Link to home
Start Free TrialLog in
Avatar of CLERS
CLERSFlag for Afghanistan

asked on

Windows 7 Slow Logoff for active directory users


We have many users on Windows 7 who can log off in a minute or so, but recently several users have reported it's taking them 5-10 minutes or more to log off.  We haven't made any changes to group policy, no shut down scripts are running, There were some recent windows updates, but no other policy or system changes recently.  I've disabled the "shutdown: clear virtual memory file" option in Group Policy, I've tried disabling the FW and other services, all to no avail.  If it log on with a local user and log off, there is no slowdown, but if I log on with an AD user, it always takes at least 5 minutes to log off.  

In the event viewer I see this as a possible clue:
Event viewer
 
4626  -  The COM+ Event System timed out attempting to fire the Logoff method on event class {D5978630-5B9F-11D1-8DD2-00AA004ABD5E} for publisher and subscriber . The subscriber failed to respond within 180 seconds. The display name of the subscription is "wltrynt SENS Logon Spy Subscription". The HRESULT was 800705b4.
 
6006 - This comes up both before and after the 4626 error
The winlogon notification subscriber <Sens> took 193 second(s) to handle the notification event (Logoff).

There is a hotfix designed to address this problem.  I've installed it but there was no improvement.

Tried these:

In group policy, set Windows < Security < Sec Options < Shutdown: clear virt mem page file to "Disabled"

"gpedit.msc" and press 'Enter'. You would get Computer Configuration to Administrative Templates to System to Shut down Options. You can double click on "Turn off automatic termination of applications that block or cancel" and finish by checking 'Enable'.

double click on the 'WaitToKillServiceTimeOut' and change the value data to suite your immediate needs. After the changes, just click 'OK' to save your settings. [Side note: The default of this value data is usually 12000 milliseconds but this should be changed to between 2000 to 20000 milliseconds].
Avatar of CLERS
CLERS
Flag of Afghanistan image

ASKER

Active Directory is running on Windows 2003 servers and the laptops in question are Dell Latitude e6400 and 6410s.  Drivers have been updated ad nauseum.  
Do you use  Symantec Endpoint Protection? If so then try uninstalling on a test and see if issue vanishes.
ASKER CERTIFIED SOLUTION
Avatar of Neil Russell
Neil Russell
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of CLERS

ASKER

Neilsr, yes, we run Symantec.  Disabling that didn't help.  I'm in the very slow process of following MS's "Clean Boot" suggestion, similar to yours above, but instead adding in about 1/2 the services at a time to speed up the identification of the service causing the problem.  
Yeah the Binary tree aproach does speed it up a bit ;)
Let us know what you find.

Are these laptops or desk tops? Both?
try to do the following

Disable any unused network cards.

Run dcdiag post results.

Make sure servers are only pointing to internal DNS servers.

Setup DNS Forwarders
Avatar of CLERS

ASKER

Neilsr, I was able to solve the problem similar to your description.  I took out all services and slowly added them back in.  3 hours later I was able to get all key services running without a logoff hangup.  Thanks.
Avatar of CLERS

ASKER

Just took a lot of time.  Good suggestion though.  Thanks.
Your welcome, glad your up and running.