user preference but it looks at the subnet of the computer to determine which printer to install. I plan to test later but for now I will use GPO to assign printers to computers.

I will have more to come on this, probably in June or July.