Why would login takes 30-45 seconds from password to desktop?

[Guest Barry]

I recently added a terminal server to our office. Previously we used a SBS

2003 server and login time from password to desktop was less than 1 minute.

The new server is Server 2003 64-bit, dual quad core 3.0, 4 Gb RAM with all

current patches. The same user logins now take 30-45 seconds from password

to desktop. Once login is complete, performance is fine. If however I log

onto the new server as an administrator, the login is <1 second. What

security issue or other issue would cause user logons to be slow? Thanks,

Barry

[Guest Lanwench [MVP - Exchange]]

Re: Why would login takes 30-45 seconds from password to desktop?

 

Barry <Barry@discussions.microsoft.com> wrote:

> I recently added a terminal server to our office. Previously we used

> a SBS 2003 server and login time from password to desktop was less

> than 1 minute.

 

On the desktop, surely. Your users were never logging into your SBS server

at all, one hopes....right?

> The new server is Server 2003 64-bit, dual quad core

> 3.0, 4 Gb RAM with all current patches. The same user logins now

> take 30-45 seconds from password to desktop.

 

Well - that's still less than one minute. And just to clarify, you mean

logging onto TS across the network, yes?

> Once login is complete,

> performance is fine. If however I log onto the new server as an

> administrator, the login is <1 second. What security issue or other

> issue would cause user logons to be slow? Thanks, Barry

 

Since you're using SBS, did you set up the TS computer account using the

wizard in Server Management and join the domain using /connectcomputer?

That's how you should join any servers (and computers) to your domain.

 

Have you set up TS profile paths for your users (either in ADUC or via GPO)?

You need to.

[Guest Frankster]

Re: Why would login takes 30-45 seconds from password to desktop?

 

 

"Barry" <Barry@discussions.microsoft.com> wrote in message

news:AFA02622-91EB-4179-BB41-D5EAAA075890@microsoft.com...

>I recently added a terminal server to our office. Previously we used a SBS

> 2003 server and login time from password to desktop was less than 1

> minute.

> The new server is Server 2003 64-bit, dual quad core 3.0, 4 Gb RAM with

> all

> current patches. The same user logins now take 30-45 seconds from

> password

> to desktop. Once login is complete, performance is fine. If however I

> log

> onto the new server as an administrator, the login is <1 second. What

> security issue or other issue would cause user logons to be slow? Thanks,

> Barry

 

Have you added roaming profiles perhaps? Administrator would not have that.

 

Is the new server directly on the same router/switch as the SBS? I once had

an issue with extremely slow longons to a TS that was solved by adjusting

the TCP/IP frame in the router. Just a thought.

 

-Frank

[Guest Barry]

Re: Why would login takes 30-45 seconds from password to desktop?

 

 

 

"Lanwench [MVP - Exchange]" wrote:

> Barry <Barry@discussions.microsoft.com> wrote:

> > I recently added a terminal server to our office. Previously we used

> > a SBS 2003 server and login time from password to desktop was less

> > than 1 minute.

>

> On the desktop, surely. Your users were never logging into your SBS server

> at all, one hopes....right?

 

Previous to installing this terminal server, the users did logon to the SBS

Server.

>

> > The new server is Server 2003 64-bit, dual quad core

> > 3.0, 4 Gb RAM with all current patches. The same user logins now

> > take 30-45 seconds from password to desktop.

>

> Well - that's still less than one minute. And just to clarify, you mean

> logging onto TS across the network, yes?

 

Yes, logging onto Terminal Services on the local network.

>

> > Once login is complete,

> > performance is fine. If however I log onto the new server as an

> > administrator, the login is <1 second. What security issue or other

> > issue would cause user logons to be slow? Thanks, Barry

>

> Since you're using SBS, did you set up the TS computer account using the

> wizard in Server Management and join the domain using /connectcomputer?

> That's how you should join any servers (and computers) to your domain.

>

> Have you set up TS profile paths for your users (either in ADUC or via GPO)?

> You need to.

>

Do I have to set up every user individually with a complete path including

the user name, or is there a variable I can include for the user name, so I

can apply the setting to all users at once? (I assume you mean to do this in

AD?)

[Guest Barry]

Re: Why would login takes 30-45 seconds from password to desktop?

 

 

"Frankster" wrote:

>

> "Barry" <Barry@discussions.microsoft.com> wrote in message

> news:AFA02622-91EB-4179-BB41-D5EAAA075890@microsoft.com...

> >I recently added a terminal server to our office. Previously we used a SBS

> > 2003 server and login time from password to desktop was less than 1

> > minute.

> > The new server is Server 2003 64-bit, dual quad core 3.0, 4 Gb RAM with

> > all

> > current patches. The same user logins now take 30-45 seconds from

> > password

> > to desktop. Once login is complete, performance is fine. If however I

> > log

> > onto the new server as an administrator, the login is <1 second. What

> > security issue or other issue would cause user logons to be slow? Thanks,

> > Barry

>

> Have you added roaming profiles perhaps? Administrator would not have that.

>

> Is the new server directly on the same router/switch as the SBS? I once had

> an issue with extremely slow longons to a TS that was solved by adjusting

> the TCP/IP frame in the router. Just a thought.

>

I have not created roaming profiles explicitly. It seems that if a user

moves from one computer to another that they still get their original

desktop, and I don't get any errors reporting that the roaming profile could

not be located.

 

The new server is on the same switch as at SBS.

 

> -Frank

>

>

[Guest Hank Arnold (MVP)]

Re: Why would login takes 30-45 seconds from password to desktop?

 

Barry wrote:

> "Frankster" wrote:

>

>> "Barry" <Barry@discussions.microsoft.com> wrote in message

>> news:AFA02622-91EB-4179-BB41-D5EAAA075890@microsoft.com...

>>> I recently added a terminal server to our office. Previously we used a SBS

>>> 2003 server and login time from password to desktop was less than 1

>>> minute.

>>> The new server is Server 2003 64-bit, dual quad core 3.0, 4 Gb RAM with

>>> all

>>> current patches. The same user logins now take 30-45 seconds from

>>> password

>>> to desktop. Once login is complete, performance is fine. If however I

>>> log

>>> onto the new server as an administrator, the login is <1 second. What

>>> security issue or other issue would cause user logons to be slow? Thanks,

>>> Barry

>> Have you added roaming profiles perhaps? Administrator would not have that.

>>

>> Is the new server directly on the same router/switch as the SBS? I once had

>> an issue with extremely slow longons to a TS that was solved by adjusting

>> the TCP/IP frame in the router. Just a thought.

>>

> I have not created roaming profiles explicitly. It seems that if a user

> moves from one computer to another that they still get their original

> desktop, and I don't get any errors reporting that the roaming profile could

> not be located.

>

> The new server is on the same switch as at SBS.

>

>

>> -Frank

>>

>>

 

What you describe sure sounds like roaming profiles. The exact purpose

of roaming profiles is that the user gets the same desktop regardless of

what computer they log on with.

 

Log on time can be affected by the size of the roaming profiles This is

because the profile has to be downloaded from the server where it is

stored onto the computer. You need to find where they are being stored

and what the sizes are. You can do several things to reduce the size

like redirecting My documents and others to another location and get

them out of the profile....

--

 

Regards,

Hank Arnold

Microsoft MVP

Windows Server - Directory Services

[Guest Barry]

Re: Why would login takes 30-45 seconds from password to desktop?

 

Thanks for the reply. Do I use file redirection to point My Documents, etc.

to another location?

 

"Hank Arnold (MVP)" wrote:

> Barry wrote:

> > "Frankster" wrote:

> >

> >> "Barry" <Barry@discussions.microsoft.com> wrote in message

> >> news:AFA02622-91EB-4179-BB41-D5EAAA075890@microsoft.com...

> >>> I recently added a terminal server to our office. Previously we used a SBS

> >>> 2003 server and login time from password to desktop was less than 1

> >>> minute.

> >>> The new server is Server 2003 64-bit, dual quad core 3.0, 4 Gb RAM with

> >>> all

> >>> current patches. The same user logins now take 30-45 seconds from

> >>> password

> >>> to desktop. Once login is complete, performance is fine. If however I

> >>> log

> >>> onto the new server as an administrator, the login is <1 second. What

> >>> security issue or other issue would cause user logons to be slow? Thanks,

> >>> Barry

> >> Have you added roaming profiles perhaps? Administrator would not have that.

> >>

> >> Is the new server directly on the same router/switch as the SBS? I once had

> >> an issue with extremely slow longons to a TS that was solved by adjusting

> >> the TCP/IP frame in the router. Just a thought.

> >>

> > I have not created roaming profiles explicitly. It seems that if a user

> > moves from one computer to another that they still get their original

> > desktop, and I don't get any errors reporting that the roaming profile could

> > not be located.

> >

> > The new server is on the same switch as at SBS.

> >

> >

> >> -Frank

> >>

> >>

>

> What you describe sure sounds like roaming profiles. The exact purpose

> of roaming profiles is that the user gets the same desktop regardless of

> what computer they log on with.

>

> Log on time can be affected by the size of the roaming profiles This is

> because the profile has to be downloaded from the server where it is

> stored onto the computer. You need to find where they are being stored

> and what the sizes are. You can do several things to reduce the size

> like redirecting My documents and others to another location and get

> them out of the profile....

> --

>

> Regards,

> Hank Arnold

> Microsoft MVP

> Windows Server - Directory Services

>

[Guest Lanwench [MVP - Exchange]]

Re: Why would login takes 30-45 seconds from password to desktop?

 

Barry <Barry@discussions.microsoft.com> wrote:

> Thanks for the reply. Do I use file redirection to point My

> Documents, etc. to another location?

 

You should use folder redirection for My Documents, Desktop, and Application

Data - set up a separate GPO and link it to SBSUsers. "Redirect all to the

following location" and "create a folder under the root" - specifying

whatever you use for your Users Shared Folders, e.g., \\sbsserver\users.

 

You should use this whether you have roaming profiles or not. If you have

laptop users it gets trickier, but the above is good basic advice. I

personally disable offline files via GPO as well.

>

> "Hank Arnold (MVP)" wrote:

>

>> Barry wrote:

>>> "Frankster" wrote:

>>>

>>>> "Barry" <Barry@discussions.microsoft.com> wrote in message

>>>> news:AFA02622-91EB-4179-BB41-D5EAAA075890@microsoft.com...

>>>>> I recently added a terminal server to our office. Previously we

>>>>> used a SBS 2003 server and login time from password to desktop

>>>>> was less than 1 minute.

>>>>> The new server is Server 2003 64-bit, dual quad core 3.0, 4 Gb

>>>>> RAM with all

>>>>> current patches. The same user logins now take 30-45 seconds from

>>>>> password

>>>>> to desktop. Once login is complete, performance is fine. If

>>>>> however I log

>>>>> onto the new server as an administrator, the login is <1 second.

>>>>> What security issue or other issue would cause user logons to be

>>>>> slow? Thanks, Barry

>>>> Have you added roaming profiles perhaps? Administrator would not

>>>> have that.

>>>>

>>>> Is the new server directly on the same router/switch as the SBS? I

>>>> once had an issue with extremely slow longons to a TS that was

>>>> solved by adjusting the TCP/IP frame in the router. Just a

>>>> thought.

>>>>

>>> I have not created roaming profiles explicitly. It seems that if a

>>> user moves from one computer to another that they still get their

>>> original desktop, and I don't get any errors reporting that the

>>> roaming profile could not be located.

>>>

>>> The new server is on the same switch as at SBS.

>>>

>>>

>>>> -Frank

>>>>

>>>>

>>

>> What you describe sure sounds like roaming profiles. The exact

>> purpose of roaming profiles is that the user gets the same desktop

>> regardless of what computer they log on with.

>>

>> Log on time can be affected by the size of the roaming profiles This

>> is because the profile has to be downloaded from the server where it

>> is stored onto the computer. You need to find where they are being

>> stored and what the sizes are. You can do several things to reduce

>> the size like redirecting My documents and others to another

>> location and get them out of the profile....

>> --

>>

>> Regards,

>> Hank Arnold

>> Microsoft MVP

>> Windows Server - Directory Services

[Guest Lanwench [MVP - Exchange]]

Re: Why would login takes 30-45 seconds from password to desktop?

 

Barry <Barry@discussions.microsoft.com> wrote:

> "Lanwench [MVP - Exchange]" wrote:

>

>> Barry <Barry@discussions.microsoft.com> wrote:

>>> I recently added a terminal server to our office. Previously we

>>> used a SBS 2003 server and login time from password to desktop was

>>> less than 1 minute.

>>

>> On the desktop, surely. Your users were never logging into your SBS

>> server at all, one hopes....right?

>

> Previous to installing this terminal server, the users did logon to

> the SBS Server.

 

Ouch. You definitely want to disable that option - undo whatever you did to

allow it in the first place. Users should never log into a DC/Exchange/etc

server. And you don't want to install *any* desktop software on it.

>

>>

>>> The new server is Server 2003 64-bit, dual quad core

>>> 3.0, 4 Gb RAM with all current patches. The same user logins now

>>> take 30-45 seconds from password to desktop.

>>

>> Well - that's still less than one minute. And just to clarify, you

>> mean logging onto TS across the network, yes?

>

> Yes, logging onto Terminal Services on the local network.

>>

>>> Once login is complete,

>>> performance is fine. If however I log onto the new server as an

>>> administrator, the login is <1 second. What security issue or other

>>> issue would cause user logons to be slow? Thanks, Barry

>>

>> Since you're using SBS, did you set up the TS computer account using

>> the wizard in Server Management and join the domain using

>> /connectcomputer? That's how you should join any servers (and

>> computers) to your domain.

 

You didn't anwer this question....

>>

>> Have you set up TS profile paths for your users (either in ADUC or

>> via GPO)? You need to.

>>

> Do I have to set up every user individually with a complete path

> including the user name, or is there a variable I can include for the

> user name, so I can apply the setting to all users at once? (I

> assume you mean to do this in AD?)

 

If you do this in a GPO, you can specify

\\fileserver\tsprofiles$\%username%, I think (am not in front of a server to

look this up for you easily). You should have a GPO that handles your TS box

anyway and locks it down, etc - and this would be a good place to set that

up.

 

Some boilerplate follows....

 

Basics: you should be running Terminal Services on a dedicated member server

with *no* other roles on the network. It should be set up in its own OU,

with a policy specifically for TS (including loopback processing so that all

users who log in get the same settings, regardless of

their own inherited user policy settings). See KB 278295 for some good

lockdown suggestions. Also see MVP Patrick Rouse's articles at

http://www.sessioncomputing.com/articles.htm

 

-------------------------------------------

Cribbed shamelessly from Patrick Rouse......

-------------------------------------------

 

Best Practice for applying Settings to Users only when they log on to

Terminal Servers would be to:

 

1. Create an OU to contain a set of Terminal Servers

 

2. Block Policy Inheritance on the OU (Properties -> Group Policy). This

prevents settings from higher-up in AD from affecting your Terminal Servers.

 

3. Move the Terminal Server Computer Objects into the OU. Do NOT place User

Accounts in this OU.

 

4. Create an Active Directory Security Group called "Terminal Servers" (or

something similar that you'll recognize) and add the Terminal Servers from

this OU to this group.

 

5. Create a GPO called "TS Machine Policy" linked to the OU

 

6. Check "Disable User Configuration settings" on the GPO

 

7. Enable Loopback Policy Processing in the GPO

 

8. Edit the Security of the Policy so Apply Policy is set for "Authenticated

Users" and the Security Group containing the Terminal Servers

 

9. Create additional GPOs linked to this OU for each user population, i.e.

"TS Users", "TS Administrators".

 

10. Check "Disable Computer Configuration settings" on these GPO

 

11. Edit the Security on these User Configuration GPOs so Apply Policy is

enabled for the target user population, and Deny Apply Policy is enabled for

user to which the policy should not apply.

 

With GPOs configured this way the Machine Policy applies to everyone that

logs on to the Terminal Server (only the Computer Configuration Settings of

the Machine Policy are processed) in addition to the appropriate User

Configuration GPO (only the User Configuration portion of the GPO is

processed) for the target user population.

 

------------------------------------