Solved

The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (Logon).

Posted on 2014-03-03
14
12,254 Views
Last Modified: 2016-05-31
I have a client that is having terrible issues with logging onto his Domain Network. The title is what I get in the event manager and the time is currently taking about 3550 seconds, which is about an hour. Yes it does eventually logon and then all is well. This started to happen about the same time that I had installed GFI Remote Max management and then the AV that comes with it, so as it happened about this time, that is the initial route I went down, first removing it all, then removing all startup items in msconfig, I did a cleanup and it looked like the computer had never been done as I removed some 34Gb of files using the disk cleanup tool, then defragged, it was 25% fragmented, then run diskcheck and whilst he was home on the weekend, everything went good again. The minute he was back in the office today, it was the same again. Which is when I went onto the event logs and found this.
Our setup is a Windows Small Business server 2011 standard with sp1, 24GB RAM adn 2.4ghz Xeon processor. The client machine is Windows7 pro with 8Gb of RAM and he logs onto a domain as mentioned.
I did some digging around on the web about this error and there are lots, but all are pointing to issues relating to Server 2008. Some of what was mentioned, was to disable IPV6, disable TCPIP Chimney, but none of these have helped the situation. As soon as you login in safemode all is well. I even tried logging in with the administrator account as this is a different profile, but still nothing,
So now I am at my wits end having spent 6hrs on it.
Can someone please help
Howell Rees
0
Comment
Question by:moodyskipper
  • 5
  • 5
  • 2
  • +1
14 Comments
 
LVL 10

Expert Comment

by:Korbus
ID: 39901132
Not a answer, but a possible brute-force-fix:  I would remove the computer from the domain, then re-join it to the domain at this point.  I've found this fixes some really weird issues, usually caused by some kind of data corruption.

Just to confirm: the logged error is on the workstation, correct?  Do you see any corresponding errors in the logon server's logs?
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 39901397
The error is about Group Policy Processing -- no need to look at anything else to account for the length of time to log on.

See:  http://blogs.technet.com/b/instan/archive/2010/07/06/the-case-of-the-mysterious-10-minute-logon-delay.aspx

There is some Group Policy which is bugging out on this particular machine.

First, be sure that it is in the proper OU on your SBS -- which should be My Business > Computers > SBS Computers.

If it is in the proper OU, then take a look at the Group Policies being applied to it.  Log onto the laptop and run the following command:

C:\>GPRESULT /h gp.html

This will create an html document which you can then post back here if you need assistance in reviewing it.

Jeff
0
 

Author Comment

by:moodyskipper
ID: 39901872
HI Both,
thanks for the answers. I will get the gpresult first and post this back here.
thanks again.
Howell
0
 

Author Comment

by:moodyskipper
ID: 39902023
Hi Jeff, I run this tonight and I saw that it created the report, but where do I find it?
thanks
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 39902033
in whatever directory you were in when you ran the report.

open up a command prompt again and see where it's defaulting
0
 

Author Comment

by:moodyskipper
ID: 39902046
Hi Jeff,
thanks and here it is, find attached.
gp.html
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
ID: 39902128
{ED430232-6C3E-4467-B2B6-A54AE99A7DB7} brocklehurst.local Inaccessible 
{89E66F76-EFF5-4344-A583-198E756CDB46} brocklehurst.local Inaccessible 
{0397C518-EF1C-48C5-A7F1-F225402A57A7} brocklehurst.local Inaccessible 
{620E6966-6E1B-4E45-862A-8E2012B3D24B} brocklehurst.local Inaccessible 
{62BE3995-6281-4FC9-A0B8-532240831DFD} brocklehurst.local Inaccessible 
{A1269D13-959B-4717-A09C-D4520FD9EFC7} brocklehurst.local Inaccessible 
{44E921EC-743B-4EA1-B7E7-27FB6C26F53C} 

Open in new window


You need to do some cleanup in your group policy
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 39902140
Actually, I don't think that's the case.  I would suspect the issue may be related to network connectivity:

Group Policy Infrastructure failed due to the error listed below.

The network is not present or not started. 

Open in new window



So, next we need to look at an IPCONFIG /ALL from the laptop.
0
 

Author Comment

by:moodyskipper
ID: 39903191
HI
Can I ask why you need Ipconfig /all information? Also what you have said is this network is not present. I took the GPResult when it was not on the network. I suppose that was wrong. I have taken it again, whilst it is on the network, but the user has found a work around. He brings the laptop to work and switches off the wifi connection, starts up and it starts fine, then turns the wireless on and he is away on the network. Unfortunately I cannot get the report to write as it comes up with an access denied at the end. I am trying to create it in the same placed as yesterday in the route of C:\. Can I suspect this as it has not authenticated with the server since it didnt log onto the network properly to start with.?
thanks
Howell
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
ID: 39903215
a standard user cannot write to the root of c: but can create a sub-directory and save to the sub-directory
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 39914292
The reason for asking for the IPCONFIG /ALL is so that I can review the network configuration of that computer.  There is nothing sensitive in providing such information with the exception of your internal domain name which may identify the organization.  You can easily just edit the report and replace that with something generic if you like.

The fact that the user is disabling/enabling wireless says a lot though - and if you posted the requested info, I could easily assess the problem.

First, though, post the gpresult report while logged into your domain.

Jeff
0
 

Author Comment

by:moodyskipper
ID: 39922268
Hi
first of all , huge apologies for the delay in replying. My client is murder to pin down and let me have his laptop. Anyway, I did this time and got him to log on normally, it took over an hour. But eventually we got in. I have tried running the gpresult again and tried putting it into various directories, but all come up with access denied, which I dont understand as he is a local administrator on his own laptop. I have run an ipconfig /all and here are the results:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : WREN
   Primary Dns Suffix  . . . . . . . : brocklehurst.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : brocklehurst.local

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
   Physical Address. . . . . . . . . : 00-24-D7-63-88-05
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : brocklehurst.local
   Description . . . . . . . . . . . : Intel(R) 82577LM Gigabit Network Connecti
on
   Physical Address. . . . . . . . . : 68-B5-99-ED-82-04
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physical Address. . . . . . . . . : 70-F3-95-CF-A0-16
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : brocklehurst.local
   Description . . . . . . . . . . . : Intel(R) Centrino(R) Ultimate-N 6300 AGN
   Physical Address. . . . . . . . . : 00-24-D7-63-88-04
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::c97f:143:778c:6631%10(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.160.37(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 11 March 2014 13:52:52
   Lease Expires . . . . . . . . . . : 12 March 2014 05:52:52
   Default Gateway . . . . . . . . . : 192.168.160.30
   DHCP Server . . . . . . . . . . . : 192.168.160.101
   DHCPv6 IAID . . . . . . . . . . . : 184558807
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-A1-FA-4B-68-B5-99-ED-82-04

   DNS Servers . . . . . . . . . . . : 192.168.160.101
   NetBIOS over Tcpip. . . . . . . . : Enabled


I hope this helps.
I also have to add that I can boot into safemode with no problem at all and on doing so have rerun gpresult, so please find this attached.
Howell Rees
gp.html
0
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 400 total points
ID: 39933652
Running gpresult in SafeMode doesn't help.  

But lets first concentrate on the IPCONFIG.

There are three connections which have priority over the Wireless connection which is trying to access the domain network.  These can definitely cause problems in processing Group Policies.

You can either disable all of the three connections listed above or you can move the "Wireless LAN adapter Wireless Network Connection" into the FIRST priority position by opening up the Network Adapters (START > ncpa.cpl > enter) then access the Advanced Settings by pressing the LEFT SIDE ALT Key and selecting Advanced > Advanced Settings from the drop-down menu.  Then use the UP arrow to move the adapter to the first position:

Advanced SettingsPosition adjustment
Reboot the computer and see if that allows a proper connection.  Once you do that, please log in and open a CMD prompt.  Change directory to C:\Users\<Username> (where <username> is the name of the user you are logged into.  Then run your gpresult /h gp.html command again.

Jeff
0

Featured Post

Do email signature updates give you a headache?

Do you feel like all of your time is spent managing email signatures? Too busy to visit every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now