Home > Windows XP / 7 > Windows XP: Troubleshoot logon issues

Windows XP: Troubleshoot logon issues

Slow logon times is in my opinion one of the most common complaints of users especially when you have them on the phone and ask them to log-off and log-on again. Then there will be a big chance that they say oh that will take a lot of time! In this post I will cover a small tutorial of how I enable logging and troubleshoot this for Windows XP clients. For Windows 7 I prefer to use the Debugging and performance tools in the “Windows SDK toolkit” to troubleshoot logon issues because this provides more info then in Windows 7 then XP. This was already covered in my previous post.

First it’s important to enable some logging to determinate the issue:

For myself is the user environment log the most important log file because here I can determine easier when exactly a user logs in and when it is  finished. The netlogon & uermode log files are located in %systemRoot%\Debug & %systemRoot%\Debug\UserMode

To analyze the UserMode userenv.log file I prefer to use the free third party tool Policy Reporter: http://www.sysprosoft.com/policyreporter.shtml

Example events of userenv.log :

USERENV(224.228) 11:06:41:452 LoadUserProfile: Entering, hToken = <0x860>, lpProfileInfo = 0x6e3e0
-> You have entered your login credentials

USERENV(224.228) 11:06:41:452 LoadUserProfile: lpProfileInfo->dwFlags = <0x0>
-> Winlogon tries to identify your profile

USERENV(224.228) 11:06:41:452 LoadUserProfile: lpProfileInfo->lpUserName = <test_user>
-> Start loading profile your

USERENV(af8.a08) 11:07:13:045 LibMain: Process Name:  C:\WINDOWS\Explorer.EXE
-> Logon finished -> Explorer.exe starts: desktop, taskbar loaded.

So I have collected the correct logon timings, I can start investigating the events between these. Also I will investigate the %systemRoot%\Debug\netlogon.log events between the same timings to detect errors or time-outs.

You can also use the NLParse tool from Account lockout and management tools of Microsoft to extract some events from the netlogon: NLParse.exe.

The netlogon.log & userenv.log provides a lot of information and it could take some time to get through them. The best way is first to determine the time difference between each event to detect the slow logon issue.

Categories: Windows XP / 7
  1. Used Commercial Laundry Equipment
    July 14, 2013 at 4:52 am

    We are a group of volunteers and starting a new scheme in our community.
    Your web site provided us with valuable information to work on.
    You have done a formidable job and our whole community will be grateful to you.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: