.png)
Understand the Effect of Fast Logon Optimization and Fast Startup on Group Policy
Published: August 1, 2012
Updated: August 1, 2012
Applies To: Windows 7, Windows 8, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Vista, Windows XP
This troubleshooting topic explains the interaction between the required synchronous processing for certain Group Policy client-side extensions (CSEs) and Fast Logon Optimization, which was introduced in Windows XP. Fast Logon Optimization may cause you to sign in (log on for Windows 7 or earlier computers) or restart the computer multiple times before certain Group Policy settings are actually applied to the client computer. This topic also discusses the affect that the fast startup feature introduced in Windows 8 will have on Group Policy settings that are applied during startup or shutdown.
This topic applies to client computers that are running Windows 8, Windows 7, Windows Vista, or Windows XP.
Policy settings are grouped into categories, such as Administrative Templates, Security Settings, Folder Redirection, Disk Quota, Software Installation, and the Group Policy preference extensions. The settings in each category require a specific CSE to process them, and each CSE has its own rules for processing settings. For this discussion, it’s important to understand that Group Policy preference extensions represent a set of client-side extensions, not a single CSE. Each Group Policy preference extension has rules to process settings.
In the general definition, asynchronous processing refers to processes that do not depend on each other’s outcome. Therefore, they can occur on different threads simultaneously.
The opposite is synchronous. Synchronous processing refers to processes that depend on each other’s outcome. Therefore, synchronous processes must wait for the previous process to finish before the next process can start.
Asynchronous processing at startup and sign-in affects Group Policy in the following ways:
-
At startup, asynchronous processing means that the client computer does not wait for the network to be fully initialized before sign-in is available to the user. Group Policy for the client computer will process when the network becomes available in parallel to startup and sign-in activities.
-
At sign-in, asynchronous processing means that a user does not have to wait for Group Policy to finish processing before signing-in.
For some CSEs, for example, Folder Redirection, Software Installation, and Drive Maps preference extension the outcome of the Group Policy processing might adversely affect the user’s experience, for example, programs being uninstalled while the user is working with them. To keep this from happening, the CSE is designed to require synchronous processing to apply the new settings. In this case, during asynchronous processing, the CSE signals the system to set a flag that indicates synchronous application of Group Policy is required. Synchronous application of Group Policy will happen at the next startup, if it is signaled during the computer Group Policy refresh; or at the user’s next sign-in, if it is signaled during the user Group Policy refresh.
Group Policy foreground processing applies when the computer starts up or shuts down and when the user signs in or signs out. During foreground processing, policy settings are applied either asynchronously or synchronously.
Group Policy background processing applies during periodic refreshes after the computer has started or a user has signed in. All requested Group Policy refreshes that are performed by using Gpupdate.exe also run as background processing. During background processing, policy settings are only applied asynchronously.
When Group Policy processes on a Windows-based computer, client-side extensions interpret the stored policy settings and make the appropriate changes to the environment. When troubleshooting a given client-side extension’s application of Group Policy, the administrator can view the configuration parameters for that extension that affect the extension’s operation. These parameters are in the form of registry values.
 Important |
|---|
| This section provides an overview about the information that is stored in the registry. This is for informational purposes, and it is not recommending that you adjust the CSE processing properties by using the registry. Serious problems might occur if you modify the registry incorrectly. If you do make any changes to the registry, it is recommended that you back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see article 322756 in the Microsoft Knowledge Base. |
Each client-side extension is identified by a subkey under the following path: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions The subkey name takes the form of a Globally Unique Identifier (GUID). For more information about identifying registered Group Policy client-side extensions, see article 216357 in the Microsoft Knowledge Base.
The NoBackgroundPolicy registry key determines if a CSE is called during Group Policy background policy processing. If this value is set to 1, the CSE will not be called during background processing. A CSE that requires synchronous processing can still be called during background processing. However, because background processing is always performed in asynchronous mode, a CSE requiring synchronous processing will exit after signaling a request for the next sign-in (log on for Windows 7 or earlier) to be run in synchronous mode.
Each CSE determines if it requires synchronous processing to apply changes to the policy settings.
The following table provides information about the synchronous processing requirements and the default background processing behavior of CSEs in Group Policy for Windows Server 2012.
| CSE name | Requires synchronous processing | Called during background processing |
|---|---|---|
|
Disk Quota |
No |
Yes |
|
EFS Recovery |
No |
Yes |
|
Folder Redirection |
Yes |
Yes |
|
Internet Explorer Maintenance |
No |
Yes |
|
IP security |
No |
Yes |
|
Registry |
No |
Yes |
|
Scripts |
|
Yes, but scripts are only run in foreground processing |
|
Security |
No |
Yes |
|
Software Installation |
Yes |
Yes |
|
Wired Networking |
No |
Yes |
|
Wireless Networking |
No |
Yes |
|
Applications preference extension |
No |
Yes |
|
Data Sources preference extension |
No |
Yes |
|
Devices preference extension |
No |
Yes |
|
Drive Maps preference extension |
Yes |
No |
|
Environment preference extension |
No |
Yes |
|
Files preference extension |
No |
Yes |
|
Folder Options preference extension |
No |
Yes |
|
Folders preference extension |
No |
Yes |
|
Ini Files preference extension |
No |
Yes |
|
Internet Settings preference extension |
No |
Yes |
|
Local Users and Groups preference extension |
No |
Yes |
|
Network Options preference extension |
No |
Yes |
|
Network Shares preference extension |
No |
Yes |
|
Power Options preference extension |
No |
Yes |
|
Printers preference extension |
No |
Yes |
|
Regional Options preference extension |
No |
Yes |
|
Registry preference extension |
No |
Yes |
|
Scheduled Tasks preference extension |
No |
Yes |
|
Services preference extension |
No |
Yes |
|
Shortcuts preference extension |
No |
Yes |
|
Start Menu preference extension |
No |
Yes |
Although a client-side extension’s requirement to run in synchronous mode is not configurable, other default behavior for each CSE can be configured through policy settings. To configure the properties that are associated with a CSE, apply the Administrative Templates computer configuration policy settings that are created for this purpose. The following table provides the names of the policy settings and the CSE properties that can be modified. If the CSE property is checked, it can be modified for the specific CSE.
| Policy Setting Name | Allows processing across a slow network connection | Do not apply during periodic background processing | Process even if the Group Policy Objects have not changed | Background processing priority |
|---|---|---|---|---|
|
Configure disk quota policy processing |
X |
X |
X |
|
|
Configure EFS recovery policy processing |
X |
X |
X |
|
|
Configure Folder Redirection policy processing |
X |
|
X |
|
|
Configure Internet Explorer Maintenance policy processing |
X |
X |
X |
|
|
Configure IP security policy processing |
X |
X |
X |
|
|
Configure Registry policy processing |
|
X |
X |
|
|
Configure Scripts policy processing |
X |
X |
X |
|
|
Configure Security policy processing |
|
X |
X |
|
|
Configure Software Installation policy processing |
X |
|
X |
|
|
Configure Wired Networking policy processing |
X |
X |
X |
|
|
Configure Wireless Networking policy processing |
X |
X |
X |
|
|
Configure Applications preference extension policy processing |
X |
X |
X |
X |
|
Configure Data Sources preference extension policy processing |
X |
X |
X |
X |
|
Configure Devices preference extension policy processing |
X |
X |
X |
X |
|
Configure Drive Maps preference extension policy processing |
X |
|
X |
X |
|
Configure Environment preference extension policy processing |
X |
X |
X |
X |
|
Configure Files preference extension policy processing |
X |
X |
X |
X |
|
Configure Folder Options preference extension policy processing |
X |
X |
X |
X |
|
Configure Folders preference extension policy processing |
X |
X |
X |
X |
|
Configure Ini Files preference extension policy processing |
X |
X |
X |
X |
|
Configure Internet Settings preference extension policy processing |
X |
X |
X |
X |
|
Configure Local Users and Groups preference extension policy processing |
X |
X |
X |
X |
|
Configure Network Options preference extension policy processing |
X |
X |
X |
X |
|
Configure Network Shares preference extension policy processing |
X |
X |
X |
X |
|
Configure Power Options preference extension policy processing |
X |
X |
X |
X |
|
Configure Printers preference extension policy processing |
X |
X |
X |
X |
|
Configure Regional Options preference extension policy processing |
X |
X |
X |
X |
|
Configure Registry preference extension policy processing |
X |
X |
X |
X |
|
Configure Scheduled Tasks preference extension policy processing |
X |
X |
X |
X |
|
Configure Services preference extension policy processing |
X |
X |
X |
X |
|
Configure Shortcuts preference extension policy processing |
X |
X |
X |
X |
|
Configure Start Menu preference extension policy processing |
X |
X |
X |
X |
By default in Windows 8, Windows 7, Windows Vista, and Windows XP, the Fast Logon Optimization feature is set for domain and workgroup members. Policy settings apply asynchronously when the computer starts and when the user signs in. As a result, Windows 8, Windows 7, Windows Vista, and Windows XP do not wait for the network to be fully initialized at startup and sign-in. Existing users are signed in by using cached credentials. This results in shorter sign-in times. Group Policy is applied after the network becomes available.
Fast Logon Optimization is always off during sign-in under the following conditions:
-
When a user first signs in to a computer.
-
When a user has a roaming user profile or a home directory for sign-in purposes.
-
When a user has synchronous sign-in scripts.
|
Note |
|---|
| Under the preceding conditions, computer startup can still be asynchronous. However, because sign-in is synchronous under these conditions, sign-in does not exhibit optimization. |
With Fast Logon Optimization, enabled Group Policy foreground processing is run asynchronously. When a CSE requires synchronous processing:
-
Policy settings will not apply during the asynchronous processing cycle.
-
The CSE that requires synchronous policy application may still be called during asynchronous policy application. Instead of applying policy settings, the CSE will signal for synchronous processing to be applied at the next startup or sign-in.
When synchronous policy application is required and Fast Logon Optimization is enabled, it may take up to two reboots or two sign-ins for the policy settings to apply. This is demonstrated in the following examples.
-
Example 1: Fast Logon Optimization with synchronous processing when the user is not signed in. A user is not signed in to the client computer when a change is made to user policy settings, and synchronous processing is not requested. In this case, the policy settings are applied after two sign-ins.
-
Example 2: Fast Logon Optimization with synchronous processing when the user is signed in. A user is signed in to the client computer when a change is made to user policy settings, and the user stays signed in to the computer so that background processing takes place prior to sign-out. In this case, the policy settings are applied after one sign-in.
|
Note |
|---|
| These examples assume that only policy settings for a single CSE that requires synchronous processing have changed. When you troubleshoot Group Policy, consider that there may be interactions with multiple CSEs. You may find that the expected behavior for a single CSE varies when combined with the processing requirements of other CSEs. For more specific examples, see the Group Policy topics in Wiki: Group Policy Troubleshooting Portal. |
Example 1: Fast Logon Optimization with synchronous processing when the user is not signed in
In this example, the user is not signed in to the computer when there is a change to the user policy setting for a CSE that requires synchronous processing. At this point, synchronous processing was not requested when the user policy setting was last processed. In this example, it takes two sign-ins for the CSE to apply the policy settings.
When the user signs in, Fast Logon Optimization is in effect and Group Policy processes asynchronously. The Group Policy engine determines that there is a change to the policy settings for the CSE, and the Group Policy engine calls that CSE.
The CSE determines that it requires synchronous processing to apply the new settings. With the current processing session in asynchronous mode, the CSE exits without applying the policy settings, and the CSE signals to the Group Policy engine that synchronous processing is needed for the next sign-in.
At the next (second) sign-in, Group Policy processes synchronously. The Group Policy engine determines that the CSE did not complete processing of the policy settings during the last sign-in session. The Group Policy engine calls the CSE. The CSE determines that Group Policy is processing synchronously, and the CSE applies the policy settings.
Example 2: Fast Logon Optimization with synchronous processing when the user is signed in
In this example, the user is already signed in to the computer when there is a change to the user policy setting for a CSE that requires synchronous processing. The user stays signed-in to the computer until Group Policy background processing occurs. This example shows that the CSE applies the policy settings after a single sign-in.
When the user stays signed in to a client computer, by default, background processing occurs approximately every ninety minutes. Background processing is always run asynchronously. During this background processing, the Group Policy engine determines that there is a change to the policy settings for a CSE. The Group Policy engine calls that CSE.
The CSE determines that it requires synchronous processing to apply the new settings. With the background processing session in asynchronous mode, the CSE exits without applying the policy settings. The CSE signals to the Group Policy engine that synchronous processing is needed for the next sign-in. During subsequent background refreshes, the CSE is called, but it exits without applying the policy settings because it still requires synchronous processing.
At the next sign-in, Group Policy processes synchronously. The Group Policy engine determines that the CSE did not complete processing during the last sign-in session. The Group Policy engine calls the CSE. The CSE determines that Group Policy is processing synchronously, and the CSE applies the policy settings with a single sign-in.
A CSE can require both synchronous processing and foreground processing to apply settings. The foreground processing requirement is set when the NoBackgroundPolicy registry key is set to a value of 1. In this case, the CSE applies the policy settings with two sign-ins.
For example, the user is already signed in to the computer when there is a change to a user policy setting that requires synchronous processing and can only be applied during foreground processing. The user stays signed-in to the client computer until Group Policy background processing occurs (by default, approximately every ninety minutes). During background processing, the Group Policy engine determines there is a change to the policy settings for a CSE, but the NoBackgroundPolicy registry key is set to 1, and the Group Policy engine does not call this CSE during background processing. Additionally, during subsequent background refreshes, the Group Policy engine does not call the CSE.
At the next sign-in, Group Policy processes asynchronously because Fast Logon Optimization is in effect. This is foreground processing, so the Group Policy engine calls the CSE, which was set to only process in the foreground.
The CSE determines that it requires synchronous processing to apply the new policy settings. With the current processing session in asynchronous mode, the CSE exits without applying the policy settings. The CSE signals to the Group Policy engine that synchronous processing is needed for the next sign-in.
At the next sign-in, Group Policy processes synchronously. The Group Policy engine determines that the CSE did not complete processing of the policy settings during the last sign-in session. The Group Policy engine calls the CSE. The CSE determines that Group Policy is processing synchronously and applies the policy settings. In this case, it takes two sign-ins for the CSE to apply the settings.
|
Note |
|---|
| This example assumes that only policy settings for a single CSE that requires synchronous processing and foreground processing, have changed. When you troubleshoot Group Policy, consider that there may be interactions with multiple CSEs, and you may find that the expected behavior for a single CSE varies when combined with the processing requirements of other CSEs. For more specific examples, see the Group Policy topics in Wiki: Group Policy Troubleshooting Portal. |
Group Policy settings or scripts that are applied during startup or shutdown might not be applied on computers that are running Windows 8 because, by default, these computers are not fully shut down by the Shut down command. Instead, the computer enters a hibernate state. Full shutdown only occurs when the system is set to reboot or when a pending software update or other event causes the computer to process a full shutdown. You can use the Restart Computer command in Windows 8 to achieve startup or shutdown on client computers.
If you do not want fast startup to apply to the computers in your enterprise, you can apply to those computers a GPO that disables the Computer Configuration/Policies/Administrative Templates/System/Shutdown/Require use of fast startup policy setting. Be aware that disabling this policy setting results in full shutdowns of client computers, and longer startup times. The enabled state of the Require use of fast startup policy setting does not take precedence over any Group Policy setting that disables hibernation.
