Clients are effected by this slow logon behavior when the policy file is being downloaded. Administrators can disable slow-link detection (by using Administrator Templates\System\Group Policy) to force policy downloads regardless of the link speed. Each modification of the policy file causes the Registry.pol file to be downloaded by remote clients, for every change.
For more information about how a slow link is detected and the default behavior of Group Policy extensions over slow link, click the following article numbers to view the articles in the Microsoft Knowledge Base:
227369 Default behavior for Group Policy extensions with slow link
227260 How a slow link is detected for user profiles and Group Policy
By default, the redirector attempts to get an opportunistic lock when a file is opened remotely. This enables the redirector to use read-ahead caching to improve performance.
For more information about oplocks, click the following article number to view the article in the Microsoft Knowledge Base:
129202 Explanation of opportunistic locking on Windows NT
In certain cases, the file server may reject opportunistic locking requests. This frequently occurs if the file is locked for exclusive/write use. Additionally, the Server service performs the following checks to prevent data damage and to improve stability:
- Check to determine whether the file is a system file
- Check to determine whether the network link is considered reliable
- Check to determine whether there are filter drivers that have not finished their job
For more information about a related topic, click the following article number to view the article in the Microsoft Knowledge Base:
306981 Level II oplocks are not granted after a file is locked
The users that access the files by using oplocks do not experience this behavior because the redirector performs read-ahead caching, and file reads are served from the redirector cache.
If the redirector does not open the remote file by using opportunistic locking, the Windows NT 4.0 SMB or CIF 2.0 specification from MSDN states:
If a client holds no oplocks, all requests other than reads must be sent to the server. Reads may be performed using cached or read-ahead data as long as the byte range has been locked by the client; otherwise they too must be sent to the server.
This causes the policy load method reads to access the server by using the network for each Unicode character that is read. If the policy file is large, and if the available bandwidth to the clients is low, significant delays occur while policies are loading, and this create logon delays.
To identify this situation, use any of the following methods.
Method 1
You can run the third-party Filemon.exe tool from the following Sysinternals Web site:
The output from the Filemon.exe tool is similar to:
System:8 FSCTL_REQUEST_BATCH_OPLOCK C:\WINNT\SYSVOL\domain\Policies\{Policy-GUID}\user\registry.pol OPLOCK NOT GRANTED
System:8 FSCTL_REQUEST_OPLOCK_LEVEL_2 C:\WINNT\SYSVOL\domain\Policies\{Policy-GUID}\user\registry.pol OPLOCK NOT GRANTED
System:8 FASTIO_QUERY_NETWORK_OPEN_INFO C:\WINNT\SYSVOL\domain\Policies\{Policy-GUID}\user\registry.pol SUCCESS
Method 2
Microsoft network monitor traces display Oplock Level=none for the server response to the file open request:
SMB: R NT create and X, FID = 0x4009
+ SMB: NT status code = 0x0, Facility = System, Severity = Success, Code = (0) STATUS_WAIT_0
+ SMB: Header: PID = 0x00B8 TID = 0x0804 MID = 0x0841 UID = 0x1000
SMB: Command = C NT create and X
SMB: Word count = 42
SMB: Word parameters
SMB: Next offset = 0x0087
SMB: Word count = 42
SMB: Word parameters
SMB: Oplock Level = NONE
SMB: File ID (FID) = 16393 (0x4009)
SMB: File name = \mydom.com\Policies\{E3FDB1FB-0FA1-484E-8751-7009DD5287BD}\User\registry.pol
The sequential 2 byte reads to the policy file, making it a slow download if the file is large:
107 26.234375 SMB C NT create n X, File = \mydom.com\Policies\{E3FDB1FB-0FA1-484E-8751-7009DD5287BD}\User\registry
108 26.234375 SMB R NT create n X, FID = 0x4009 161.123.162.142 161.123.110.40
109 26.296875 SMB C read n X, FID = 0x4009, Read 0x4 at 0x00000000 161.123.110.40 161.123.162.142
110 26.296875 SMB R read n X, Read 0x4 161.123.162.142 161.123.110.40
111 26.343750 SMB C read n X, FID = 0x4009, Read 0x4 at 0x00000004 161.123.110.40 161.123.162.142
112 26.343750 SMB R read n X, Read 0x4 161.123.162.142 161.123.110.40
113 26.406250 SMB C read n X, FID = 0x4009, Read 0x2 at 0x00000008 161.123.110.40 161.123.162.142
114 26.406250 SMB R read n X, Read 0x2 161.123.162.142 161.123.110.40
115 26.453125 SMB C read n X, FID = 0x4009, Read 0x2 at 0x0000000A 161.123.110.40 161.123.162.142