Active Directory 2003 SlowDown

[cainecabe]

We recently migrated to a Active Directory 2003 infrastructure. The majority of our users are converted along with their machines and we still have to migrate our servers (next project). The issue is that a large number of our users are complaining their machines are incredibly slow, at times. The machines just slow down all the sudden, not always at the same times, but often enough to know somehting is doing something to them. The application logs show event 1202 SceCli messages, but they point to securities between sid and mappings and such. Has anyone noticed this? If i put some users into OU's with no policies, they dont mention the problem anymore, so i get the feeling its a policy.

Any ideas?

Thanks,

 

[ShackDaddy]

Is SMS part of your AD rollout?

 

[cainecabe]

SMS 2003 was upgraded from SMS 2.0 prior to our rollout and still resides in the legacy domain which will be active until all servers are migrated out. but if your question is in regards to how often if runs its discoveries, we set it to once a day at 10:00pm. Is there a link between the two possibly ?

Thanks,

 

[cainecabe]

I came across KB837166 and it sounds like it may well be what our problem is. But it doesn't say anything about the client pcs drastically slowing down while it attempts to load the Group Policies. Has anyone experienced, or heard of this ?

Thanks,

 

[ShackDaddy]

Group Policy implementation uses a 'refresh interval' or an interval during which group policies are pushed to the clients. It may be that your clients are slowing down when they are trying to apply an invalid policy at each refresh interval. The refresh interval is 90 minutes, plus a random number of minutes between 0 and 30.

To see if it's the refresh interval slowing down a particular system, you can turn off background refresh using the following registry hack:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system - add a DWORD entry called DisableBkGndGroupPolicy and set the value to 1.

If I were you, I'd rebuild your group policies from scratch on the new domain, using the best tools at your disposal.

I recommend the book Group Policy, Profiles, and IntelliMirror for Windows 2003, Windows XP, and Windows 2000 by Jeremy Moskowitz.

ShackDaddy

 

[cainecabe]

I'm trying it now on a few machines.. thank a million. If you don't mind me asking, how'd you find out about adding the dword value ?

Thanks,

 

[cainecabe]

What the articles talk about is this effecting W2Kpro clients that can't understand XP info. We see XP clients also having this same problem. Can it be possible that XP machines GP's can be affected as well by errors within the policies?

Thanks,

 

[ShackDaddy]

Yes. The registry hack I gave you works on both.

I was the tech-editor for the book that I mentioned, and I remembered that factoid from the book and looked it up.

ShackDaddy