You are currently offline, waiting for your internet to reconnect

Unexpectedly slow logon caused by large WMI repository in Windows or Windows Server

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

Symptoms

You notice one of the following symptoms:

  • The logon process is unexpectedly slow when users log on to the Remote Desktop servers.
  • Users experience delays when they log on to the console of a Windows client or of a Windows Server-based computer.

This delay is logged in the Userenv.log log file in Windows Server 2003 and in the Gpsvc.log log file in Windows 8.1, Windows 8, and Windows 7 clients and on Windows Server 2012 R2-based, Windows Server 2012-based, Windows Server 2008 R2-based, and Windows Server 2008-based computers.

To enable USERENV Logging in Windows Server 2003, see the following Microsoft Knowledge Base article:

221833 How to enable user environment debug logging in retail builds of Windows

Example Userenv.log entry:

USERENV(234.82c) 08:28:36:210 ParseRegistryFile: Leaving.
USERENV(234.82c) 08:30:26:839 LogRegistry RsopData: Successfully logged registry Rsop data

This example shows a ~ 2-minute delay in writing RSoP logging data.

How to enable logging in the Gpsvc.log file on Windows 8.1, Windows 8, and Windows 7 clients and Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, and Windows Server 2008 computers

To enable logging in the Gpsvc.log file, follow these steps. 

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
  3. On the Edit menu, point to New, and then click Key.
  4. Type Diagnostics, and then press Enter.
  5. Right-click the Diagnostics entry, point to New, and then click DWORD Value.
  6. Type GPSvcDebugLevel, and then press Enter.
  7. Right-click GPSvcDebugLevel, and then click Modify.
  8. In the Value data box, type 0x30002, and then click OK.
  9. Exit Registry Editor.
  10. At a command prompt, type the following command, and then press Enter:
    gpupdate /force
  11. View the Gpsvc.log file in the following folder:
    %windir%\debug\usermode

    Note If the Usermode folder does not exist under %WINDIR%\debug\, the Gpsvc.log file will not be created. If the Usermode folder does not exist, create it under %windir%\debug.

Example Gpsvc.log entry:

GPSVC(638.13d4) hh:mm:41:316 AllocAdmFileInfo: Adding File name <\\contoso.com\sysvol\contoso.com\Policies\{<policy guid>}\Adm\wuau.adm> to the Adm list.
GPSVC(638.13d4) hh:mm:47:556 LogRegistry RsopData: Successfully logged registry Rsop data

This example shows a ~ 6-second delay in writing RSoP logging data.
Cause

This issue may occur if RSoP logging is enabled and there is a large WMI repository on the problem Windows client or Windows Server computer. The WMI repository is located on the following path:

%windir%\System32\Wbem\Repository

RSoP uses the CIMOM database through WMI. When a computer logs on to a network, information such as the computer hardware, Group Policy Software Installation settings, Internet Explorer Maintenance settings, Scripts, Folder Redirection settings, and Security Settings, are written to the CIMOM database. When you start RSoP in logging mode, RSoP reports policy settings that have been applied by using the information that is provided in the CIMOM database.

The RSoP logging process to the WMI repository causes delays to console logons and especially Remote Desktop logons.

Larger WMI repository sizes in %windir%\system32\wbem\repository cause longer logon delays.

For more information about RSoP, see the following Microsoft TechNet topic:

RSoP Overview
http://technet.microsoft.com/en-us/library/cc778752(WS.10).aspx

Resolution

Workaround

To work around this issue, determine the size of the WMI repository.

The WMI repository is located on the following path:

%windir%\System32\Wbem\Repository

If the size of the WMI repository is large, temporarily disable RSoP logging to monitor its impact on user logons.

To disable RSoP logging, enable the following Group Policy setting:

 

Turn off RSoP logging (Computer Configuration/Administrative Templates/System/Group Policy)

This setting allows you to enable or disable Resultant Set of Policy (RSoP) logging on a client computer.

After you enable this policy, run gpupdate /force on the computer, and then restart the computer. Measure the impact on user logon duration.

Note By disabling RSoP logging, you prevent the RSoP snap-in (rsop.msc) from running on that computer. You can get RSoP modeling information by using the Group Policy Management Console (GPMC), if it is necessary.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 2020286 - Last Review: 04/28/2014 17:51:00 - Revision: 11.0

Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Standard Edition (32-bit x86), Windows Server 2008 Datacenter, Windows Server 2008 Enterprise, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Standard, Windows Server 2012 Datacenter, Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows 7 Enterprise, Windows 7 Professional, Windows 8, Windows 8.1

  • KB2020286
Feedback
ody>amp;did=1&t=">