14 minute boot problem

[Todd]

Hi All,

Windows XP Pro SP3, 32 bit

I am having a both interesting and frustrating troubleshoot
on a customer's computer I would like to run by you guys:

As of about a week ago, her boot suddenly started to take
14 minutes -- this from event log. And it has nothing to
do with logging in the user. The user login screen will
come up and you put your password in, then wait and wait
and wait for the desktop to come up. But, if you let
it sit for 14 minutes at the logon prompt, then put your
password in, up the desktop comes almost instantly.

Initial, I looked at the system events and found a bunch of
red marks. I fix them all. Now, no more red marks. No
symptom change. Rats.

So I booted into safe mode, and no delays. This is a
good sign.

So, msconfig and selective start up. Wait and wait and
wait and wait. No symptom change. Not a good sign.

Tried with the Anti Virus removed. No symptom change.

So, I installed and ran a utility called "bootviz".
This utility graphs for me the delays involved in booting.
Well, bootviz clearly shows the 14 minutes. 13-1/2 minutes
are relegated to a driver called "fltmgr.sys". (Virus
Total says it is not infected.)

On bootviz, if I click on the various segments of fltmgr,
it tells me what it running. Nothing special. Just that each
thing it runs takes 2 minutes to complete. And, I uploaded each
thing fltmgr is running to Virus Total: all are clean.

And, bootviz shows virtually no CPU or hard drive activity
during the 13-1/2 minutes of wait. The only thing that
is running is fltmgr at 0% CPU.

And, once you get past the 14 minutes, the computer is
very, very fast (has an SSD drive). And, it acts totally
normal the rest of the day.

Any thoughts? How would you proceed? Shake fist at it
and accuse its parents of not being married?

Many thanks,
-T

 

[Paul]

Hi All,

Windows XP Pro SP3, 32 bit

I am having a both interesting and frustrating troubleshoot
on a customer's computer I would like to run by you guys:

As of about a week ago, her boot suddenly started to take
14 minutes -- this from event log. And it has nothing to
do with logging in the user. The user login screen will
come up and you put your password in, then wait and wait
and wait for the desktop to come up. But, if you let
it sit for 14 minutes at the logon prompt, then put your
password in, up the desktop comes almost instantly.

Initial, I looked at the system events and found a bunch of
red marks. I fix them all. Now, no more red marks. No
symptom change. Rats.

So I booted into safe mode, and no delays. This is a
good sign.

So, msconfig and selective start up. Wait and wait and
wait and wait. No symptom change. Not a good sign.

Tried with the Anti Virus removed. No symptom change.

So, I installed and ran a utility called "bootviz".
This utility graphs for me the delays involved in booting.
Well, bootviz clearly shows the 14 minutes. 13-1/2 minutes
are relegated to a driver called "fltmgr.sys". (Virus
Total says it is not infected.)

On bootviz, if I click on the various segments of fltmgr,
it tells me what it running. Nothing special. Just that each
thing it runs takes 2 minutes to complete. And, I uploaded each
thing fltmgr is running to Virus Total: all are clean.

And, bootviz shows virtually no CPU or hard drive activity
during the 13-1/2 minutes of wait. The only thing that
is running is fltmgr at 0% CPU.

And, once you get past the 14 minutes, the computer is
very, very fast (has an SSD drive). And, it acts totally
normal the rest of the day.

Any thoughts? How would you proceed? Shake fist at it
and accuse its parents of not being married?

Many thanks,
-T

http://www.bleepingcomputer.com/for...boot-on-new-laptop-process-explorer-boot-vis/

MSE removal helped for one person. Not a cure, but a workaround
for whatever got damaged.

And the reference here suggests AV programs may need
the services of fltmgr.sys.

http://msdn.microsoft.com/en-us/library/aa939640(v=WinEmbedded.5).aspx

"File system filters are used by antivirus and other applications."

I can't find enough on fltmgr.sys to say much more about it.
I don't know if it has anything to do with UpperFilter
and LowerFilter driver shims or not. devcon stack *
can list those for you.

I found another reference to a network share being related to
the slow start, but to me that doesn't add up. You would think
that would come later in the boot process.

Paul

 

[Todd]

http://www.bleepingcomputer.com/for...boot-on-new-laptop-process-explorer-boot-vis/


MSE removal helped for one person. Not a cure, but a workaround
for whatever got damaged.

AV is Kaspersky Endpoint Security. Security Essentials is
not installed

And the reference here suggests AV programs may need
the services of fltmgr.sys.

http://msdn.microsoft.com/en-us/library/aa939640(v=WinEmbedded.5).aspx

"File system filters are used by antivirus and other applications."

I tried it with the AV removed. No change.

I can't find enough on fltmgr.sys to say much more about it.
I don't know if it has anything to do with UpperFilter
and LowerFilter driver shims or not. devcon stack *
can list those for you.

Didn't look at the device manager. I presumed probles there would
show up in the System log. Maybe I presumed a little too much.

I found another reference to a network share being related to
the slow start, but to me that doesn't add up. You would think
that would come later in the boot process.

Paul

Where would I look for stale network mount points? (None
show in Windows Explorer [not Internet Explorer].)

Thank you for the help,
-T

 

[Todd]

http://www.bleepingcomputer.com/for...boot-on-new-laptop-process-explorer-boot-vis/



MSE removal helped for one person. Not a cure, but a workaround
for whatever got damaged.

AV is Kaspersky Endpoint Security. Security Essentials is
not installed

And the reference here suggests AV programs may need
the services of fltmgr.sys.

http://msdn.microsoft.com/en-us/library/aa939640(v=WinEmbedded.5).aspx

"File system filters are used by antivirus and other applications."

I tried it with the AV removed. No change.

I can't find enough on fltmgr.sys to say much more about it.
I don't know if it has anything to do with UpperFilter
and LowerFilter driver shims or not. devcon stack *
can list those for you.

Didn't look at the device manager. I presumed probles there would
show up in the System log. Maybe I presumed a little too much.

I found another reference to a network share being related to
the slow start, but to me that doesn't add up. You would think
that would come later in the boot process.

Paul

Where would I look for stale network mount points? (None
show in Windows Explorer [not Internet Explorer].)

Thank you for the help,
-T

I have also disabled the indexing service and indexing
on the main drive.

Customer has an external backup drive, but unplugging
it and reboot did not change the symptom.

 

[VanguardLH]

Hi All,

Windows XP Pro SP3, 32 bit

I am having a both interesting and frustrating troubleshoot
on a customer's computer I would like to run by you guys:

As of about a week ago, her boot suddenly started to take
14 minutes -- this from event log. And it has nothing to
do with logging in the user. The user login screen will
come up and you put your password in, then wait and wait
and wait for the desktop to come up. But, if you let
it sit for 14 minutes at the logon prompt, then put your
password in, up the desktop comes almost instantly.

Initial, I looked at the system events and found a bunch of
red marks. I fix them all. Now, no more red marks. No
symptom change. Rats.

So I booted into safe mode, and no delays. This is a
good sign.

So, msconfig and selective start up. Wait and wait and
wait and wait. No symptom change. Not a good sign.

Tried with the Anti Virus removed. No symptom change.

So, I installed and ran a utility called "bootviz".
This utility graphs for me the delays involved in booting.
Well, bootviz clearly shows the 14 minutes. 13-1/2 minutes
are relegated to a driver called "fltmgr.sys". (Virus
Total says it is not infected.)

On bootviz, if I click on the various segments of fltmgr,
it tells me what it running. Nothing special. Just that each
thing it runs takes 2 minutes to complete. And, I uploaded each
thing fltmgr is running to Virus Total: all are clean.

And, bootviz shows virtually no CPU or hard drive activity
during the 13-1/2 minutes of wait. The only thing that
is running is fltmgr at 0% CPU.

And, once you get past the 14 minutes, the computer is
very, very fast (has an SSD drive). And, it acts totally
normal the rest of the day.

Any thoughts? How would you proceed? Shake fist at it
and accuse its parents of not being married?

Many thanks,
-T

A driver file doesn't need to be infected to cause it to hang the bootup
sequence. It can merely be corrupted.

Have you yet tried using System File Checker (sfc.exe) to replace system
files that have a different hash than from the protected store?

Have you yet tried a repair of Windows?

Could be a different driver or application. Maybe some software is
installed (which obviously does NOT load during a Windows's safe mode
startup) that interfaces with FltMgr.sys. Applications and services can
use that driver. That is, something else causes the problem. Article
http://support.microsoft.com/kb/975759 doesn't mention Windows XP but
you get the idea that something else that uses fltmgr.sys could cause
the hang.

One of the settings in boot.ini is to not show the GUI. Instead you see
a list of drivers getting loaded. Alas, the last one you see that seems
to hang is not the culprit. That one already loaded. It's the next one
(that you don't get to see) that is hanging. Use SysInternals LoadOrder
(http://technet.microsoft.com/en-us/sysinternals/bb897416.aspx) to see
the load order of the drivers to see which would be the one right after
the last visible one shown whereafter the hang occurs. I've not used
Microsoft's bootviz to know if what it shows as hanging is the prior and
successfully loaded driver (as does the no-GUI startup mode) or the
actual one causing the hang. Could be bootviz better identifies which
driver is hanging.

Have you yet tried unplugging all USB and all other external devices,
even keyboard and mouse, to see if any of that hardware is causing the
unresponsive state? How about any daughtercards? For example, if there
is an analog data/fax modem, pull it and do a cold boot. It's been a
long time since using a data/fax modem but recall that sometimes they
got into a hardware state that rendered them unusable and caused other
nasty symptoms. They required a cold boot to reset them.

From a cold boot (not hibernate or low-power mode), does the problem
continue? Completely shutdown Windows, wait for computer to power off,
yank the power cord for 15 seconds, replug the power cord, and cold boot
the computer. Do you see the LEDs flash on a connected keyboard which
shows a Reset sent to all hardware to put it into a known initial state?

Without sounding condemning, ask the user if they happened to recently
perform a BIOS flash update, like just before the problem started.
Although against their favor, and if felt like caught doing something
wrong or stupid, users will sometimes lie about a blunder. So just
casually ask them about it within a list of queries you put to the user.

Have you cleared the logs in Event Viewer, rebooted, and checked Event
Viewer for any anomalies, like an error stating "Boot critical file:
c:\windows\system32\drivers\fltmgr.sys is corrupt"?

If a Windows's safe mode boot eliminates the problem then it certainly
seems that something loaded during normal startup causes the hang.
msconfig.exe only looks at some startup items. Besides just the startup
items, have you also disabled all the unnecessary non-Microsoft services
to test boot load time? There are other startup locations than shown by
msconfig so you might have to use SysInternals' AutoRuns to see all.

 

[Ben Myers]

Hi All,
Windows XP Pro SP3, 32 bit
I am having a both interesting and frustrating troubleshoot
on a customer's computer I would like to run by you guys:
As of about a week ago, her boot suddenly started to take
14 minutes -- this from event log. And it has nothing to
do with logging in the user. The user login screen will
come up and you put your password in, then wait and wait
and wait for the desktop to come up. But, if you let
it sit for 14 minutes at the logon prompt, then put your
password in, up the desktop comes almost instantly.
Initial, I looked at the system events and found a bunch of
red marks. I fix them all. Now, no more red marks. No
symptom change. Rats.
So I booted into safe mode, and no delays. This is a
good sign.
So, msconfig and selective start up. Wait and wait and
wait and wait. No symptom change. Not a good sign.
Tried with the Anti Virus removed. No symptom change.
So, I installed and ran a utility called "bootviz".
This utility graphs for me the delays involved in booting.
Well, bootviz clearly shows the 14 minutes. 13-1/2 minutes
are relegated to a driver called "fltmgr.sys". (Virus
Total says it is not infected.)
On bootviz, if I click on the various segments of fltmgr,
it tells me what it running. Nothing special. Just that each
thing it runs takes 2 minutes to complete. And, I uploaded each
thing fltmgr is running to Virus Total: all are clean.
And, bootviz shows virtually no CPU or hard drive activity
during the 13-1/2 minutes of wait. The only thing that
is running is fltmgr at 0% CPU.
And, once you get past the 14 minutes, the computer is
very, very fast (has an SSD drive). And, it acts totally
normal the rest of the day.
Any thoughts? How would you proceed? Shake fist at it
and accuse its parents of not being married?
Many thanks,
-T

Right-click the "Start" button, click "Search", then "Back" in the left pane, then
"Change preferences" and see if "Without indexing service" is listed. If so, click it,
select "No, do not enable indexing service" and click "OK".

Ben

 

[Todd]

What about customer's back up settings? Image?, Complete copy back up of
entire system? Incremental? Unplugging the external drive does not
automatically stop computer looking for external drive.

Cobian Backup on a schedule (12:10 week days). But, see below
comment on Auto Runs.

What about temp files? Try running CCleaner to clear out any caches.

I cleaned the out by hand, including IE caches. Ran Tree Size to
look for large deposit of files. The largest is her documents,

Conflicting anti-nasty programmes? Is there more than one running in
"real time"?

She has only one. Kaspersky End Point Security 10. I did a
full uninstall of it with their cleaner. No symptom change.

I have found that any security "suite" eventually thinks it owns the
computer and does it's own thing. I would uninstall Kaspersky and just
use Windows Firewall, MSE and a couple of programmes to scan for malware.

Malwarebytes and SuperAntiSpyware are good programmes to find any
nasties that are not necessarily viruses. Malwarebytes also checks for
any PUPs (Possibly Unwanted Programmes). The free versions are all you
need and they run "on demand" not in "real time".

I ran several third part scanners looking for bad guys. She is
clean as a whistle.

Last thing I did (over the wire) to the machine last
night was open up Auto Runs and go through every
service and drive and remove anything "File not found".
Also removed a few drivers I knew she did not use any more,
like Seagate and Maxtor backup schedulers you mentioned
earlier. But, the stinker crashed on me trying
to shut it down, so I will have to wait till
Monday for the customer to power it off and back on.

Thank you for the help!

-T

Speaking of PUPs, this guys writes a great removal utility:

http://thisisudax.org/

 

[Todd]

A driver file doesn't need to be infected to cause it to hang the bootup
sequence. It can merely be corrupted.

Have you yet tried using System File Checker (sfc.exe) to replace system
files that have a different hash than from the protected store?

Never had much luck with sfc. How about yourself?

Have you yet tried a repair of Windows?

No. Before I would do that, I'd try talking the
customer into a full reinstal.

Could be a different driver or application. Maybe some software is
installed (which obviously does NOT load during a Windows's safe mode
startup) that interfaces with FltMgr.sys. Applications and services can
use that driver. That is, something else causes the problem. Article
http://support.microsoft.com/kb/975759 doesn't mention Windows XP but
you get the idea that something else that uses fltmgr.sys could cause
the hang.

One of the settings in boot.ini is to not show the GUI. Instead you see
a list of drivers getting loaded. Alas, the last one you see that seems
to hang is not the culprit. That one already loaded. It's the next one
(that you don't get to see) that is hanging. Use SysInternals LoadOrder
(http://technet.microsoft.com/en-us/sysinternals/bb897416.aspx) to see
the load order of the drivers to see which would be the one right after
the last visible one shown whereafter the hang occurs. I've not used
Microsoft's bootviz to know if what it shows as hanging is the prior and
successfully loaded driver (as does the no-GUI startup mode) or the
actual one causing the hang. Could be bootviz better identifies which
driver is hanging.

I am not sure bootviz is all that helpful. Just downloaded Load Order.

Have you yet tried unplugging all USB and all other external devices,
even keyboard and mouse, to see if any of that hardware is causing the
unresponsive state? How about any daughtercards? For example, if there
is an analog data/fax modem, pull it and do a cold boot. It's been a
long time since using a data/fax modem but recall that sometimes they
got into a hardware state that rendered them unusable and caused other
nasty symptoms. They required a cold boot to reset them.

yes, except for keboard and mouse.

From a cold boot (not hibernate or low-power mode), does the problem
continue? Completely shutdown Windows, wait for computer to power off,
yank the power cord for 15 seconds, replug the power cord, and cold boot
the computer. Do you see the LEDs flash on a connected keyboard which
shows a Reset sent to all hardware to put it into a known initial state?

cold boot. no symprom change. She can type her password in, but
then has to wait 14 minutes for the desktop to come up.

Without sounding condemning, ask the user if they happened to recently
perform a BIOS flash update, like just before the problem started.
Although against their favor, and if felt like caught doing something
wrong or stupid, users will sometimes lie about a blunder. So just
casually ask them about it within a list of queries you put to the user.

doesn't know how.

Have you cleared the logs in Event Viewer, rebooted, and checked Event
Viewer for any anomalies, like an error stating "Boot critical file:
c:\windows\system32\drivers\fltmgr.sys is corrupt"?

Clear it before each reboot. I have fixed all the error messages.
Good catch on the error logs. I have had that freeze up a machine
before.

If a Windows's safe mode boot eliminates the problem then it certainly
seems that something loaded during normal startup causes the hang.
msconfig.exe only looks at some startup items. Besides just the startup
items, have you also disabled all the unnecessary non-Microsoft services
to test boot load time? There are other startup locations than shown by
msconfig so you might have to use SysInternals' AutoRuns to see all.

Last thing I did (over the wire) to the machine last
night was open up Auto Runs and go through every
service and drive and remove anything "File not found".
Also removed a few drivers I knew she did not use any more,
like Seagate and Maxtor backup schedulers. But, the stinker
crashed on me trying to shut it down, so I will have to
wait till Monday for the customer to power it off and
back on.

Thank you for the help!

-T

 

[Todd]

Right-click the "Start" button, click "Search", then "Back" in the left pane, then
"Change preferences" and see if "Without indexing service" is listed. If so, click it,
select "No, do not enable indexing service" and click "OK".

Ben

No symptom change. Boot Viz shows zero hard drive activity
during the 14 minutes.

Thank you for the help!

-T

 

[Todd]

Fat-32 need more Ram then a NTFS


The RAM maybe going bad or need to add more to it

Add a 1 GB of RAM


fltmgr.sys = Microsoft Filesystem Filter Manager 5.1.2600.5512

NTFS and 4 GB of RAM. Boot Viz shows 0% CPU,
memory, and HD activity during the 14 minutes.

Thank you for the help!

-T

 

[Ben Myers]

No symptom change. Boot Viz shows zero hard drive activity
during the 14 minutes.
Thank you for the help!
-T

Go to "Control Panel", "Internet Options", click on the "Connections" tab, select
"LAN Settings" and see if "Use a proxy server..." is enabled. If so, disable it.

Ben

 

[Todd]

Go to "Control Panel", "Internet Options", click on the "Connections" tab, select
"LAN Settings" and see if "Use a proxy server..." is enabled. If so, disable it.

Ben

Will do. Thank you! What a need in a hay stack!

 

[Buffalo]

"Ben Myers" wrote in message news:[email protected]...

Go to "Control Panel", "Internet Options", click on the "Connections" tab,
select
"LAN Settings" and see if "Use a proxy server..." is enabled. If so,
disable it.

Ben

Seems like since there was no HDD activity or ram usage, the computer was
waiting for something, and that, many times is an internet connection.
I think your suggestion will help out immensely.

 

[Todd]

"Ben Myers" wrote in message news:[email protected]...
Seems like since there was no HDD activity or ram usage, the computer
was waiting for something, and that, many times is an internet connection.
I think your suggestion will help out immensely.

An weekend warrior reboot for me and I was able to log in.
There are no proxy settings. RATS!

 

[Buffalo]

"Todd" wrote in message news:[email protected]...

An weekend warrior reboot for me and I was able to log in.
There are no proxy settings. RATS!

Damn.
Well, when you find the culprit, post back.

 

[VanguardLH]

Never had much luck with sfc. How about yourself?

Most times SFC found the files inuse matched the ones in its cache so
the files were okay. Only once do I remember that it found a corrupted
system file and replaced it. I then followed with a visit to the
Windows Update site to ensure it was the latest one (no update to the
file so it was the latest).

No. Before I would do that, I'd try talking the customer into a full
reinstal.

But then the customer loses all tweaks, customizations, and app
configurations. If this customer has been using that instance of
Windows for awhile, you'll be forcing them to redo all that work which
could take a week, or longer (i.e., until the customer found more stuff
to reconfigure), when a repair might solve the problem in an evening.

You haven't mentioned and it's likely the customer does not perform
regular (daily) backups. If there was an obvious change that the user
noticed, maybe see if System Restore works for them.

You might like the idea of starting with a fresh instance of Windows but
the customer might prefer their computer to be working again as soon as
possible and without have to redo everything to get back to the same
state. In fact, doing a fresh install of Windows won't prevent the user
from doing or installing whatever caused the problem. You'll get a nice
clean install of Windows perhaps with all updates and then eventually
the user does again what causes the problem now. Your time to do the
fresh install and their time to reconfigure would all be wasted since
you still haven't removed the primary cause of the problem: the user.

yes, except for keboard and mouse.

I'd even unplug those since a USB device, any of them, could cause the
hang. You would have to configure Windows for auto-logon so the user
would not need the keyboard at a logon prompt; i.e., have the computer
boot and Windows load and continue right through an automatic login to
check that no external devices (and no extraneous daughtercards) were
causing the hardware hang. Even keyboards aren't the simple devices
they once were. Some have lots of features and come with software, like
for macros, programming, gaming, extra functions, etc. Even if the
keyboard is a simple 101-key device, it might have software installed
for it that could cause problems but if the keyboard isn't attached then
maybe that software won't interfere (but should still be removed). If
you still want the mouse and keyboard attached during the bootup, make
sure to have the customer uninstall any 3rd party software for they,
like a Microsoft or Logitech mouse software/driver package or a keyboard
utility. Just use the embedded standard HID devices included with
Windows.

doesn't know how.

That you think the user doesn't have the expertise to do a BIOS flash
update doesn't preclude the user from reading instructions and stepping
through them. Just ask. Users often update hardware drivers, too, and
for no good or valid reason other than, gee, it's new so it must be
better only to find out the latest driver causes problems with their old
hardware.

You might also want to ask this customer if they contacted any other
support help desk, like for the computer maker (Dell, HP, etc). I've
had those guys remote to a host, fix the problem, but create even worse
problems. My dad would call after calling HP to fix his now-worse
screwed up computer. He'd give me a vague description of what the tech
did, I'd have to undo it, and then address the real problem.

 

[VanguardLH]

Will do. Thank you! What a need in a hay stack!

In fact, you might want to yank the Ethernet cable or disable the NIC
or turn off the router (whatever is easiet) to completely disable
network access. Not just Internet access but all network access, even
the local nework. For example, mapped drives can cause delays on login
to reconnect to all those hosts (although it shouldn't be 14 minutes
unless the number of mapped drives is huge and the hosts really slow).

 

[Todd]

"Todd" wrote in message news:[email protected]...
Damn.
Well, when you find the culprit, post back.

Hi Bufflo,

Oh, I intent to bitch and bitch and bitch ...

-T

 

[Todd]

You haven't mentioned and it's likely the customer does not perform
regular (daily) backups.

In another letter I said she uses Cobian Backup and it
goes off as 12:10 weekdays.

If yo can type and mouse the mouse, they are not the
problem. I will try anything at this point though.

This is a customer to die for. I build this computer for
her. She runs everything by me. Her descriptions of problems
are so good that a few months back my phone was ringing off the
hook with all kinds of weird and different problems that I just
could not get a handle on. Very, Very frustrating. Then this
lady called and got in the queue. My wife took the message.
Then second had, she told me troubleshoot everyone else's
problems based on this lady's description. I fixed every one.
bang, bang, bang. One after another. They were all the
same problem and not one but hers was the only correct description.
Not the first time she has been dead on either.

Complaint: I need a new mouse.
Translation: teach user how to reboot

If this lady says she didn't, she didn't.

-T

 

[VanguardLH]

In another letter I said she uses Cobian Backup and it
goes off as 12:10 weekdays.

If yo can type and mouse the mouse, they are not the
problem. I will try anything at this point though.

This is a customer to die for. I build this computer for
her. She runs everything by me. Her descriptions of problems
are so good that a few months back my phone was ringing off the
hook with all kinds of weird and different problems that I just
could not get a handle on. Very, Very frustrating. Then this
lady called and got in the queue. My wife took the message.
Then second had, she told me troubleshoot everyone else's
problems based on this lady's description. I fixed every one.
bang, bang, bang. One after another. They were all the
same problem and not one but hers was the only correct description.
Not the first time she has been dead on either.

Complaint: I need a new mouse.
Translation: teach user how to reboot

If this lady says she didn't, she didn't.

-T

Since the problem occurs after she logs on, what did AutoRuns show added
under the WinLogon event? This is one of those sneaky places that
malware and some okay programs like to hide. When using AutoRuns, make
sure the status bar doesn't still say "scanning". It can take a little
bit of time to compile the complete list of all startup items.

Another sneaky place to hide is the logon script for an account. You
have to look at the details of the problematic account to see if a logon
script was defined for it. As I recall, run "control userpasswords2",
go to Advanced, and look at the account to check if the logon script
field is non-blank.

msconfig doesn't include this but AutoRuns does: Did you check the Task
Scheduler? Some startup items go there and can be configured to run on
login. You could disable the Task Scheduler service and reboot to test
if nothing pops out at you but then you could also just disable every
scheduled event in Task Manager and reboot rather than disable its
service.

I don't remember where is the tweak or config setting but, as I recall,
you can configure Windows to reload all apps on a restart. If, for
example, the user had left open a media viewer trying to play a
corrupted video file then it reloads on Windows restart and hangs again.
Also, a corrupt video file, especially .avi files, can cause a hang in
Windows Explorer (which is the same program used to manage the desktop).
If the user has Windows Explorer open and selects a corrupted .avi, or a
file with a defective or corrupted codec, then Windows Explorer hangs.
Make sure the restart option to reopen windows that were closed on
shutdown is not enabled.

You say the user gets the login prompt, logs in, and then has to wait 14
minutes. Just to be sure it isn't a timing issue where the user thinks
it only occurs after login, have the user restart Windows and then let
it sit at the logon prompt for 20 minutes. Then have her login to see
if the login goes right in or if there the 14-minute delay truly starts
counting after login. Most likely every time Windows has started the
user has logged in right away so it is uncertain if the delay is part of
Windows startup (there's most to load even after the logon prompt
appears) or only starts sometime after logging in.