Branch office slow login

[Edward]

Here's my environment:
1. Dfs is AD published
2. 2 AD DC in corporate LAN
3. Branch offices have a DC that's been GC enabled
4. Users get assigned a GPO on logon. Login script is
defined on user's GPO.

Users, at branch offices, log on just fine as quiet fast -
as long as the link to corporate is up (WAN environmet).
If I cut the WAN link, and restart a user's computer - it
takes a long time before they get to the CTRL-ALT-DEL
screen. They can log on, but the logon script doesn't
execute for some unknown reason. Yes, the DCs are
synchronizing; I've checked the SYSVOL and it's
synchronized. It appears also that their GPO doesn't kick
in either.
They are being authenticated by their local DC as
LOGONSERVER= their local DC.

Any ideas would be greatly appreciated.

[Rocky]

I take it you have set up sites in AD?


"Edward" <anonymous@discussions.microsoft.com> wrote in message
news:2158c01c45ab2$8fe059e0$a101280a@phx.gbl...

> Here's my environment:
> 1. Dfs is AD published
> 2. 2 AD DC in corporate LAN
> 3. Branch offices have a DC that's been GC enabled
> 4. Users get assigned a GPO on logon. Login script is
> defined on user's GPO.
>
> Users, at branch offices, log on just fine as quiet fast -
> as long as the link to corporate is up (WAN environmet).
> If I cut the WAN link, and restart a user's computer - it
> takes a long time before they get to the CTRL-ALT-DEL
> screen. They can log on, but the logon script doesn't
> execute for some unknown reason. Yes, the DCs are
> synchronizing; I've checked the SYSVOL and it's
> synchronized. It appears also that their GPO doesn't kick
> in either.
> They are being authenticated by their local DC as
> LOGONSERVER= their local DC.
>
> Any ideas would be greatly appreciated.

[Edward]

Yes, sorry forgot to mention that. AD sites and subnets
have been setup for each of my branch offices. And the
branch AD server has been set for the corresponding site.

>-----Original Message-----
>I take it you have set up sites in AD?
>
>
>"Edward" <anonymous@discussions.microsoft.com> wrote in

message

>news:2158c01c45ab2$8fe059e0$a101280a@phx.gbl...

>> Here's my environment:
>> 1. Dfs is AD published
>> 2. 2 AD DC in corporate LAN
>> 3. Branch offices have a DC that's been GC enabled
>> 4. Users get assigned a GPO on logon. Login script is
>> defined on user's GPO.
>>
>> Users, at branch offices, log on just fine as quiet fast -
>> as long as the link to corporate is up (WAN environmet).
>> If I cut the WAN link, and restart a user's computer - it
>> takes a long time before they get to the CTRL-ALT-DEL
>> screen. They can log on, but the logon script doesn't
>> execute for some unknown reason. Yes, the DCs are
>> synchronizing; I've checked the SYSVOL and it's
>> synchronized. It appears also that their GPO doesn't kick
>> in either.
>> They are being authenticated by their local DC as
>> LOGONSERVER= their local DC.
>>
>> Any ideas would be greatly appreciated.

>
>
>.
>

[Edward]

Yes, Sites and subnets are configured in AD. Also, I've
assigned the correct branch AD to the proper AD site and
subnet.

Thanks for your response :)

>-----Original Message-----
>I take it you have set up sites in AD?
>
>
>"Edward" <anonymous@discussions.microsoft.com> wrote in

message

>news:2158c01c45ab2$8fe059e0$a101280a@phx.gbl...

>> Here's my environment:
>> 1. Dfs is AD published
>> 2. 2 AD DC in corporate LAN
>> 3. Branch offices have a DC that's been GC enabled
>> 4. Users get assigned a GPO on logon. Login script is
>> defined on user's GPO.
>>
>> Users, at branch offices, log on just fine as quiet

fast -

>> as long as the link to corporate is up (WAN

environmet).

>> If I cut the WAN link, and restart a user's computer -

it

>> takes a long time before they get to the CTRL-ALT-DEL
>> screen. They can log on, but the logon script doesn't
>> execute for some unknown reason. Yes, the DCs are
>> synchronizing; I've checked the SYSVOL and it's
>> synchronized. It appears also that their GPO doesn't

kick

>> in either.
>> They are being authenticated by their local DC as
>> LOGONSERVER= their local DC.
>>
>> Any ideas would be greatly appreciated.

>
>
>.
>

[Rocky]

Strange that a login script runs when the wan is connected but not when
disconnected given you have a local dc in the site and the clients you are
running must obviously be 2000 or xp desktops as you cant assign scripts via
gpo to earlier OSs ie 9x.

I also experience slightly longer logons if the wan link is down but
everything else works as expected.

As you mention dfs, I presume the login scripts are mapping the users drive
to a share on dfs? If so, that adds another layer to troubleshoot.

You'll probably have to troubleshoot in stages, firstly checking that the
branch office DC is set up correctly. Running dcdiag and netdiag from the
support tools is a good start. Also using the repladmin command line tool
to check the time of last replication and success status or not of the
various AD partitions that get replicated around.

If you're satisfied everything is ok, then you'll have to move onto the
clients. If xp, run rsop.msc to confirm that the gpos you configured are
reaching the client. \

then dfs, try to map to the dfs share in your domain by
\\domainname\dfssharename\etc and see if you can access the resources whilst
the wan link is down.

Good luck


"Edward" <anonymous@discussions.microsoft.com> wrote in message
news:217ba01c45abe$484bf4c0$a401280a@phx.gbl...

> Yes, Sites and subnets are configured in AD. Also, I've
> assigned the correct branch AD to the proper AD site and
> subnet.
>
> Thanks for your response :)

> >-----Original Message-----
> >I take it you have set up sites in AD?
> >
> >
> >"Edward" <anonymous@discussions.microsoft.com> wrote in

> message

> >news:2158c01c45ab2$8fe059e0$a101280a@phx.gbl...

> >> Here's my environment:
> >> 1. Dfs is AD published
> >> 2. 2 AD DC in corporate LAN
> >> 3. Branch offices have a DC that's been GC enabled
> >> 4. Users get assigned a GPO on logon. Login script is
> >> defined on user's GPO.
> >>
> >> Users, at branch offices, log on just fine as quiet

> fast -

> >> as long as the link to corporate is up (WAN

> environmet).

> >> If I cut the WAN link, and restart a user's computer -

> it

> >> takes a long time before they get to the CTRL-ALT-DEL
> >> screen. They can log on, but the logon script doesn't
> >> execute for some unknown reason. Yes, the DCs are
> >> synchronizing; I've checked the SYSVOL and it's
> >> synchronized. It appears also that their GPO doesn't

> kick

> >> in either.
> >> They are being authenticated by their local DC as
> >> LOGONSERVER= their local DC.
> >>
> >> Any ideas would be greatly appreciated.

> >
> >
> >.
> >

[Edward]

I found the problem; I messed up and forgot to create a
new root Dfs target to point to this new DC, duh! :)
Login script runs fine and all Dfs links come up just as
fine.

Now, the issue is...for some reason the login does take
19 seconds longer for my branch users if I unplug the WAN
link. I was expecting the login part to be just as fast,
since I have a DC and all at the branch office.

>-----Original Message-----
>Strange that a login script runs when the wan is

connected but not when

>disconnected given you have a local dc in the site and

the clients you are

>running must obviously be 2000 or xp desktops as you

cant assign scripts via

>gpo to earlier OSs ie 9x.
>
>I also experience slightly longer logons if the wan link

is down but

>everything else works as expected.
>
>As you mention dfs, I presume the login scripts are

mapping the users drive

>to a share on dfs? If so, that adds another layer to

troubleshoot.

>
>You'll probably have to troubleshoot in stages, firstly

checking that the

>branch office DC is set up correctly. Running dcdiag

and netdiag from the

>support tools is a good start. Also using the repladmin

command line tool

>to check the time of last replication and success status

or not of the

>various AD partitions that get replicated around.
>
>If you're satisfied everything is ok, then you'll have

to move onto the

>clients. If xp, run rsop.msc to confirm that the gpos

you configured are

>reaching the client. \
>
>then dfs, try to map to the dfs share in your domain by
>\\domainname\dfssharename\etc and see if you can access

the resources whilst

>the wan link is down.
>
>Good luck
>
>
>"Edward" <anonymous@discussions.microsoft.com> wrote in

message

>news:217ba01c45abe$484bf4c0$a401280a@phx.gbl...

>> Yes, Sites and subnets are configured in AD. Also, I've
>> assigned the correct branch AD to the proper AD site

and

>> subnet.
>>
>> Thanks for your response :)

>> >-----Original Message-----
>> >I take it you have set up sites in AD?
>> >
>> >
>> >"Edward" <anonymous@discussions.microsoft.com> wrote

in

>> message

>> >news:2158c01c45ab2$8fe059e0$a101280a@phx.gbl...
>> >> Here's my environment:
>> >> 1. Dfs is AD published
>> >> 2. 2 AD DC in corporate LAN
>> >> 3. Branch offices have a DC that's been GC enabled
>> >> 4. Users get assigned a GPO on logon. Login script

is

>> >> defined on user's GPO.
>> >>
>> >> Users, at branch offices, log on just fine as quiet

>> fast -

>> >> as long as the link to corporate is up (WAN

>> environmet).

>> >> If I cut the WAN link, and restart a user's

computer -

>> it

>> >> takes a long time before they get to the CTRL-ALT-

DEL

>> >> screen. They can log on, but the logon script

doesn't

>> >> execute for some unknown reason. Yes, the DCs are
>> >> synchronizing; I've checked the SYSVOL and it's
>> >> synchronized. It appears also that their GPO doesn't

>> kick

>> >> in either.
>> >> They are being authenticated by their local DC as
>> >> LOGONSERVER= their local DC.
>> >>
>> >> Any ideas would be greatly appreciated.
>> >
>> >
>> >.
>> >

>
>
>.
>