Security Filtering Group to use for Default Domain Policy

[Bill Bradley]

Our Domain, all sites, is experiencing slow logons/boots.

In searching for solutions, one of the things we found is that the Default
Domain GPO (maybe, others, too) should have the Domain Computers group added
into the Security Filtering under Scope.

Currently, all that's in there, and, most other GPO's, is Authenticated
Users, which, I thought, included both users and computers, and, is
preferable over the Everyone group.

Should I add Domain Computers in, too?

If not, any hints on troubleshooting slow logon/boot?

Thanks!

 

[Florian Frommherz [MVP]]

Bill,

Currently, all that's in there, and, most other GPO's, is Authenticated
Users, which, I thought, included both users and computers, and, is
preferable over the Everyone group.

Should I add Domain Computers in, too?

The default is "Authenticated Users" and yes, it already includes the
"Domain Computers" group in there. So no need to tweak the security
settings at all. They're fine this way.

As for further troubleshooting the startups, try to unplug the network
cable and see how fast it's no going to boot up. If the bootup is
faster, it's a domain thing. If not, you're gonna have to look at
drivers and stuff so that network and stuff.

Check for DNS configuration and make sure the client only has valid DNS
servers in its configuration (only DCs at best!), look for scripts that
might take some time to execute (scripts that access file shares),
extensive use of alternative permissions on GPOs (security filtering)
and WMI filtering. Those might slow down GP processing.

At what stage does it "hang"? You may want to enable userenv debug
logging and check if and where booting and logging on hangs.

cheers,

Florian