Announcement

Collapse
No announcement yet.

XP Domain PCs Take Forever to Apply Computer Settings?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • XP Domain PCs Take Forever to Apply Computer Settings?

    I have spent best part of 5 days reading loads of pages on why 400+ of our Windows XP Professional SP3 domain pc's sit for 2-4 minutes on "Applying Computer Settings" before getting to the "Ctrl-Alt-Del" login prompt.

    I started at this company only a week ago and was brought in to lead the desktop infrastructure. Do some Root Cause Analysis, streamline the XP builds/deployment and resolve underlying issues that are losing the "helpdesk" team many hours of manual work.

    One of the issues that my interviewers kept going on about was that startup/login times were atrocious, I merely passed it off as poor/bloated builds and assured them I could help. However upon starting here and creating some lovely lightweight and optimized XP Pro builds, after adding them to the domain and rebooting, the systems sit at "Applying Computer Settings" for way too long. If I remove the network cable before starting the system they get to the "Ctrl-Alt-Del" screen immediately.

    I've read on many pages that it is probably a DNS issue. However, I know little about DNS servers, other than what their used for. Configuration is over my head really, however I'm willing to get deeper into this as it would be quite a coup for me in my new job to resolve this. I mentioned that this is probably a "DNS issue" to the systems administrator who whilst not disagreeing with me, said "but what dns issue? This is only happening to the desktops and not the servers."

    Presently, 400 users all have this "applying computer settings" pause. No matter how much optimizing I do to the builds, this issue is always going to make my work look bad.

    I have tried manually entering each of the DNS servers individually and rebooting, but same pause.

    8 DCs, all DNS servers also.

    Anyone have any ideas?

  • #2
    Re: XP Domain PCs Take Forever to Apply Computer Settings?

    I'd start looking at the Group Policy settings, especially those configured in the computer section.
    Also can you give us a little more info on the structure of your network, especially DC placements and their FSMO roles and also networking infrastructure to rule out any possible networking issues.
    Caesar's cipher - 3

    ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

    SFX JNRS FC U6 MNGR

    Comment


    • #3
      Re: XP Domain PCs Take Forever to Apply Computer Settings?

      Hmm 400 users is allot, do they loggin all at the same time in the morning ? you have good servers ? i had a problem similar to your, and indeed it was a DNS problem, but such a large company and 8 DC, probably a missing config around there ?

      Regards
      Kevin

      Comment


      • #4
        Re: XP Domain PCs Take Forever to Apply Computer Settings?

        Originally posted by kevinguerreiro View Post
        Hmm 400 users is allot, do they loggin all at the same time in the morning ? you have good servers ? i had a problem similar to your, and indeed it was a DNS problem, but such a large company and 8 DC, probably a missing config around there ?

        Regards
        Kevin
        I should imagine the majority login between 8-9am, however regardless of login time the issue occurs. If I reboot when everyone is logged in (lunchtime) I still get the "Applying computer settings" pause/hang.

        I have checked the default domain policy for computers and everything seems to be in order. Once again, I'm not hugely experienced with DNS so couldn't tell if a config was missing.

        All 8 DC's are also DNS servers. 2K8 and more than capable.

        Comment


        • #5
          Re: XP Domain PCs Take Forever to Apply Computer Settings?

          created new test OU. blocked GP inheritance, put computer account in there and tried it. same issue. Almost certainly a DNS issue and not a GPO issue.

          nslookup for every dc/dns resolves the correct IP with dc01 being the responding server for each nslookup.

          dc01 - 10.10.13.153
          dc02 - 10.10.13.151
          dc03 - 10.10.21.152
          dc04 - 10.10.21.153
          dc05 - 10.10.30.26
          dc06 - 10.10.31.26
          dc07 - 10.101.2.161
          dc08 - 10.101.2.161

          Comment


          • #6
            Re: XP Domain PCs Take Forever to Apply Computer Settings?

            Hmm for shure it's a DNS problem, do you have the DNS integrated with DC ? Try to download a ebook about dns infrastuture, or maybe buy trainsignal videos about dns ? it's always a good option. I'm not an expert on dns so just trying to help you in some sort of way.

            Regards
            Kevin Guerreiro

            Comment


            • #7
              Re: XP Domain PCs Take Forever to Apply Computer Settings?

              Carry out a gpresult /v on 1 of the problem machines. You can then analyse the settings taking effect and then look at the appropriate GPOs. You could look into disabling the User and Computer settings as appropriate on the GPOs as well.

              I have come across this before when certain GPOs were trying to run scripts for systems or software that weren't present on the computer that the GPO was applying to. I have tended to either restructure OUs or use Security Groups to target specific machines at domian level.

              Comment


              • #8
                Re: XP Domain PCs Take Forever to Apply Computer Settings?

                Originally posted by Virtual View Post
                Carry out a gpresult /v on 1 of the problem machines. You can then analyse the settings taking effect and then look at the appropriate GPOs. You could look into disabling the User and Computer settings as appropriate on the GPOs as well.

                I have come across this before when certain GPOs were trying to run scripts for systems or software that weren't present on the computer that the GPO was applying to. I have tended to either restructure OUs or use Security Groups to target specific machines at domian level.
                Bear in mind I've blocked inheritance on the OU to stop computer GPO settings. I have not pasted user GPO settings as these shouldn't affect anything because this issue occurs before a user is defined.

                Code:
                Microsoft (R) Windows (R) XP Operating System Group Policy Result tool v2.0
                Copyright (C) Microsoft Corp. 1981-2001
                
                Created On 09/06/2009 at 09:13:20
                
                
                
                RSOP results for P******T\b***kers on D420TEST : Logging Mode
                --------------------------------------------------------------
                
                OS Type:                     Microsoft Windows XP Professional
                OS Configuration:            Member Workstation
                OS Version:                  5.1.2600
                Domain Name:                 P******T
                Domain Type:                 Windows 2000
                Site Name:                   PP-Welwyn
                Roaming Profile:             
                Local Profile:               C:\Documents and Settings\b****ers
                Connected over a slow link?: No
                
                
                COMPUTER SETTINGS
                ------------------
                    CN=d420test,OU=Build Testing,DC=p******t,DC=com
                    Last time Group Policy was applied: 09/06/2009 at 08:59:57
                    Group Policy was applied from:      ppws304.p******t.com
                    Group Policy slow link threshold:   500 kbps
                
                    Applied Group Policy Objects
                    -----------------------------
                        N/A
                
                    The following GPOs were not applied because they were filtered out
                    -------------------------------------------------------------------
                        Local Group Policy
                            Filtering:  Not Applied (Empty)
                
                    The computer is a part of the following security groups:
                    --------------------------------------------------------
                        BUILTIN\Administrators
                        Everyone
                        BUILTIN\Users
                        NT AUTHORITY\NETWORK
                        NT AUTHORITY\Authenticated Users
                        D420TEST$
                        Domain Computers
                        CERTSVC_DCOM_ACCESS
                        
                    Resultant Set Of Policies for Computer:
                    ----------------------------------------
                
                        Software Installations
                        ----------------------
                            N/A
                
                        Startup Scripts
                        ---------------
                            N/A
                
                        Shutdown Scripts
                        ----------------
                            N/A
                
                        Account Policies
                        ----------------
                            N/A
                
                        Audit Policy
                        ------------
                            N/A
                
                        User Rights
                        -----------
                            N/A
                
                        Security Options
                        ----------------
                            N/A
                
                        Event Log Settings
                        ------------------
                            N/A
                
                        Restricted Groups
                        -----------------
                            N/A
                
                        System Services
                        ---------------
                            N/A
                
                        Registry Settings
                        -----------------
                            N/A
                
                        File System Settings
                        --------------------
                            N/A
                
                        Public Key Policies
                        -------------------
                            N/A
                
                        Administrative Templates
                        ------------------------
                            N/A

                Comment


                • #9
                  Re: XP Domain PCs Take Forever to Apply Computer Settings?

                  Can you post a DCDiag of the DC on the affected site
                  Caesar's cipher - 3

                  ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

                  SFX JNRS FC U6 MNGR

                  Comment


                  • #10
                    Re: XP Domain PCs Take Forever to Apply Computer Settings?

                    Originally posted by L4ndy View Post
                    Can you post a DCDiag of the DC on the affected site
                    I ran dcdiag /dns:test from the PDC.

                    Code:
                    Microsoft Windows [Version 6.0.6001]
                    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.
                    
                    O:\>dcdiag /test:dns
                    
                    Directory Server Diagnosis
                    
                    Performing initial setup:
                       Trying to find home server...
                       Home Server = ppws304
                       * Identified AD Forest.
                       Done gathering initial info.
                    
                    Doing initial required tests
                    
                       Testing server: PP-Welwyn\PPWS304
                          Starting test: Connectivity
                             ......................... PPWS304 passed test Connectivity
                    
                    Doing primary tests
                    
                       Testing server: PP-Welwyn\PPWS304
                    
                          Starting test: DNS
                    
                             DNS Tests are running and not hung. Please wait a few minutes...
                             ......................... PPWS304 passed test DNS
                    
                       Running partition tests on : DomainDnsZones
                    
                       Running partition tests on : ForestDnsZones
                    
                       Running partition tests on : paypoint
                    
                       Running partition tests on : Schema
                    
                       Running partition tests on : Configuration
                    
                       Running enterprise tests on : adlocal.com
                          Starting test: DNS
                             Test results for domain controllers:
                    
                                DC: ppws304.p******t.com
                                Domain: p******t.com
                    
                    
                                   TEST: Basic (Basc)
                                      Warning: The AAAA record for this DC was not found
                    
                                   TEST: Dynamic update (Dyn)
                                      Warning: Failed to delete the test record _dcdiag_test_record
                    in zone p******t.com
                    
                                   TEST: Records registration (RReg)
                                      Network Adapter
                                      [00000013] HP Network Teaming Virtual Miniport Driver:
                                         Warning:
                                         Missing AAAA record at DNS server 10.10.13.151:
                                         ppws304.paypoint.com
                    
                                         Warning:
                                         Missing AAAA record at DNS server 10.10.13.151:
                                         gc._msdcs.adlocal.com
                    
                                         Warning:
                                         Missing AAAA record at DNS server 10.10.13.153:
                                         ppws304.paypoint.com
                    
                                         Warning:
                                         Missing AAAA record at DNS server 10.10.13.153:
                                         gc._msdcs.adlocal.com
                    
                                         Warning:
                                         Missing AAAA record at DNS server 10.10.13.153:
                                         ppws304.paypoint.com
                    
                                         Warning:
                                         Missing AAAA record at DNS server 10.10.13.153:
                                         gc._msdcs.adlocal.com
                    
                                   Warning: Record Registrations not found in some network adapters
                    
                                   ppws304                      PASS WARN PASS PASS WARN WARN n/a
                             ......................... adlocal.com passed test DNS
                    
                    O:\>

                    Comment


                    • #11
                      Re: XP Domain PCs Take Forever to Apply Computer Settings?

                      Code:
                      DCDIAG /TEST:DNS /V /E
                      Code:
                       Summary of DNS test results:
                      
                                                          Auth Basc Forw Del  Dyn  RReg Ext
                          _________________________________________________________________
                          Domain: adlocal.com
                             pphs302                      PASS FAIL n/a  n/a  n/a  n/a  n/a
                             ppws300                      PASS FAIL n/a  n/a  n/a  n/a  n/a
                          Domain: p******t.com
                             PPRS308                      PASS WARN PASS PASS WARN WARN n/a
                             PPWS303                      PASS WARN PASS PASS WARN WARN n/a
                             PPWSHUB                      PASS WARN PASS PASS WARN WARN n/a
                             PPHS306                      PASS WARN PASS PASS WARN WARN n/a
                             ppws304                      PASS WARN PASS PASS WARN WARN n/a
                             PPRS307                      PASS WARN PASS PASS WARN WARN n/a
                             PPHSHUB                      PASS WARN PASS PASS WARN WARN n/a
                             PPHS305                      PASS WARN PASS PASS WARN WARN n/a

                      Comment


                      • #12
                        Re: XP Domain PCs Take Forever to Apply Computer Settings?

                        How are your DNS zones configured? Have you enabled Dynamic updates?
                        Also can you post an ipconfig /all from a problematic client and the DC in question?
                        Caesar's cipher - 3

                        ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

                        SFX JNRS FC U6 MNGR

                        Comment


                        • #13
                          Re: XP Domain PCs Take Forever to Apply Computer Settings?

                          Originally posted by L4ndy View Post
                          How are your DNS zones configured? Have you enabled Dynamic updates?
                          Also can you post an ipconfig /all from a problematic client and the DC in question?
                          I don't believe dynamic updates are enabled. They are not applied via GPO (they're showing disabled)How can I clarify for certain?

                          Client

                          Code:
                          Windows IP Configuration
                          
                                  Host Name . . . . . . . . . . . . : WEL10215
                                  Primary Dns Suffix  . . . . . . . : p******t.com
                                  Node Type . . . . . . . . . . . . : Hybrid
                                  IP Routing Enabled. . . . . . . . : No
                                  WINS Proxy Enabled. . . . . . . . : No
                                  DNS Suffix Search List. . . . . . : p******t.com
                                                                      p******t.com
                          
                          Ethernet adapter Local Area Connection:
                          
                                  Connection-specific DNS Suffix  . : p******t.com
                                  Description . . . . . . . . . . . : Intel(R) 82566DM-2 Gigabit Network C
                          onnection
                                  Physical Address. . . . . . . . . : 00-1E-4F-48-E0-66
                                  Dhcp Enabled. . . . . . . . . . . : Yes
                                  Autoconfiguration Enabled . . . . : Yes
                                  IP Address. . . . . . . . . . . . : 10.10.41.151
                                  Subnet Mask . . . . . . . . . . . : 255.255.255.0
                                  Default Gateway . . . . . . . . . : 10.10.41.1
                                  DHCP Server . . . . . . . . . . . : 10.10.13.153
                                  DNS Servers . . . . . . . . . . . : 10.10.13.153
                                                                      10.10.13.151
                                                                      10.10.21.152
                                                                      10.10.21.153
                                                                      10.10.30.26
                                                                      10.10.31.26
                                                                      10.101.2.161
                                                                      10.101.2.162
                                  Lease Obtained. . . . . . . . . . : 08 June 2009 09:59:09
                                  Lease Expires . . . . . . . . . . : 22 June 2009 09:59:09
                          PDC

                          Code:
                          C:\>ipconfig /all
                          
                          Windows IP Configuration
                          
                             Host Name . . . . . . . . . . . . : ppws304
                             Primary Dns Suffix  . . . . . . . : p******t.com
                             Node Type . . . . . . . . . . . . : Hybrid
                             IP Routing Enabled. . . . . . . . : No
                             WINS Proxy Enabled. . . . . . . . : No
                             DNS Suffix Search List. . . . . . : p******t.com
                          
                          Ethernet adapter Local Area Connection 3:
                          
                             Connection-specific DNS Suffix  . :
                             Description . . . . . . . . . . . : HP Network Team #1
                             Physical Address. . . . . . . . . : 00-14-38-4B-3C-A0
                             DHCP Enabled. . . . . . . . . . . : No
                             Autoconfiguration Enabled . . . . : Yes
                             IPv4 Address. . . . . . . . . . . : 10.10.13.153(Preferred)
                             Subnet Mask . . . . . . . . . . . : 255.255.255.0
                             Default Gateway . . . . . . . . . : 10.10.13.1
                             DNS Servers . . . . . . . . . . . : 10.10.13.151
                                                                 10.10.13.153
                                                                 127.0.0.1
                             NetBIOS over Tcpip. . . . . . . . : Enabled
                          
                          Tunnel adapter Local Area Connection* 11:
                          
                             Media State . . . . . . . . . . . : Media disconnected
                             Connection-specific DNS Suffix  . :
                             Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
                             Physical Address. . . . . . . . . : 02-00-54-55-4E-01
                             DHCP Enabled. . . . . . . . . . . : No
                             Autoconfiguration Enabled . . . . : Yes
                          
                          Tunnel adapter Local Area Connection* 12:
                          
                             Media State . . . . . . . . . . . : Media disconnected
                             Connection-specific DNS Suffix  . :
                             Description . . . . . . . . . . . : isatap.{FDBDFD44-9242-491D-B4C3-CEDA59E3B
                          928}
                             Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
                             DHCP Enabled. . . . . . . . . . . : No
                             Autoconfiguration Enabled . . . . : Yes

                          Comment


                          • #14
                            Re: XP Domain PCs Take Forever to Apply Computer Settings?

                            Originally posted by Spuddy View Post
                            I don't believe dynamic updates are enabled. They are not applied via GPO (they're showing disabled)How can I clarify for certain?
                            I am actually referring to DNS dynamic updates on the Zone properties in the DNS management console.
                            Can you give us an overview of how your DNS servers are setup?
                            Also is there any reason the clients are configured with so many DNS servers?

                            You also mentioned previously that all your DC are running windows 2k8, the ipconfig of the PDC doesn't show any entries for IPv6. Have you disabled IPv6 by any chance?
                            Caesar's cipher - 3

                            ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

                            SFX JNRS FC U6 MNGR

                            Comment


                            • #15
                              Re: XP Domain PCs Take Forever to Apply Computer Settings?

                              Originally posted by L4ndy View Post
                              I am actually referring to DNS dynamic updates on the Zone properties in the DNS management console.
                              "Nonsecure and Secure" is showing. Does that sould right?

                              Originally posted by L4ndy
                              Can you give us an overview of how your DNS servers are setup?
                              Like I said, I'm not too clued up with DNS. If you can talk me though something, I can do it. But I'm new to the company and DNS has never been my strong point!

                              Originally posted by L4ndy
                              Also is there any reason the clients are configured with so many DNS servers?
                              I don't know the reasoning behind it, but even if I manually enter one DNS server (have tried them all) in the network properties of a client the same "applying computer settings" issue is present.

                              Originally posted by L4ndy
                              You also mentioned previously that all your DC are running windows 2k8, the ipconfig of the PDC doesn't show any entries for IPv6. Have you disabled IPv6 by any chance?
                              It does seem IPv6 has been disabled correct.

                              Comment

                              Working...
                              X