Forum Discussion

Arnold1704's avatar
Arnold1704
Copper Contributor
Sep 24, 2025

RDP Long delay between Longon-Event and GPO-Processing

Hello,

i have an 2019 rdp connection-broker and some 2019 session-hosts with current os.

Sometimes it takes a very long time (up to 15 minutes) between the logon at the session-host till i get an desktop.

In the event-log i see the security-event 4624 (an account was logged on) at 08:02.

If i check gpresult for this user i see the processing of the gpo startet at 08:16 and is finished in a few seconds.

And this times match with the user-experience that they see a "loading user profile" message.

How can i get information which task takes so long?

Regards

Arnold

 

Windows Server

1 Reply

  • kyazaferr's avatar
    kyazaferr
    MCT
    Oct 08, 2025

    That long delay between Event ID 4624 (logon) and Group Policy processing usually means the session host is waiting for a background process before it can start User Profile Initialization or Group Policy client (gpsvc) execution.
    In RDS environments, this typically comes from slow network I/O, profile load, or GPO-driven scripts.
    Every RDP logon passes through these stages:

    Authentication / Session creation → Event 4624 in Security log

    User profile load → User Profile Service (ProfSvc) events

    Group Policy and logon scripts → Microsoft-Windows-GroupPolicy/Operational log

    In your case, authentication completes instantly (08:02), but ProfSvc or gpsvc does not start until 08:16.

    Check the User Profile Service log
    Event Viewer →
     Applications and Services Logs →
      Microsoft →
       Windows →
        User Profile Service →
         Operational

    Look for events 1511–1530.
    You might see entries like
    “Windows cannot locate the server copy of your roaming profile”
    or
    “Waiting for the profile service.”
    Those reveal if the delay is caused by roaming profile path, FSLogix container, or network folder timeout.

    If you use FSLogix or UPD, check the logs under:

    C:\ProgramData\FSLogix\Logs\Profile

    Enable Group Policy debug logging

    To verify the time GPO processing begins and ends:
    Event Viewer →
     Applications and Services Logs →
      Microsoft →
       Windows →
        GroupPolicy →
         Operational
    Each policy phase is timestamped.
    If there’s a 14-minute gap before any entry appears, gpsvc was blocked by something else (typically profile loading or network initialization).

    Check DNS and SYSVOL/NETLOGON latency
    nltest /dsgetdc:<yourdomain>
    dcdiag /test:sysvolcheck

    Slow DC or SYSVOL access can delay the “Preparing Windows” / “Loading user profile” stage because Windows waits for the domain controller to return user and GPO data

    Examine network and disk activity during logon

    While reproducing the problem, run Resource Monitor (resmon.exe) → Disk and Network tabs.
    Look for heavy I/O on:
    C:\Users\<username>
    \\<fileserver>\Profiles
    \\<domain>\SYSVOL

    If any GPO forces “Always wait for the network at computer startup and logon”, logon will pause until the network stack fully initializes.
    gpresult /H c:\temp\gp.html

     

Resources