Slow Logins and Slow Boot-up

I have a 2003 AD and my workstations are very slow to apply computer settions
and complete the user login.

For the most part I have figured it's just how it is.
Yesterday I used Group Policy to deploy Java 6-13 via machine settings.
The install is taking anywhere from 20 min to over an hour on some systems.
There is nothing I can do except wait for the process to complete.
As far as I can tell my DNS is running well.

I have 2 AD servers on my local site and 2 other sites each with a AD server.
All my workstations are in the one main site (with the two Ad servers)
The other sites are my off site Exchange (hosted and connected via VPN) and
an backup server (connected via VPN)

I wonder if some of my clients are connecting to the othere sites for their
AD info. ?Runing scripts over the slower VPN.

Is there a health check I can run to verify all AD transations run on my
main site?
Or can I somehow block Group Policy Scripts from running across sites?

Maybe a way to see what DC each client connects to?
I feel like my AD health is not wonderful.

Hello Adam,
Do the users have roaming profile or drives mapping at logon? By default
clients will use AD servers on their current subnet, but you cn verify which
DC they are authenticating to by doing a simple set logonserver at command
prompt on the client workstation. Since you have DCs on both sites, clients
should be getting gpos from the DCs in their sites/location. I will look
more if you have any roaming profile or drive mapping at logon that might be
slowing down authentication..
Also check the health of the AD servers on the locations that you are having
issues.. do a dcdiag /q for any errors etc

--
Isaac Oben [MCTIP:EA, MCSE]
"Adam" <Adam@discussions.microsoft.com> wrote in message
news:38C25CF3-7831-4566-89C6-3F9D53726A4C@microsoft.com...
>I have a 2003 AD and my workstations are very slow to apply computer
>settions
> and complete the user login.
>
> For the most part I have figured it's just how it is.
> Yesterday I used Group Policy to deploy Java 6-13 via machine settings.
> The install is taking anywhere from 20 min to over an hour on some
> systems.
> There is nothing I can do except wait for the process to complete.
> As far as I can tell my DNS is running well.
>
> I have 2 AD servers on my local site and 2 other sites each with a AD
> server.
> All my workstations are in the one main site (with the two Ad servers)
> The other sites are my off site Exchange (hosted and connected via VPN)
> and
> an backup server (connected via VPN)
>
> I wonder if some of my clients are connecting to the othere sites for
> their
> AD info. ?Runing scripts over the slower VPN.
>
> Is there a health check I can run to verify all AD transations run on my
> main site?
> Or can I somehow block Group Policy Scripts from running across sites?
>
> Maybe a way to see what DC each client connects to?
> I feel like my AD health is not wonderful.
>
>

Simple things first.

You have three Sites with 4 DCs.
When you say "Site" do you only mean only the Physical Site or do you mean
Sites listed in Active Directory Sites and Services?

How do you configure DNS on the Clients and "other" servers within their
TCP/IP Specs?

How do you configure DNS on the DCs themselves within their TCP/IP specs?



--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------



"Adam" <Adam@discussions.microsoft.com> wrote in message
news:38C25CF3-7831-4566-89C6-3F9D53726A4C@microsoft.com...
>I have a 2003 AD and my workstations are very slow to apply computer
>settions
> and complete the user login.
>
> For the most part I have figured it's just how it is.
> Yesterday I used Group Policy to deploy Java 6-13 via machine settings.
> The install is taking anywhere from 20 min to over an hour on some
> systems.
> There is nothing I can do except wait for the process to complete.
> As far as I can tell my DNS is running well.
>
> I have 2 AD servers on my local site and 2 other sites each with a AD
> server.
> All my workstations are in the one main site (with the two Ad servers)
> The other sites are my off site Exchange (hosted and connected via VPN)
> and
> an backup server (connected via VPN)
>
> I wonder if some of my clients are connecting to the othere sites for
> their
> AD info. ?Runing scripts over the slower VPN.
>
> Is there a health check I can run to verify all AD transations run on my
> main site?
> Or can I somehow block Group Policy Scripts from running across sites?
>
> Maybe a way to see what DC each client connects to?
> I feel like my AD health is not wonderful.
>
>

Isaac,

I do have Roaming Profiles as well as folder redirect.
I have Desktop and My Docs redirected with Roaming profiles.
I also have drive mapping via login- Group Policy User based scripts.

I know there is a lot going on at boot up and log in but today it was crazy
slow.


"Isaac Oben [MCITP,MCSE]" wrote:

> Hello Adam,
> Do the users have roaming profile or drives mapping at logon? By default
> clients will use AD servers on their current subnet, but you cn verify which
> DC they are authenticating to by doing a simple set logonserver at command
> prompt on the client workstation. Since you have DCs on both sites, clients
> should be getting gpos from the DCs in their sites/location. I will look
> more if you have any roaming profile or drive mapping at logon that might be
> slowing down authentication..
> Also check the health of the AD servers on the locations that you are having
> issues.. do a dcdiag /q for any errors etc
>
> --
> Isaac Oben [MCTIP:EA, MCSE]
> "Adam" <Adam@discussions.microsoft.com> wrote in message
> news:38C25CF3-7831-4566-89C6-3F9D53726A4C@microsoft.com...
> >I have a 2003 AD and my workstations are very slow to apply computer
> >settions
> > and complete the user login.
> >
> > For the most part I have figured it's just how it is.
> > Yesterday I used Group Policy to deploy Java 6-13 via machine settings.
> > The install is taking anywhere from 20 min to over an hour on some
> > systems.
> > There is nothing I can do except wait for the process to complete.
> > As far as I can tell my DNS is running well.
> >
> > I have 2 AD servers on my local site and 2 other sites each with a AD
> > server.
> > All my workstations are in the one main site (with the two Ad servers)
> > The other sites are my off site Exchange (hosted and connected via VPN)
> > and
> > an backup server (connected via VPN)
> >
> > I wonder if some of my clients are connecting to the othere sites for
> > their
> > AD info. ?Runing scripts over the slower VPN.
> >
> > Is there a health check I can run to verify all AD transations run on my
> > main site?
> > Or can I somehow block Group Policy Scripts from running across sites?
> >
> > Maybe a way to see what DC each client connects to?
> > I feel like my AD health is not wonderful.
> >
> >
>

They are both Physical sites and AD sites.
I created two additional sites in AD Sites and Services by IP Subnet.


The DCs all have static IP, Each with DNS servers (pointing to themselves
for DNS)
DNS is AD integrated.
Clients have DHCP with DNS pointing to the 2 DCs in my main (default) site.

I have four total DCS
2 in Default site - where my workstations are
1 in Remote Site (1) Hosted off site Email server -- Firewall site VPN
1 in Remote Site (2) Backup server - Firewall Site VPN

If should also be noted The Default site sees both sites fine
Site (1) sees the Default Site
Site (2) sees the Default Site

Site (1) does not see Site (2) and site (2) does not see Site (1)
-- based on how the VPN is connected.



"Phillip Windell" wrote:

> Simple things first.
>
> You have three Sites with 4 DCs.
> When you say "Site" do you only mean only the Physical Site or do you mean
> Sites listed in Active Directory Sites and Services?
>
> How do you configure DNS on the Clients and "other" servers within their
> TCP/IP Specs?
>
> How do you configure DNS on the DCs themselves within their TCP/IP specs?
>
>
>
> --
> Phillip Windell
> www.wandtv.com
>
> The views expressed, are my own and not those of my employer, or Microsoft,
> or anyone else associated with me, including my cats.
> -----------------------------------------------------
>
>
>
> "Adam" <Adam@discussions.microsoft.com> wrote in message
> news:38C25CF3-7831-4566-89C6-3F9D53726A4C@microsoft.com...
> >I have a 2003 AD and my workstations are very slow to apply computer
> >settions
> > and complete the user login.
> >
> > For the most part I have figured it's just how it is.
> > Yesterday I used Group Policy to deploy Java 6-13 via machine settings.
> > The install is taking anywhere from 20 min to over an hour on some
> > systems.
> > There is nothing I can do except wait for the process to complete.
> > As far as I can tell my DNS is running well.
> >
> > I have 2 AD servers on my local site and 2 other sites each with a AD
> > server.
> > All my workstations are in the one main site (with the two Ad servers)
> > The other sites are my off site Exchange (hosted and connected via VPN)
> > and
> > an backup server (connected via VPN)
> >
> > I wonder if some of my clients are connecting to the othere sites for
> > their
> > AD info. ?Runing scripts over the slower VPN.
> >
> > Is there a health check I can run to verify all AD transations run on my
> > main site?
> > Or can I somehow block Group Policy Scripts from running across sites?
> >
> > Maybe a way to see what DC each client connects to?
> > I feel like my AD health is not wonderful.
> >
> >
>
>
>

"Adam" <Adam@discussions.microsoft.com> wrote in message
news:E7881E96-8AE8-41EC-B190-39CDFFFAA69B@microsoft.com...

> Clients have DHCP with DNS pointing to the 2 DCs in my main (default)
> site.

No. They need to point only to the DC in their own respective Site. They
could use other DC/DNS as "secondaries" but I personally am not sure I would
even do that.

Likewise DC/DNS's should only point to DCs in thier own site (which is only
themself in two of the sites)

> Site (1) does not see Site (2) and site (2) does not see Site (1)
>-- based on how the VPN is connected.

You will "get by",...but it all works better if they see each other
properly.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

Philip,

Yes I do have my clients pointing to the DNS in thier site
DC1 with DC2 as 2nd.
This was I can bring on DC offline to reboot without any distrutions.

All servers and clients only point to the DCs in their site.

As far as Site(1) and Site (2) not connected to each othere its not a big
concern.
Replication all goes though my Default site anyway.

I can try to enable those connections to see if it helps.

"Phillip Windell" wrote:

> "Adam" <Adam@discussions.microsoft.com> wrote in message
> news:E7881E96-8AE8-41EC-B190-39CDFFFAA69B@microsoft.com...
>
> > Clients have DHCP with DNS pointing to the 2 DCs in my main (default)
> > site.
>
> No. They need to point only to the DC in their own respective Site. They
> could use other DC/DNS as "secondaries" but I personally am not sure I would
> even do that.
>
> Likewise DC/DNS's should only point to DCs in thier own site (which is only
> themself in two of the sites)
>
> > Site (1) does not see Site (2) and site (2) does not see Site (1)
> >-- based on how the VPN is connected.
>
> You will "get by",...but it all works better if they see each other
> properly.
>
> --
> Phillip Windell
> www.wandtv.com
>
> The views expressed, are my own and not those of my employer, or Microsoft,
> or anyone else associated with me, including my cats.
> -----------------------------------------------------
>
>
>

Hello Adam,

Make sure the clients use there site DNS as preferred, for failover set the
secondaries to the other site DNS. Do not use the ISP's DNS server on the
client NIC's.

Check that AD sites and services are configured with the correct subnets
added to the site where the DC's are located.

Slow installation can also result if you have an AntiVirus program running,
that scans the files during setup.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I have a 2003 AD and my workstations are very slow to apply computer
> settions and complete the user login.
>
> For the most part I have figured it's just how it is.
> Yesterday I used Group Policy to deploy Java 6-13 via machine
> settings.
> The install is taking anywhere from 20 min to over an hour on some
> systems.
> There is nothing I can do except wait for the process to complete.
> As far as I can tell my DNS is running well.
> I have 2 AD servers on my local site and 2 other sites each with a AD
> server.
> All my workstations are in the one main site (with the two Ad servers)
> The other sites are my off site Exchange (hosted and connected via
> VPN) and
> an backup server (connected via VPN)
> I wonder if some of my clients are connecting to the othere sites for
> their AD info. ?Runing scripts over the slower VPN.
>
> Is there a health check I can run to verify all AD transations run on
> my
> main site?
> Or can I somehow block Group Policy Scripts from running across sites?
> Maybe a way to see what DC each client connects to? I feel like my AD
> health is not wonderful.
>