question

Alexander-6028 avatar image
0 Votes"
Alexander-6028 asked DaisyZhou-MSFT answered

GPO takes long time to process

Hello community,

For some employees, we have the problem that the total GPO processing take an extremely long time.
The processing of the GPO components (Group Policy Environment, Registry, Services, ...) takes up to 21 seconds (screenshot at the bottom of the post).
The screenshot is taken from Group Policy Result Wizard.
This error is reproducible (while running gpupdate) and also occurs if the user uses a different domain controller.
The error does not happen to everyone - not even with users and computers that are in the same AD OU.


To log the error, I have already created the registry entry GPSvcDebugLevel.
https://social.technet.microsoft.com/wiki/contents/articles/4506.group-policy-debug-log-settings.aspx

I have added an excerpt from the log file when processing the “Group Policy Envorinment” (gpsvc.log).

Here you can see that step takes just under 21 seconds.

 GPSVC(1ed0.2dc8) 09:03:47:804 LogExtSessionStatus: Successfully logged Extension Session data
 GPSVC(1ed0.2dc8) 09:03:47:817 ProcessGPOList: lpGPOInfo->lpGPInfoHandle->dwExtnCount is 2 for Group Policy Environment.
 GPSVC(1ed0.2dc8) 09:04:09:000 IsSecureCachingDisabled: secureCachingState = 2.

In order to expand the log additionally, I configured further logs via GPO.
Computer Configuration> Administrative Templates> System> Group Policy> Logging and tracing
Here I have set and activated the event logging to Informational, Warning and Errors for all available settings.

In this log (computer.log) you can see that these steps are the time-consuming steps.

 2021-06-17 09: 03: 47.825 [pid = 0x1ed0, tid = 0x2dc8] Licensing subsystem initialized.
 2021-06-17 09: 03: 51.927 [pid = 0x1ed0, tid = 0x2dc8] User information initialized.
 2021-06-17 09: 04: 08.960 [pid = 0x1ed0, tid = 0x2dc8] Variable% ComSpec% = "C: \ WINDOWS \ system32 \ cmd.exe"


What else can I do to narrow down the error or to fix it?

Attachments:
106536-computer.log
106555-gpsvc.log
106487-group-policy-result.png




windows-active-directorywindows-group-policy
computer.log (46.1 KiB)
gpsvc.log (3.2 KiB)
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @Alexander-6028,
How are things going on your end? Please keep me posted on this issue.
If you have any further questions or concerns about this question, please let us know.
I appreciate your time and efforts.

Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

0 Votes 0 ·

Hello @Alexander-6028,
I just want to confirm the current situations.
Please feel free to let us know if you need further assistance.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered Alexander-6028 commented

Hello @Alexander-6028,

Thank you for posting here.

From the information provided above, it seems all GPO settings are applied successfully.

For the possible reasons why some GPOs takes long time to process:

1.The performance of the client machine
2.Domain network performance

You can try to troubleshoot from the above two aspects.

Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @DaisyZhou-MSFT

Thanks for your message.

Yes, it seems to be a client problem, because if I log on with another user account the same long processing time occurs.
If the user tries to log on to another computer, the processing time is short.
Do you have any tools, programs, tips for checking the performance of the machine while performing the GPOs?

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered Alexander-6028 commented

Hello @Alexander-6028,

Thank you for your reply.

Based on my knowledge, you can try the Windows built-in Performance Monitor tool.

108032-per.png


For more information about Performance Monitor tool, please refer to links below.

Windows Performance Monitor Overview
https://techcommunity.microsoft.com/t5/ask-the-performance-team/windows-performance-monitor-overview/ba-p/375481

Introducing the new Performance Monitor for Windows
https://techcommunity.microsoft.com/t5/windows-admin-center-blog/introducing-the-new-performance-monitor-for-windows/ba-p/957991


Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.



per.png (29.2 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @DaisyZhou-MSFT

I checked the client performance and do not see any bottlenecks or abnormalities.

After this check, we reinstalled the client and deleted the object from Active Directory.
We changed the switch port, cables, docking station.
No improvement.

We tried to log in with another user to the client and this user has the same long time while processing the GPOs.
The problem does not occur if both users (normal client user and my test user) try to log in to another computer (same model, CPU generation, hard disk, RAM, ...).
So it must be something with the client.

I would be interested in what the computer does in step "User information initialized." and why this takes so long time.
I think if we know that we will find the fault...
But I do not find anything about this while searching the internet.

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered Alexander-6028 commented

Hello @Alexander-6028,

Thank you for your update.

It seems one/more GPO settings caused the issue.

You can check as below:

Test 1
1.Create a test domain user in domain (not in any OU). Right click domain name -> New->User (I mean this new test user applies no GPO setting except Default Domain Policy).
108873-user1.png

2.Logon this problematic machine using this new test user and check if the issue persists.


Test 2
1.Move this problematic machine from OU to domain temporarily if possible.

2.Logon this problematic machine using this new test user and check if the issue persists.


Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.





user1.png (32.6 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @DaisyZhou-MSFT

We apply four GPOs in the root "folder" of the domain.
So I created an OU where the inheritance is blocked and no GPO is linked.
I created the new user in this OU and moved the computer to this OU too.
The processing time (of no GPO) still is long.

0 Votes 0 ·
ParvezGadhia-1089 avatar image
0 Votes"
ParvezGadhia-1089 answered Alexander-6028 commented

Just give a try by renaming registry.pol file - "C:\Windows\system32\GroupPolicy\Machine\Registry.pol"

then run gpupdate /force

restart the machine


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @ParvezGadhia-1089

The client does not have the folder "Machine" in "C:\Windows\system32\GroupPolicy".
So I deleted the GroupPolicyUsers and GroupPolicy folder and run gpupdate /force + reboot of the machine.
But now the two folders are missing and seems not to be recreated after a few reboots and gpupdates.
The strange thing now is that the processing of the GPOs is fine for about half an our.
After this short time the processing time is long again.

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered

Hello @Alexander-6028,

Thank you for your update.

Based on your test below. I think the issue is related to GPO.

110970-gpo.png

You mentioned earlier,two machines with the same hardware, one has a problem and the other has no problem, then according to my understanding, the hardware of the machine is the same, the problem may be related to the operating system or the software or any application in the operating system.


You can try to perform clean boot on the problematic machine and check if the issue persists.

How to perform a clean boot in Windows
https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd

If the issue disappears in clean boot mode, then maybe the third app or service caused the issue.


Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.



gpo.png (33.7 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.