XP Slow Login to NT Domain

[Guest]

I have a couple of XP SP2 laptops that are having very slow login times to
our NT 4.0 domain. After entering the password, it takes about 3 minutes to
begin to load the personal settings. The delay only occurs after a reboot.
Once the user has logged in, he can logout/login without a problem.
Not all XP installs seem to have this problem, but one of the ones that does
is the CEO (nice!).

I have done quite a bit a research on this problem, which seems pretty
common with XP installs but have not found a solution. Most solutions seem
to point to DNS.

Our DNS server is on a NT 4.0 server. The ipconfig/all output is pointing
to the NT DNS server as it should. BTW - we are running DHCP.

I have enable debug of the userenv log file and the most suspicious thing is
about a 2 minute delay after a call to GetUserDNSDomainName and the
LoadUserProfile call.

A snip is as follows (notice the delay at the 11:20:05 timestamp):
USERENV(5cc.5d0) 11:19:59:172 GetUserDNSDomainName: Domain name is NT
Authority. No DNS domain name available.
USERENV(468.46c) 11:19:59:212 LibMain: Process Name:
C:\WINDOWS\System32\SCardSvr.exe
USERENV(11c.144) 11:20:00:614 LibMain: Process Name: C:\Program
Files\Intel\Wireless\Bin\WLKeeper.exe
USERENV(11c.144) 11:20:00:614 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(11c.144) 11:20:00:614 GetUserNameAndDomain Failed to impersonate user
USERENV(11c.144) 11:20:00:614 GetUserDNSDomainName: Domain name is NT
Authority. No DNS domain name available.
USERENV(11c.144) 11:20:05:271 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(11c.144) 11:20:05:271 GetUserNameAndDomain Failed to impersonate user
USERENV(11c.144) 11:20:05:271 GetUserDNSDomainName: Domain name is NT
Authority. No DNS domain name available.
USERENV(11c.144) 11:20:05:281 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(11c.144) 11:20:05:281 GetUserNameAndDomain Failed to impersonate user
USERENV(11c.144) 11:20:05:281 GetUserDNSDomainName: Domain name is NT
Authority. No DNS domain name available.
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: Yes, we can impersonate the
user. Running as self
USERENV(5cc.5d0) 11:22:22:799
=========================================================
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: Entering, hToken = <0x4a0>,
lpProfileInfo = 0x7fcf8
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: lpProfileInfo->lpUserName =
<LocalService>
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: NULL central profile path
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: NULL default profile path
USERENV(5cc.5d0) 11:22:22:799 LoadUserProfile: NULL server name

 

[Guest]

I found that if I disabled the wireless NIC, the login time went to about 40
seconds. I do not understand why or this can be tweaked in any way.

 

[Chuck]

I found that if I disabled the wireless NIC, the login time went to about 40
seconds. I do not understand why or this can be tweaked in any way.

What protocols are bound to the wireless NIC?

XP differs from previous versions of windows in that it uses DNS as it's primary
name resolution method for finding domain controllers.
http://support.microsoft.com/?id=314861

If DNS is misconfigured, XP will spend a lot of time waiting for it to timeout
before it tries using legacy NT4 style NetBIOS, Which may or may not work.

1) Ensure that the XP clients are all configured to point to the local DNS
server which hosts the AD domain. That will probably be the win2k server itself.
They should NOT be pointing an ISP's DNS server. An 'ipconfig /all' on the XP
box should reveal ONLY the domain's DNS server. Use a DHCP server to issue the
local DNS server address, if possible.

2) Ensure DNS server on win2k is configured to permit dynamic updates.

3) Ensure the win2k server points to itself as a DNS server.

4) For external (internet) name resolution, specify your ISP's DNS server not on
the clients, but in the 'forwarders' tab of the local win2k DNS server.

5) On the DNS server, if you cannot access the 'Forwarders' and 'Root Hints'
tabs because they are grayed out, that is because there is a root zone (".")
present on the DNS server. You MUST delete this root zone to permit the server
to forward unresolved queries to your ISP or the root servers.
http://support.microsoft.com/?id=298148

Setting Up the Domain Name System for Active Directory
http://support.microsoft.com/?id=237675
HOW TO: Configure DNS for Internet Access in Windows 2000
http://support.microsoft.com/?id=300202

--
Cheers,
Chuck
Paranoia is not necessarily a bad thing - it comes from experience.
My email is AT DOT
actual address pchuck sonic net.