Currently, my Windows 10 install (Pro edition, build 10586.29) is experiencing a problem with extremely slow logins (up to three minutes on the "black screen of death" -- cursor is visible, but absolutely nothing actually happens) after entering my login password. Additionally, the Windows Shell can take upwards of five minutes to load (items to display on my taskbar, shortcut icons to load, etc).

I've attempted to attach a debugger (through procmon) to my boot process, but I have yet been unable to find anything out of the ordinary, with the exception of about a three minute gap between two registry lookups:


All of this happens before atbroker and UserInit start (I think).

During this gap, many processes (Specifically NVIDIA and ELAN) launch, but none seem to contribute to a hang.

I have no idea about how to debug this, what's causing it, and (most importantly), how to fix it. Can someone please help me out?

Winlogon's process tree:


Edit: I've noticed that this only happens when I first boot my computer. Any subsequent logons/logoffs work perfectly normally.

Edit 2: Upon doing a bit of log debugging, I noticed something in my boot logs:

This application took longer than usual to start up, resulting in a performance degradation in the system startup process: 
     File Name          :   MsMpEng.exe
     Friendly Name      :   Antimalware Service Executable
     Version            :   4.9.10586.0 (th2_release.151029-1700)
     Total Time         :   48205ms
     Degradation Time   :   45705ms
     Incident Time (UTC):   ‎2015‎-‎12‎-‎13T05:50:13.777810900Z

This suggests something is wrong with Windows Defender (again). Now what?

Edit 3: Also, I'm using Razer Synapse because of my keyboard and mouse, and quite a few different people confirm that it actually does slow boot. Can that be remedied somehow (preferably without uninstalling Synapse)?

  • Have you run Windows Performance Toolkit's boot profiler? – oldmud0 Dec 12 '15 at 2:07
  • @oldmud0 Is there any guide for using the boot profiler? – Kaz Wolfe Dec 12 '15 at 22:10

You should use xperf to troubleshoot slow logons.

  1. install the WPT
  2. logon to an admin account
  3. open a cmd.exe and run this command:

xperf -on base+latency+dispatcher+NetworkTrace+Registry+FileIO -stackWalk CSwitch+ReadyThread+ThreadCreate+Profile -BufferSize 1024 -start UserTrace -on "Microsoft-Windows-Shell-Core+Microsoft-Windows-Wininit+Microsoft-Windows-Folder Redirection+Microsoft-Windows-User Profiles Service+Microsoft-Windows-GroupPolicy+Microsoft-Windows-Winlogon+Microsoft-Windows-Security-Kerberos+Microsoft-Windows-User Profiles General+e5ba83f6-07d0-46b1-8bc7-7e669a1d31dc+63b530f8-29c9-4880-a5b4-b8179096e7b8+2f07e2ee-15db-40f1-90ef-9d7ba282188a" -BufferSize 1024 -MinBuffers 64 -MaxBuffers 128 -MaxFile 1024

  1. Press CTRL+ALT+DEL and then Switch User.
  2. Logon with the user account experiencing the slow user logon to reproduce the issue.
  3. in the slow account, open a elevated/admin command prompt and run this:

xperf -stop -stop UserTrace -d merged.etl

  1. open the merged.etl in WPA.exe, look in the Generic Events for events with matching Start/Stop Opcodes and look which Event has a long duration.

If you need help, compress the merged.etl as 7z/RAR (to reduce the size) and share it (oneDrive, dropbox, google drive).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.