Takes Forever to Log in from Workstations

jcantele · 05-15-2007, 10:15 AM

Hi everyone,

The problem I'm having is that whenever I log in as administrator on the server (running Windows Server 2003), it comes right up. However, if I try to log in as administrator on the individual XP workstations, it will take approximatly 30 minutes to 2 hours to come up. I am able to log in as other users on the workstations just fine, however.

geewhiz · 05-15-2007, 01:40 PM

Where those other users created locally on the XP clients?

jcantele · 05-15-2007, 02:13 PM

no, they were created on the server (but also created on local machines afterwards).

geewhiz · 05-15-2007, 02:39 PM

I don't know much about this, new to it all

But I was having problems with long time for loggins because my DNS wasn't setup correctly.

geewhiz · 05-15-2007, 03:09 PM

Make sure your NAT, or router, is configured such that it points to your server as the DNS server.

newhouse1390 · 05-16-2007, 07:17 AM

Login to a computer with the slow logon times.

Open up a command prompt (Start -- Run -- "cmd")

Type "ipconfig /all"

Paste results here. This will help make sure that DNS is configured properly on the workstations. If the machine is on the network and DNS is not configured correctly you will not be able to login to the domain unless you have already been able to login with that user previously. You would then be able to login with cached credentials.

You are running Active Directory, right?

jcantele · 05-23-2007, 10:17 AM

Hey guys, thanks for the help. Sorry for the delayed response.

I am running active directory. Here's the ipconfig window:

newhouse1390 · 05-23-2007, 01:14 PM

Is 192.168.2.100 the address of the domain controller?

jcantele · 05-23-2007, 01:19 PM

Yes, it is.

newhouse1390 · 05-23-2007, 01:31 PM

Let me make sure I understand the issue...

You have a Windows 2003 AD environment and all the machines that are haveing this issue are on the domain. You create users in the AD Users and Computers Console and they can logon/logoff fine, but when you try to logon as the LOCAL administroator it takes 30 min to 1 hour?

jcantele · 05-23-2007, 02:28 PM

Yes to all of that except the last part. It is when the workstations try to log on to the DOMAIN administrator account that this problem occurs.

This problem is occuring on ALL workstations that are running XP. My boss says there are a few which are running Windows 2000 which don't have this problem.

crazijoe · 05-24-2007, 07:35 AM

Disable the Windows Firewall service. Make sure you disable it, not just turn it off.

newhouse1390 · 05-24-2007, 09:02 AM

You are not using roaming profiles are you?

If not logon and delete the locally stored Domain Administrator profile, by opening system properties > advanced > user profiles.

Try creating a new domain admin account (for testing) and see if the same issue occurs.

jcantele · 05-24-2007, 01:17 PM

Quote:

Originally Posted by crazijoe

Disable the Windows Firewall service. Make sure you disable it, not just turn it off.

My boss is extremely wary of turning off the Windows Firewall. Could you elaborate a bit on your thinking here?

jcantele · 05-24-2007, 01:20 PM

Quote:

Originally Posted by newhouse1390

You are not using roaming profiles are you?

If not logon and delete the locally stored Domain Administrator profile, by opening system properties > advanced > user profiles.

Try creating a new domain admin account (for testing) and see if the same issue occurs.

Not using roaming profiles.

Ok, I deleted the domain adminstrator account on the local workstation, and created a new one. Same thing.

newhouse1390 · 05-24-2007, 01:33 PM

We need to get this issue isolated, in order to continue troubleshooting and to make sure that the communication is not hindered in any way we must make sure that the Windows firewall and other anti-virus programs are turned off.

You can isolate this policy (firewall off) to only one machine.

This may be a little out there but boot into safe mode w/networkking and logon to the domain with the domain admin account and see if the issue still occurs.

jcantele · 05-24-2007, 02:00 PM

Does being in safe mode with networking disable the firewall?

I have not been able to turn off the firewall yet because it is set up as a group policy. How can I disable a firewall on an individual workstation without changing the group policy?

I have just tested it in safe mode with networking.. Same problem.

crazijoe · 05-24-2007, 02:00 PM

Quote:

Originally Posted by jcantele

My boss is extremely wary of turning off the Windows Firewall. Could you elaborate a bit on your thinking here?

It is known how ineffective Windows firewall is and thus most enterprise networks will implement a third party program. Beit stand alone or integrated with antivirus software (client security). Windows firewall will only monitor oneway while third party will watch both.
If you do use a third party firewall solution, you should turn off the Windows firewall anyways because you should always run a single instance of a firewall and AV program.

If a workstation is part of a domain, it will actually have 2 Windows firewall profiles. If you turn off Windows firewall in a domain users profile that is logged into the machine, before he actually logs in, the firewall is enabled. When the machine applies the user settings, it will shut off the firewall. The only real way of disabling thie firewall is to disable Windows Firewall and ICS service. By default, Windows Firewall does not allow incoming ICMP Echo messages and therefore the computer cannot send an ICMP Echo Reply in response. You can set the firewall to permit certian ICMP settings but since we already had individual third party firewall on all workstations, we decided to disable it.
We have notice that this effected our domain logons and after we disabled it on all workstations, the problem was resolved.

newhouse1390 · 05-24-2007, 02:03 PM

This issue only affects Domain Administrators?

Try taking a machine off the domain and putting it back on.

jcantele · 05-24-2007, 03:05 PM

crazijoe, I'm goign to try to relay back some of my boss's response to your post.

He says that he does not see how the Windows firewall could create this problem, because it only exists for a single domain administrator, "Administrator." All of the other administrator accounts work fine. How could the windows firewall create a problem with a single account, with all of the other accounts working fine?

05-15-2007, 10:15 AM	#1 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Takes Forever to Log in from Workstations Hi everyone, The problem I'm having is that whenever I log in as administrator on the server (running Windows Server 2003), it comes right up. However, if I try to log in as administrator on the individual XP workstations, it will take approximatly 30 minutes to 2 hours to come up. I am able to log in as other users on the workstations just fine, however.

05-15-2007, 01:40 PM	#2 (permalink)
geewhiz Registered User Join Date: Jul 2006 Posts: 138 OS: Vista, Suse	Re: Takes Forever to Log in from Workstations Where those other users created locally on the XP clients?

05-15-2007, 02:13 PM	#3 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Re: Takes Forever to Log in from Workstations no, they were created on the server (but also created on local machines afterwards).

05-15-2007, 02:39 PM	#4 (permalink)
geewhiz Registered User Join Date: Jul 2006 Posts: 138 OS: Vista, Suse	Re: Takes Forever to Log in from Workstations I don't know much about this, new to it all But I was having problems with long time for loggins because my DNS wasn't setup correctly.

05-15-2007, 03:09 PM	#5 (permalink)
geewhiz Registered User Join Date: Jul 2006 Posts: 138 OS: Vista, Suse	Re: Takes Forever to Log in from Workstations Make sure your NAT, or router, is configured such that it points to your server as the DNS server.

05-16-2007, 07:17 AM	#6 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Re: Takes Forever to Log in from Workstations Login to a computer with the slow logon times. Open up a command prompt (Start -- Run -- "cmd") Type "ipconfig /all" Paste results here. This will help make sure that DNS is configured properly on the workstations. If the machine is on the network and DNS is not configured correctly you will not be able to login to the domain unless you have already been able to login with that user previously. You would then be able to login with cached credentials. You are running Active Directory, right? __________________ Because you can read this thank a teacher, because it's English thank a soldier.

05-23-2007, 10:17 AM	#7 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Re: Takes Forever to Log in from Workstations Hey guys, thanks for the help. Sorry for the delayed response. I am running active directory. Here's the ipconfig window:

05-23-2007, 01:14 PM	#8 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Re: Takes Forever to Log in from Workstations Is 192.168.2.100 the address of the domain controller? __________________ Because you can read this thank a teacher, because it's English thank a soldier.

05-23-2007, 01:19 PM	#9 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Re: Takes Forever to Log in from Workstations Yes, it is.

05-23-2007, 01:31 PM	#10 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Re: Takes Forever to Log in from Workstations Let me make sure I understand the issue... You have a Windows 2003 AD environment and all the machines that are haveing this issue are on the domain. You create users in the AD Users and Computers Console and they can logon/logoff fine, but when you try to logon as the LOCAL administroator it takes 30 min to 1 hour? __________________ Because you can read this thank a teacher, because it's English thank a soldier.

05-23-2007, 02:28 PM	#11 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Re: Takes Forever to Log in from Workstations Yes to all of that except the last part. It is when the workstations try to log on to the DOMAIN administrator account that this problem occurs. This problem is occuring on ALL workstations that are running XP. My boss says there are a few which are running Windows 2000 which don't have this problem.

05-24-2007, 07:35 AM	#12 (permalink)
crazijoe Registered User Join Date: Oct 2004 Location: Omaha, The Center of the Universe Posts: 7,632 OS: WinXP, Win2K3 My System	Re: Takes Forever to Log in from Workstations Disable the Windows Firewall service. Make sure you disable it, not just turn it off. __________________ Microsoft MCSA + Messaging, MVP, A+, Network+ http://i16.photobucket.com/albums/b3...other/Help.jpg Do you want a real Republican? HDD diagnostic tools / HDD data recovery software

05-24-2007, 09:02 AM	#13 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Re: Takes Forever to Log in from Workstations You are not using roaming profiles are you? If not logon and delete the locally stored Domain Administrator profile, by opening system properties > advanced > user profiles. Try creating a new domain admin account (for testing) and see if the same issue occurs. __________________ Because you can read this thank a teacher, because it's English thank a soldier.

05-24-2007, 01:33 PM	#16 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Re: Takes Forever to Log in from Workstations We need to get this issue isolated, in order to continue troubleshooting and to make sure that the communication is not hindered in any way we must make sure that the Windows firewall and other anti-virus programs are turned off. You can isolate this policy (firewall off) to only one machine. This may be a little out there but boot into safe mode w/networkking and logon to the domain with the domain admin account and see if the issue still occurs. __________________ Because you can read this thank a teacher, because it's English thank a soldier.

05-24-2007, 02:00 PM	#17 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Re: Takes Forever to Log in from Workstations Does being in safe mode with networking disable the firewall? I have not been able to turn off the firewall yet because it is set up as a group policy. How can I disable a firewall on an individual workstation without changing the group policy? I have just tested it in safe mode with networking.. Same problem.

05-24-2007, 02:03 PM	#19 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Re: Takes Forever to Log in from Workstations This issue only affects Domain Administrators? Try taking a machine off the domain and putting it back on. __________________ Because you can read this thank a teacher, because it's English thank a soldier.

05-24-2007, 03:05 PM	#20 (permalink)
jcantele Registered User Join Date: May 2007 Posts: 10 OS: XP	Re: Takes Forever to Log in from Workstations crazijoe, I'm goign to try to relay back some of my boss's response to your post. He says that he does not see how the Windows firewall could create this problem, because it only exists for a single domain administrator, "Administrator." All of the other administrator accounts work fine. How could the windows firewall create a problem with a single account, with all of the other accounts working fine?