# Slow Vista logins and group policy errors...



## markm75 (Jan 26, 2007)

I have a user of x86 Vista which is having a problem on logins.. its taking a longggg time and these event logs are firing off.. I cant find any reference to the "source" listed for these.. has anyone run into this?

The user also cant access this: \\domain.local\sysvol (says cant find file verify the address is correct).

-------------
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 6/26/2007 9:03:51 AM
Event ID: 6005
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: PC01.domain.local
Description:
The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (Logon).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
<EventID Qualifiers="32768">6005</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-06-26T13:03:51.000Z" />
<EventRecordID>12829</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>PC01.domain.local</Computer>
<Security />
</System>
<EventData>
<Data>GPClient</Data>
<Data>Logon</Data>
<Binary>C8070400</Binary>
</EventData>
</Event>

Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 6/26/2007 9:03:58 AM
Event ID: 6006
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: PC01.domain.local
Description:
The winlogon notification subscriber <GPClient> took 66 second(s) to handle the notification event (Logon).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
<EventID Qualifiers="32768">6006</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-06-26T13:03:58.000Z" />
<EventRecordID>12830</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>PC01.domain.local</Computer>
<Security />
</System>
<EventData>
<Data>GPClient</Data>
<Data>66</Data>
<Data>Logon</Data>
<Binary>04000000</Binary>
</EventData>
</Event>
------------------------

Log Name: System
Source: Microsoft-Windows-GroupPolicy
Date: 6/25/2007 3:20:07 PM
Event ID: 1058
Task Category: None
Level: Error
Keywords: 
User: x
Computer: PC01.domain.local
Description:
The processing of Group Policy failed. Windows attempted to read the file \\domain.local\SysVol\domain.local\Policies\{86EF0A30-42C9-4AEC-8231-6D31DC628A10}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller. 
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" />
<EventID>1058</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>1</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2007-06-25T19:20:07.785Z" />
<EventRecordID>9210</EventRecordID>
<Correlation ActivityID="{2CF756ED-CE89-4BE0-9B01-61ACD7762EA5}" />
<Execution ProcessID="996" ThreadID="4796" />
<Channel>System</Channel>
<Computer>PC01.domain.local</Computer>
<Security UserID="S-1-5-21-1524608126-714470956-1941619863-1241" />
</System>
<EventData>
<Data Name="SupportInfo1">4</Data>
<Data Name="SupportInfo2">840</Data>
<Data Name="ProcessingMode">1</Data>
<Data Name="ProcessingTimeInMilliseconds">66956</Data>
<Data Name="ErrorCode">53</Data>
<Data Name="ErrorDescription">The network path was not found. </Data>
<Data Name="DCName">\\dc.domain.local</Data>
<Data Name="GPOCNName">cn={86EF0A30-42C9-4AEC-8231-6D31DC628A10},cn=policies,cn=system,DC=pst,DC=local</Data>
<Data Name="FilePath">\\domain.local\SysVol\pst.local\Policies\{86EF0A30-42C9-4AEC-8231-6D31DC628A10}\gpt.ini</Data>
</EventData>
</Event>


----------



## Houndog777 (May 17, 2007)

http://www.eventid.net/search.asp


----------



## markm75 (Jan 26, 2007)

There are no results for the source: Microsoft-Windows-Winlogon


----------



## Houndog777 (May 17, 2007)

Event ID: 6005 and 6006
Most of the logged entries can be ignored. For example, if you click the System icon on the left, the Event column on the right should include an entry numbered '6005' for every time you have started your PC. Each such entry signifies the beginning of the logging service when Windows loads. Similarly, a '6006' entry should appear for each time you shut down your system, indicating that you exited Windows properly and that event logging stopped. If there's no 6006 entry to correspond to a given day's 6005 entry, your computer probably stopped without using Windows' normal shutdown process, which can cause problems.

Event ID: 1058
http://support.microsoft.com/kb/842804


----------



## markm75 (Jan 26, 2007)

ok.. well in our case this machine cant find \\domain.local\sysvol.. it apppears nslookup n dns are ok though..

i tried removing then re-adding it to AD, but now it cant find the domain, though can connect to a dc in it with credentials


----------

