Windows 7 SP1 - Event 7011 - Timeout gpsvc service - welcome screen randomly hangs for 30 to 90 minutes.

Question

We rolled out Windows 7 x32 to 1200+ computers and are having random issues with extremely long login times.  Most of the time users can log into the network without issues but I typically have several computers each week that hang at the
welcome screen.  In every instance I receive the following errors.  The number of errors is directly related to the amount of time it takes for the computer to log the user in which makes since with the 30 second timeout.
Log Name:      System
Source:        Service Control Manager
Date:          10/30/2013 8:19:15 AM
Event ID:      7011
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CATECHALP.bgcs.k12.oh.us
Description:
A timeout (30000 milliseconds) was reached while waiting for a transaction response from the gpsvc service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7011</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-30T12:19:15.461367100Z" />
    <EventRecordID>19317</EventRecordID>
    <Correlation />
    <Execution ProcessID="536" ThreadID="3500" />
    <Channel>System</Channel>
    <Computer>CATECHALP.bgcs.k12.oh.us</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">30000</Data>
    <Data Name="param2">gpsvc</Data>
  </EventData>
</Event>
This morning the tech coordinator was stuck at the welcome screen for 30 minutes with 17 of the above messages until we forced the computer off and logged in successfully.  We rebooted immediately after logging into the computer and logged in a third
time without any issues.  I also checked the logs and didn't see or have any issues with the 2nd and 3rd login attempts.  The group policy client service also started successfully about 1 minute before the first error on the first attempt.
I also went through the Applications and Services Logs>Microsoft>Windows>GroupPolicy>Operational logs but didn't see any issues.  Here is the last entry in the log file until the reboot.  All 17 messages didn't generate any information
in the GroupPolicy logs.
Log Name:      Microsoft-Windows-GroupPolicy/Operational
Source:        Microsoft-Windows-GroupPolicy
Date:          10/30/2013 8:16:44 AM
Event ID:      4016
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      CATECHALP.bgcs.k12.oh.us
Description:
Starting Group Policy Folders Extension Processing.
List of applicable Group Policy objects: (No changes were detected.)
7 Default Domain Policy
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
    <EventID>4016</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-30T12:16:44.010292800Z" />
    <EventRecordID>37783</EventRecordID>
    <Correlation ActivityID="{95B5B1C8-886C-4A41-AB64-60EE164266E5}" />
    <Execution ProcessID="1260" ThreadID="1404" />
    <Channel>Microsoft-Windows-GroupPolicy/Operational</Channel>
    <Computer>CATECHALP.bgcs.k12.oh.us</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="CSEExtensionId">{6232C319-91AC-4931-9385-E70C2B099F0E}</Data>
    <Data Name="CSEExtensionName">Group Policy Folders</Data>
    <Data Name="IsExtensionAsyncProcessing">true</Data>
    <Data Name="IsGPOListChanged">false</Data>
    <Data Name="GPOListStatusString">%%4101</Data>
    <Data Name="DescriptionString">7 Default Domain Policy
</Data>
    <Data Name="ApplicableGPOList">&lt;GPO ID="{6C77B631-1580-41B1-B63A-D3D593EB84AC}"&gt;&lt;Name&gt;7 Default Domain Policy&lt;/Name&gt;&lt;/GPO&gt;</Data>
  </EventData>
</Event>
Other Information
1. Server OS - Windows 2008 R2 servers. ~20 servers with 7 DC's.
2. Windows OS - Windows 7 x32 SP1 workstation. ~1200
3. This happens on wireless and wired connections.
4. This happens across all hardware and models of laptops and desktops.  Ranging from GX270 - Opti 760, Latitude D510 - Latitude E6410, Latitude 2100 - Latitude 2120's and all models in between.
5. We are currently using SCCM 2012 to deploy images and applications.  The image was created through SCCM using Build and Capture so I never touched the image.
6. The drivers were downloaded from Dell but this is happening on multiple machines so I don't think its driver related.
7. We are using Forefront Antivirus.
8. We upgraded the machines to 2Gig of ram and upgraded them from XP to Windows 7 this summer.
9. We upgraded the servers from Windows 2003 R2 to Windows 2008 R2 this summer just before deploying Windows 7.
10. This is only reported through the helpdesk on less than 10 computers each week but I'm told it happens more frequently when I'm in the buildings.
11. We are using Group Policies to manage almost all aspects of the computer except for printers.  The printer drivers we are using are so slow that it added 60 to 180 seconds to the login time so I moved the printer mapping to a vbscript that
is launched through the logon script through a GPO.
Users are holding the power button in to shut down the machine as they can typically log in a second time without issues.  I have heard that a few people have issues logging into the computer the second time but it's normally running by the
time I heard about it.
Are there any other logs that I can look at to troubleshoot this issue?  Thanks for taking the time to read this issue.

Answer 1

Hmmm hard to say. If I was going to take a stab at it you might be hitting a DC in a remote site. 
http://blogs.technet.com/b/askpfeplat/archive/2011/12/26/in-search-of-roaming-active-directory-clients-how-to-scriptomatically-identify-missing-active-directory-subnet-definitions.aspx
A great tool for this, http://blogs.technet.com/b/askpfeplat/archive/2012/06/09/slow-boot-slow-logon-sbsl-a-tool-called-xperf-and-links-you-need-to-read.aspx
You could also take a look at this. http://blogs.technet.com/b/askpfeplat/archive/2013/03/12/slow-boot-slow-login-sbsl-hotfix-rollup-for-windows-7-and-server-2008-r2-available-today.aspx
Mark Morowczynski
Microsoft Senior Platforms PFE
Blog:
http://blogs.technet.com/b/askpfeplat  Twitter:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.