Perhaps one of the most frustrating issues to troubleshoot is a system that sits at the “Applying Computer Settings …” screen for what seems like forever before (eventually) getting to the point that you can log in. Interestingly, although several of these cases are routed to the Performance team as a perceived system hang, the fact of the matter is that the system really isn’t hung at all. In the overwhelming majority of the cases, the system is trying to complete an operation and is waiting for a response. With that having been said, the unfortunate reality is that there are literally hundreds of possible causes – but today, we’re going to go over a couple of them, and show you some quick troubleshooting shortcuts. So without further ado …
Before we get too deep into what’s going on with “Applying Computer Settings”, let’s take a quick look at the boot sequence for a client machine joined to an Active Directory domain that receives a dynamic IP Address:
- User powers on the machine which goes through a POST (Power-On Self-Test) sequence. The POST sequence displays information about the BIOS, and the amount of physical memory installed. The system will also attempt t initialize PCI cards. Once the POST sequence has completed, you will normally see a basic table outlining the system configuration including disk information, and PCI card information.
-
The system goes through the process of acquiring a DHCP address, normally referred to as DORA:
- DHCP (D)iscover
- DHCP (O)ffer
- DHCP (R)equest
- DCHP (A)cknowledge
If the system is able to successfully acquire an IP Address, then various networking configuration settings are populated, such as Default Gateway, DNS Servers, WINS servers and so on. If the system is not able to acquire an IP Address, then the system will time out / fail trying to process various networking functions - including the application of group policies and even possibly logging on to the client machine. - Assuming that the system received an IP address from the DHCP server, the DHCP Client service will try to register its IP Address with the DNS Server
- The system attempts to query DNS for a SRV record for a Domain Controller. If the system locates a domain controller it then begins the process of applying system-level domain and group policies. If no DC can be located, then we are in another timeout situation where group policies will fail to apply.
- Once the computer settings are applied, the user logon prompt is displayed and the user enters their credentials
- If the system was able to contact a domain controller, then the logon is authenticated and user policies are applied. If the system was not able to contact a domain controller, the system may log the user in with cached credentials. Since no domain controller could be located, user GPO’s will not be applied.
Now, that’s the high level overview of the startup process. So where does the “Applying Computer Settings” piece come into play? Where you’re most likely to experience that issue is between steps 4 and 5. The system has located a Domain Controller, and is querying it for a list of group policies that should be applied.
Now that we know where the problem is occurring in our process, how can we best troubleshoot it? There are a couple of different approaches to take. Believe it or not, one of the quickest ways to isolate if the problem is occurring locally or caused by something requiring network resources is simply to unplug the network cable. By “breaking” the network connection, the network requests should time out nearly instantaneously and the logon process should continue. You could also use the MSCONFIG.EXE utility to temporarily prevent non-Microsoft services from starting up the next time the system boots. To do this, launch the System Configuration Utility, and on the Services tab, hide all non-Microsoft Services, and then select “Disable All”. When you reboot the system, if the problem does not recur, then you now have a much smaller list of potential culprits to troubleshoot.
The majority of instances that we tend to run into however, revolve around group policy processing. We wrote a couple of posts last year on Group Policies (see the links below), but the best way to really troubleshoot a problem like this is to enable USERENV logging and then review the log file. Each of the entries in the log file has a timestamp, so you will be able to tell if there are any processing delays or issues locating a specific Group Policy etc. Our Directory Services support team has plenty of experience looking at USERENV logs and troubleshooting issues where systems are stuck at “Applying Computer Settings”, so if you run into one of these situations that you just can’t quite seem to isolate – give us (well, the Directory Services guys) a call so we can help you get it resolved!
With that, another post comes to an end. Until next time …
Additional Resources:
- Microsoft KB 2379016 A computer that is running Windows Vista or Windows Server 2008 stops res...
- Microsoft KB247811: How Domain Controllers are Located in Windows
- Microsoft KB 221833: How to enable user environment debug logging in retail builds of Windows ...
- Ask the Performance Team: The Basics of Group Policies
- Ask the Performance Team: GP Logging on Windows Vista
| Share this post : |
|
|
|
|
|