“Applying user settings” takes a long time for domain users

active-directorydomain-name-systemgroup-policyinternal-dns

The boot up process for our laptop-domain users takes literally, forever to start.
It sits at the "Applying user settings" stage and when you press ctrl+alt+del, it takes like another minute or so before actually being able to enter a login.

Now… I've kind of 'fixed' the problem by manually entering the DNS server in the wireless (that's how it connects) adapter properties; however, I don't want it to mess up the connection when they get home.

How can I further trouble shoot this problem? Why is it taking so long for the laptops to query for the DNS server – if indeed, it is what it is trying to do?

I have also checked the Group Policies and there is nothing I can see which could be causing this problem – also, the GP isn't very complicated; just a few account lockout and Windows Update settings.

The server is running Small Business Server 2003.
The laptops are running a clean install of Windows 7 Pro.

Best Answer

When a domain-joined computer can't find a domain controller, it will take a lot of time to start up and let a user log on, if he'll be able to log on at all. DNS is vital to proper operation of Active Directory, so, if that computer isn't properly configured to use a domain DNS server, it won't be able to find a DC... thus the slowness you're experiencing. This is confirmed by the fact that you have been able to fix it by manually configuring its DNS settings.

The question should be: why is not my computer getting proper DNS settings?

I'll assume you're using DHCP in your network, since you didn't want to manually configure network settings. So I think you should take a look at your DHCP server's settings, and try to find out why it's not handing out proper DNS informations.

Also, running ipconfig /all on the malfunctioning computer should help you see what (wrong) DNS settings it's actually using, and why.

Related Solutions

Web interface to allow users to change their Active Directory password

If you need an option beyond Outlook Web Access it's still very easy using something like:

Set objUser = GetObject("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
objUser.ChangePassword "i5A2sj*!", "jl3R86df"

from the Users bit of the Script Repository at http://www.microsoft.com/technet/scriptcenter/scripts/ad/users/default.mspx?mfr=true

It would be trivial to embed this in an ASP script. I'd force the use of SSL though :-)

Slow “applying computer settings” on workstation when I simulate domain controller being turned off that holds the FSMO roles in a two DC domain

This is the expected behavior.

You should have another system, that is a DC, and is also in the same IP subnet as the DC with the PDC role. This second DC should be a direct AD replication partner with the DC that holds the PDC FSMO role. If you only have two DCs, it will become a direct replica when promoting it.

For example, if you only have those two DCs, your second DC should already be a direct replication partner with the first DC (PDC). You can verify this by going into AD Sites and Subnets MMC (under admin tools) and expanding out sites, expanding out the PDC DC, clicking "NTDS Settings.." and then checking what DC the replication occurs to/from (it will show you in the right pane of the MMC window). It should be the second DC. This shows that the two are direct replication partners.

If you have multitudes of DCs, you may need to go into AD Sites and Subnets MMC and determine which DC is the direct replication partner of the PDC (follow the steps above and check each DC, till you find which one replicates with the PDC). Intrasite AD replication is quicker than Intersite replication (Replication between two AD sites as defined in AD Sites and Subnets).

This will allow you to quickly seize the PDC role, in the event it fails, to the DC that is the direct replication partner.

I would suggest reading up on the long list of functions the PDC role provides:

http://technet.microsoft.com/en-us/library/cc780487(WS.10).aspx

Some of the key functions include:

Acts as primary time source for the domain, to keep all time synchronized.
- If clients/ servers are out of sync you could have major authentication issues
Acts as the final authority for password unlocks, and failed password attempts
Acts as the Master Domain Browser

Best Answer

Related Solutions

Web interface to allow users to change their Active Directory password

Slow “applying computer settings” on workstation when I simulate domain controller being turned off that holds the FSMO roles in a two DC domain

Related Topic