When a user logged on to a corporate laptop, the user had to wait between 3 and 7 minutes before the desktop was displayed. Obviously, this took way too long. It should not take more than a minute, if configured properly.
The user account was new and configured with Folder Redirection through GroupPolicy. The laptop was configured with Offline Files through GroupPolicy.
After a period of testing and analyzing with debug logging, process monitoring and digging into all the knowledge on the internet, I still could not find the solution. On the internet, you find a lot of solutions for problems with Offline Files, Folder Redirection and logon times. Needless to mention, I tried all of them.
I decided to peel off the whole process and build a test OU-structure with its policies and settings. Doing it this way, it probably cost me more time, but it also revealed a couple of misconfigurations and complications of policies and settings on the corporate laptop, which were restored later.
In my tests, the last thing in the process of Offline Files was to enable encryption. Once I enabled the encryption I saw that the variable logon-delay got back. The process for encryption is controlled by the program EFSUI.exe (Encrypting File System) in the folder C:\WINDOWS\SYSTEM32.
During the process of encrypting the Offline Files in the cache (C:\WINDOWS\CSC), EFSUI.exe will start and stop automatically and therefore it is only shortly visible in the Taskmanager.
In my own Hyper-V testlab I was using the corporate Windows 7 SP1 Professional (32bit) image and decided to configure a new Windows 7 SP1 Professional machine. After the installation and adding the machine to the domain, I saw this machine was working without problems. What was going on?
I did a comparison between the two test machines and discovered I had accidentally installed the new machine with a Windows 7 SP1 (64bit) ISO.
Now, the solution was in sight.
I compared the EFSUI.exe files and found out that the files were slightly different in size and time. The original 32bit version (6. 1. 7600. 16385, Size=12,0 kB, Changed=14-7-2009 3:14) and the 64bit version (6. 1. 7600. 16385, Size=12,5 kB, Changed=14-7-2009 3:39).
Then, I replaced the 32bit version from the corporate laptop with the 64bit version and tested the logon process again. Result: in less than 50 seconds from pushing the power button to display the user’s desktop. Now, that’s the speed I was looking for!
The last thing remaining was to check if the encryption process was working like it was supposed to do.
And it did.
We decided to push the 64bit file with SCCM and added it to the corporate image as well.
It was a rewarding journey for me and our client was happy.
Auteur: Nico Boerema, Technology Professional
Email Nico Boerema
Lees alle blogberichten van Nico Boerema
Deel dit bericht