Hi there,
I get a massive delay (6 minutes +) once I join a freshly installed XP SP3 PC to the existing Windows Domain.
When verbose messages are activated for winlogon, the delay occurs while "RPCSS is starting..." and "Preparing network connections..." is displayed.
When unjoining the domain, the delay is gone (8 seconds). When rejoining, it's again there.
I suspected a SID issue and used NewSID to generate a new SID before joining the domain - no change.
I set HKLM\SOFTWARE\Policies\Microsoft\Windows\System\DisableGPO = 1 - no change.
I tried BootVis optimization - no change.
The delay occurs between two events in eventlog, but no further details.
Eventlog:
Log Time Event Source Event ID Description
Sys. 10:10:12 EventLog 6006 The Event log service was stopped.
Reboot
Sys. 10:10:58 e1express 32 Intel(R) 82566DM-2 Gigabit Network Connection Link has been established: 1000Mbps.
Sys. 10:11:00 Tcpip 4201 The system detected that network adapter Intel(R) 82566DM-2 Gigabit Network Connection was connected to the network, and has initiated normal operation over the network adapter.
Sys. 10:11:02 EventLog 6005 The Event log service was started.
Sys. 10:11:02 EventLog 6009 Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.
>>>>>>> Delay of 8 Seconds okay!
App. 10:11:10 IAANTmon 7500 Intel RAID Controller: Intel(R) ICH8R/ICH9R/ICH10R/DO/PCH SATA RAID Controller
App. 10:11:10 ESENT 102 Windows (1772) Windows: The database engine started a new instance (0).
App. 10:11:10 ESENT 100 SearchIndexer (1772) The database engine 5.01.2600.5512 started.
App. 10:11:13 Windows Search Service 1003 The Windows Search Service started.
App. 10:12:04 Windows Search Service 3044 The gatherer index resumed.
Sys. 10:12:47 Service Control Manager 7036 The Network Connections service entered the running state.
Sys. 10:12:47 Service Control Manager 7035 The Network Connections service was successfully sent a start control.
Sys. 10:12:47 Service Control Manager 7036 The Network Location Awareness (NLA) service entered the running state.
Sys. 10:12:47 Service Control Manager 7035 The Network Location Awareness (NLA) service was successfully sent a start control.
Sys. 10:15:35 Service Control Manager 7036 The Net Logon service entered the running state.
Sys. 10:15:35 Service Control Manager 7035 The Net Logon service was successfully sent a start control.
Joining Domain
Sys. 10:15:35 Workstation 3260 This computer has been successfully joined to domain 'domain.local'.
Sys. 10:15:49 EventLog 6006 The Event log service was stopped.
Reboot after Joining Domain
Sys. 10:20:38 e1express 32 Intel(R) 82566DM-2 Gigabit Network Connection Link has been established: 1000Mbps.
Sys. 10:20:40 Tcpip 4201 The system detected that network adapter Intel(R) 82566DM-2 Gigabit Network Connection was connected to the network, and has initiated normal operation over the network adapter.
Sys. 10:20:42 EventLog 6005 The Event log service was started.
Sys. 10:20:42 EventLog 6009 Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.
>>>>>>> Delay of 6 Minutes (winlogon verbose: »RPCSS ist starting…«; »Preparing Network Connections…«)
App. 10:26:37 Userenv 1054 Windows cannot obtain the domain controller name for your computer network. (The workstation driver is not installed. ). Group Policy processing aborted.
Sys. 10:28:07 Service Control Manager 7022 The Sophos Anti-Virus service hung on starting.
App. 10:28:07 ESENT 102 Windows (1892) Windows: The database engine started a new instance (0).
App. 10:28:07 ESENT 100 SearchIndexer (1892) The database engine 5.01.2600.5512 started.
App. 10:28:07 IAANTmon 7500 Intel RAID Controller: Intel(R) ICH8R/ICH9R/ICH10R/DO/PCH SATA RAID Controller
App. 10:28:10 Windows Search Service 1003 The Windows Search Service started.
Sys. 10:28:22 W32Time 35 The time service is now synchronizing the system time with the time source timesrv.domain.local (ntp.d|172.16.0.###:123->172.16.0.###:123).
App. 10:33:27 Sophos Message Router 8004 Failed to communicate with parent router "172.16.0.###".
Sys. 10:37:28 Service Control Manager 7036 The Network Location Awareness (NLA) service entered the running state.
Sys. 10:37:28 Service Control Manager 7035 The Network Location Awareness (NLA) service was successfully sent a start control.
Sys. 10:37:28 Service Control Manager 7036 The Network Connections service entered the running state.
Sys. 10:37:28 Service Control Manager 7035 The Network Connections service was successfully sent a start control.
App. 10:38:36 Windows Search Service 3024 The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.
App. 10:38:36 Windows Search Service 3036 The content source <outlookexpress://{s-1-5-21-507921405-861567501-725345543-1007}/{4b737b0c-ea3c-4230-af84-fe550eb95023}/> cannot be accessed.
%windir%\ntbtlog.txt doesn't contain anything suspicious.I suspect a delay caused by a timeout because of NIC init, but I don't even know where to investigate further.
Any suggestions?
Thank you for your support!
L.
PS: The same even happened before installing Sophos, so this can't be the root cause.