25 minute logon?? Please Help.

[mace07]

Hi everyone,

Let me preface this by saying that I am somewhat of a novice when it
comes to networking setups, I have some experience but have been
learning a lot just by doing. But there is a LOT that i do not know.
With that said, I was asked by a friend to come take a look at her
computer network at her workplace. The network is Windows 2000 and
consists of 4 Desktop PCs and 1 laptop. Each running windows 2000.
Long story short i spent several hours removing countless spyware and
trojans and assorted viruses from three of the machines. But the
reason the friend asked me there was because it takes every machine on
the network about 25 minutes to start up. 20 of those minutes are
after the password is entered on the logon screen. A great deal of the
time is spent "Applying user settings". I check all the startup
processes and removed those that were expendable. and after a lot of
web research i came across a suggestion to change the DHCP Client
service to "Manual" from "automatic". I did so, rebooted and startup
took 5 minutes tops. So much better. At which point i could manually
restart the DHCP service and reconnect to the network. Does anyone
have any idea WHY this is the case? obviously something in the network
configuration is causing a major slowdown during startup. Any
suggestions for tweaks to be made?

I'm sure i'm leaving out some details you need to evaluate everything
-- just let me know and I'll try to respond with what I can.

Appreciate the help!

 

[Robert L [MS-MVP]]

it could be a spyware. download msconfig to check any suspect software running.

Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
Hi everyone,

Let me preface this by saying that I am somewhat of a novice when it
comes to networking setups, I have some experience but have been
learning a lot just by doing. But there is a LOT that i do not know.
With that said, I was asked by a friend to come take a look at her
computer network at her workplace. The network is Windows 2000 and
consists of 4 Desktop PCs and 1 laptop. Each running windows 2000.
Long story short i spent several hours removing countless spyware and
trojans and assorted viruses from three of the machines. But the
reason the friend asked me there was because it takes every machine on
the network about 25 minutes to start up. 20 of those minutes are
after the password is entered on the logon screen. A great deal of the
time is spent "Applying user settings". I check all the startup
processes and removed those that were expendable. and after a lot of
web research i came across a suggestion to change the DHCP Client
service to "Manual" from "automatic". I did so, rebooted and startup
took 5 minutes tops. So much better. At which point i could manually
restart the DHCP service and reconnect to the network. Does anyone
have any idea WHY this is the case? obviously something in the network
configuration is causing a major slowdown during startup. Any
suggestions for tweaks to be made?

I'm sure i'm leaving out some details you need to evaluate everything
-- just let me know and I'll try to respond with what I can.

Appreciate the help!

 

[mace07]

Thanks, Bob. Pretty sure I got the spyware and suspect processes off
the machines. And each machine takes the same amount of time to boot
up. and only when DHCP is automatic. wouldn't this lean towards some
sort of network configuration issue? Feel free to correct me.

 

[josepe]

You should format the pcs and build a clean reinstall. Before connect to
the lan or internet should install service pack 4 (win2000) and news
updates. Install an antivirus updated and personal firewall if not exist
a lan-firewall.
First, you need know/have the drivers of all pcs.

 

[Phillip Windell]

A few things to look at:

1. In the event there is more than one network interface in the machine (
which
includes the virtual Dialup Adapter, Firewire, and both wired and
wireless Nics),
you want the main LAN Nic to be the first in the binding order.
Properties of Network Places,..Advanced from top menu,...Advanced
Settings
from the dropdown menu. In the upper box use the side arrows to move the
adapter to the top of the list if it isn't already.

2. If there is a Domain with a Domain Controller. The Domain Controller is
almost
always the Active Directory DNS machine as well (AD/DNS). Every machine
on
the LAN must use this as the *only* DNS Server in the TCP/IP Settings.
If using
DHCP then the DHCP Scope should only give out that DNS IP#. Then on the
AD/DNS machine go into the Properties of the DNS Server and add the
ISP's
DNS IP# to the Forwarder's List. This is done in:
DNS MMC--> ServerName-->Properties-->Forwarders Tab-->add it to the list
in the lower part of the dialog box.
Make sure the AD/DNS Machine is allowed to make outbound DNS queries
(Firewalls could block it).

The "Applying User Settings" that you see is the System Policies that in a
Domain come from the Domain Controller (Group Policy). The above steps
assure that the Client-to-AD/DNS communication is "clean" and unconfused.

Also any machines that have addition LAN Nics in them should have the Nics
disabled if they aren't using them. That can be done in Device Manager or
the Properties of Network Places.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/prodtechnol/isa/2004/deploy/dgisaserver.mspx

 

[Guest]

1. if you let one of the pc boot p nomally what is the Ip adress it has ? is
it a 169.x.x.x ?
2 where are the 5 machines getting there ip's asigned from you don't mention
a dhcp server?
if the answer to the first question is yes then it is taking so long because
the machines are waiting for an ip to be givn to them then self assigning a
defualt one which can take quite awhile.
if you do have a dhcp server that may be the problem and you might just give
the 5 machines static ip adresses all in the same ip range of your router
then they will not have to wait for the ip to be assigned.
you can find out what your IP is after it boots by opening a command promt
start > run cmd then typing ipconfig /all.
If you are getting your Ip adresses from a router (dsl cable ) that could be
your problem there I have seen one where the swich part of the router was
only working at 1 meg or less and odd things like your logg on happened.

 

[mace07]

the IPs are 192.168.xx.x from a DHCP server.

 

[mace07]

and just to add this. if i logon with the dhcp service stopped, the
computer boots up normally (3-5 minutes). and then when i start the
DHCP client service up, it connects to the network within about 30
seconds. so i find it curious that it takes so long to do the same
thing if done during the startup process. i just don't know. i'm at a
loss.

 

[.]

What kind of network? Peer-to-peer, Active Directory, or NT 4? I know you
said it's a "Windows 2000" network but I want to make sure that you meant
it's Active Directory.

If it's NT 4, you need to start the WINS service on a server, set that
server so its WINS server entries are the same as the server's IP address,
and configure DHCP to hand out that IP address as the WINS server to the
clients.

If it's Active Directory, make sure DNS is working correctly.

Ray