RDP Long delay between Longon-Event and GPO-Processing

That long delay between Event ID 4624 (logon) and Group Policy processing usually means the session host is waiting for a background process before it can start User Profile Initialization or Group Policy client (gpsvc) execution.
In RDS environments, this typically comes from slow network I/O, profile load, or GPO-driven scripts.
Every RDP logon passes through these stages:

Authentication / Session creation → Event 4624 in Security log

User profile load → User Profile Service (ProfSvc) events

Group Policy and logon scripts → Microsoft-Windows-GroupPolicy/Operational log

In your case, authentication completes instantly (08:02), but ProfSvc or gpsvc does not start until 08:16.

Check the User Profile Service log
Event Viewer →
 Applications and Services Logs →
  Microsoft →
   Windows →
    User Profile Service →
     Operational

Look for events 1511–1530.
You might see entries like
“Windows cannot locate the server copy of your roaming profile”
or
“Waiting for the profile service.”
Those reveal if the delay is caused by roaming profile path, FSLogix container, or network folder timeout.

If you use FSLogix or UPD, check the logs under:

C:\ProgramData\FSLogix\Logs\Profile

Enable Group Policy debug logging

To verify the time GPO processing begins and ends:
Event Viewer →
 Applications and Services Logs →
  Microsoft →
   Windows →
    GroupPolicy →
     Operational
Each policy phase is timestamped.
If there’s a 14-minute gap before any entry appears, gpsvc was blocked by something else (typically profile loading or network initialization).

Check DNS and SYSVOL/NETLOGON latency
nltest /dsgetdc:<yourdomain>
dcdiag /test:sysvolcheck

Slow DC or SYSVOL access can delay the “Preparing Windows” / “Loading user profile” stage because Windows waits for the domain controller to return user and GPO data

Examine network and disk activity during logon

While reproducing the problem, run Resource Monitor (resmon.exe) → Disk and Network tabs.
Look for heavy I/O on:
C:\Users\<username>
\\<fileserver>\Profiles
\\<domain>\SYSVOL

If any GPO forces “Always wait for the network at computer startup and logon”, logon will pause until the network stack fully initializes.
gpresult /H c:\temp\gp.html