Windows 7 Slow Logoff for active directory users


We have many users on Windows 7 who can log off in a minute or so, but recently several users have reported it's taking them 5-10 minutes or more to log off.  We haven't made any changes to group policy, no shut down scripts are running, There were some recent windows updates, but no other policy or system changes recently.  I've disabled the "shutdown: clear virtual memory file" option in Group Policy, I've tried disabling the FW and other services, all to no avail.  If it log on with a local user and log off, there is no slowdown, but if I log on with an AD user, it always takes at least 5 minutes to log off.  

In the event viewer I see this as a possible clue:
Event viewer
 
4626  -  The COM+ Event System timed out attempting to fire the Logoff method on event class {D5978630-5B9F-11D1-8DD2-00AA004ABD5E} for publisher and subscriber . The subscriber failed to respond within 180 seconds. The display name of the subscription is "wltrynt SENS Logon Spy Subscription". The HRESULT was 800705b4.
 
6006 - This comes up both before and after the 4626 error
The winlogon notification subscriber <Sens> took 193 second(s) to handle the notification event (Logoff).

There is a hotfix designed to address this problem.  I've installed it but there was no improvement.

Tried these:

In group policy, set Windows < Security < Sec Options < Shutdown: clear virt mem page file to "Disabled"

"gpedit.msc" and press 'Enter'. You would get Computer Configuration to Administrative Templates to System to Shut down Options. You can double click on "Turn off automatic termination of applications that block or cancel" and finish by checking 'Enable'.

double click on the 'WaitToKillServiceTimeOut' and change the value data to suite your immediate needs. After the changes, just click 'OK' to save your settings. [Side note: The default of this value data is usually 12000 milliseconds but this should be changed to between 2000 to 20000 milliseconds].
CLERSAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

CLERSAuthor Commented:
Active Directory is running on Windows 2003 servers and the laptops in question are Dell Latitude e6400 and 6410s.  Drivers have been updated ad nauseum.  
0
Neil RussellTechnical Development LeadCommented:
Do you use  Symantec Endpoint Protection? If so then try uninstalling on a test and see if issue vanishes.
0
Neil RussellTechnical Development LeadCommented:
Try running MSCONFIG, dissable all non MS Services and see if that works fine. IF it does then turn on one service at a time and try angain until you find the culprit.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

CLERSAuthor Commented:
Neilsr, yes, we run Symantec.  Disabling that didn't help.  I'm in the very slow process of following MS's "Clean Boot" suggestion, similar to yours above, but instead adding in about 1/2 the services at a time to speed up the identification of the service causing the problem.  
0
Neil RussellTechnical Development LeadCommented:
Yeah the Binary tree aproach does speed it up a bit ;)
Let us know what you find.

Are these laptops or desk tops? Both?
0
mt_spyCommented:
try to do the following

Disable any unused network cards.

Run dcdiag post results.

Make sure servers are only pointing to internal DNS servers.

Setup DNS Forwarders
0
CLERSAuthor Commented:
Neilsr, I was able to solve the problem similar to your description.  I took out all services and slowly added them back in.  3 hours later I was able to get all key services running without a logoff hangup.  Thanks.
0
CLERSAuthor Commented:
Just took a lot of time.  Good suggestion though.  Thanks.
0
Neil RussellTechnical Development LeadCommented:
Your welcome, glad your up and running.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.