How can I get a second-by-second log of Win XP bootup and login process?

My laptop is running Win XP SP1.
It recently came down with a heavy case of a logon sluggishness when it would take bloody ages for the login prompt to come up after I press Ctrl+Alt+Del. Everything works fine once the prompt is up and I log in, it is just that endless wait before the prompt (Talking up to 10-15 minutes).
It would be nice to be able to see what processes take place during that wait time - maybe an unnecessary service is starting, maybe an unstable driver is loading, who knows.
I tried "verbose logon", but nothing is displayed during the long wait time.
And the regular "F8" boot log does not have any timeline, so it is hard to tell WHERE XP "hangs".

(I can't just roll back the system, since system restore is OFF because of a proprietary app that we use, so I have to either troubleshoot or reinstall my XP along with the endless slew of apps.)
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lee W, MVPTechnology and Business Process AdvisorCommented:
Off hand, I'd say you need to replace a few DLLs with debug versions - typically only available to programmers with subscriptions to MSDN.  Check the userenv.log file %windir%\debug\UserMode
adzip2001Author Commented:
Userenv.log: Warmer, but not it yet, not enough detail... This is all the info that it had about my logon this morning:
USERENV(2d0.2d4) 07:40:25:088 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(2d0.2d4) 07:40:25:088 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(2d0.2d4) 07:40:25:088 CUserProfile::CleanupUserProfile: Ref Count is not 0

Is there a 3rd party utility out there that can do this?
Lee W, MVPTechnology and Business Process AdvisorCommented:
Using a debug version of a DLL (I don't remember which one) this USERENV log is MUCH more detailed.  Also - have you looked at event log to see what's going on?

Sorry, don't know of any third party app that can monitor the login like that.

My guess is it's trying to do something with the network and being unsuccessful contacting a server for what it's trying to do, timing out trying.
CompTIA Security+

Learn the essential functions of CompTIA Security+, which establishes the core knowledge required of any cybersecurity role and leads professionals into intermediate-level cybersecurity jobs.

adzip2001Author Commented:
> My guess is it's trying to do something with the network and being unsuccessful contacting a server for what it's trying to do, timing out trying.
- That's what I'm thinking too, I just wish I could figure out what exactly the darn thing is...

Event log didn't yield much help -- I saw only the events after the logon.

How difficult is it to subscribe to MSDN? I should prob'ly try that debug .DLL
(I would imagine that I will just need to replace the regular one somewhere in the Windows folder).
I don't remeber if it's working but there are the followings switches to try:

multi(0)disk(1)rdisk(0)partition(1)\WINDOWS="Windows XP Professional" /bootlog /debug

in the boot.ini file. I could be wrong, these could be switches for servers, but give it a try. Let's say you have the following boot.ini:

[boot loader]
[operating systems]
multi(0)disk(1)rdisk(0)partition(1)\WINDOWS="Windows XP Professional" /fastdetect

add a line like this

multi(0)disk(1)rdisk(0)partition(1)\WINDOWS="Windows XP debug mode mode" /bootlog /debug

Next time you start computer there will be a 30 second delay when you can select "Windows XP debug mode". If the switches are right the system will go (slower than normal) you'll have the bootlog file.
adzip2001Author Commented:
Quick question: where will the bootlog be saved to?
adzip2001Author Commented:
Disregard my previous comment - it goes to %SYSTEMROOT%\ntbtlog.txt

Closer to the solution, still there are no timestamps and I suspect that all that there is in the log takes place BEFORE the invitation to press "Ctrl+Alt+Del to log in".
Yet the time period in question - the time between Ctrl+Alt+Del and login prompt - still remains a mystery. No messages are displayed during that time and I don't think that those processes are reflected in the log.
You can use bootvis. It purpose is to optimize the startup of a windows xp, but it makes a timelog too. Download from here:

since I did'n't find it on microsoft site.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
adzip2001Author Commented:
Great answer, and thank you for finding bootvis -- I have been scouring the Web for days trying to find it since it went MIA from Microsoft's site.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.