Windows server 2008 r2 applying computer settings

First published on TECHNET on Oct 14, 2008

Perhaps one of the most frustrating issues to troubleshoot is a system that sits at the “Applying Computer Settings …” screen for what seems like forever before (eventually) getting to the point that you can log in.  Interestingly, although several of these cases are routed to the Performance team as a perceived system hang, the fact of the matter is that the system really isn’t hung at all.  In the overwhelming majority of the cases, the system is trying to complete an operation and is waiting for a response.  With that having been said, the unfortunate reality is that there are literally hundreds of possible causes – but today, we’re going to go over a couple of them, and show you some quick troubleshooting shortcuts.  So without further ado …

Before we get too deep into what’s going on with “Applying Computer Settings”, let’s take a quick look at the boot sequence for a client machine joined to an Active Directory domain that receives a dynamic IP Address:

1. User powers on the machine which goes through a POST (Power-On Self-Test) sequence.  The POST sequence displays information about the BIOS, and the amount of physical memory installed.  The system will also attempt t initialize PCI cards.  Once the POST sequence has completed, you will normally see a basic table outlining the system configuration including disk information, and PCI card information.
2. The system goes through the process of acquiring a DHCP address, normally referred to as DORA:
   

   • DHCP (D)iscover
   • DHCP (O)ffer
   • DHCP (R)equest
   • DCHP (A)cknowledge

   If the system is able to successfully acquire an IP Address, then various networking configuration settings are populated, such as Default Gateway, DNS Servers, WINS servers and so on. If the system is not able to acquire an IP Address, then the system will time out / fail trying to process various networking functions — including the application of group policies and even possibly logging on to the client machine.

3. Assuming that the system received an IP address from the DHCP server, the DHCP Client service will try to register its IP Address with the DNS Server
4. The system attempts to query DNS for a SRV record for a Domain Controller.  If the system locates a domain controller it then begins the process of applying system-level domain and group policies.  If no DC can be located, then we are in another timeout situation where group policies will fail to apply.
5. Once the computer settings are applied, the user logon prompt is displayed and the user enters their credentials
6. If the system was able to contact a domain controller, then the logon is authenticated and user policies are applied.  If the system was not able to contact a domain controller, the system may log the user in with cached credentials.  Since no domain controller could be located, user GPO’s will not be applied.

Now, that’s the high level overview of the startup process.  So where does the “Applying Computer Settings” piece come into play?  Where you’re most likely to experience that issue is between steps 4 and 5.  The system has located a Domain Controller, and is querying it for a list of group policies that should be applied.

Now that we know where the problem is occurring in our process, how can we best troubleshoot it?  There are a couple of different approaches to take.  Believe it or not, one of the quickest ways to isolate if the problem is occurring locally or caused by something requiring network resources is simply to unplug the network cable.  By “breaking” the network connection, the network requests should time out nearly instantaneously and the logon process should continue.  You could also use the MSCONFIG.EXE utility to temporarily prevent non-Microsoft services from starting up the next time the system boots.  To do this, launch the System Configuration Utility, and on the Services tab, hide all non-Microsoft Services, and then select “Disable All”.  When you reboot the system, if the problem does not recur, then you now have a much smaller list of potential culprits to troubleshoot.

The majority of instances that we tend to run into however, revolve around group policy processing.  We wrote a couple of posts last year on Group Policies (see the links below), but the best way to really troubleshoot a problem like this is to enable USERENV logging and then review the log file.  Each of the entries in the log file has a timestamp, so you will be able to tell if there are any processing delays or issues locating a specific Group Policy etc.  Our Directory Services support team has plenty of experience looking at USERENV logs and troubleshooting issues where systems are stuck at “Applying Computer Settings”, so if you run into one of these situations that you just can’t quite seem to isolate – give us (well, the Directory Services guys) a call so we can help you get it resolved!

With that, another post comes to an end.  Until next time …

Additional Resources:

• Microsoft KB 2379016 A computer that is running Windows Vista or Windows Server 2008 stops res…

• Microsoft KB247811: How Domain Controllers are Located in Windows

• Microsoft KB 221833: How to enable user environment debug logging in retail builds of Windows
  …

• Ask the Performance Team: The Basics of Group Policies

• Ask the Performance Team: GP Logging on Windows Vista

—

CC Hameed

Share this post :

Skip to content

We have a Windows Server 2008 R2 Standard server that is hanging for over 45 minutes at the Applying Computer Settings screen. If I remove the NIC, it boots up to the «Press CTRL+ALT+DELETE to log on» screen relatively quick. Safe Mode with and without Networking boots up quickly.

I looked through the event logs and it seems like the «SERVER» service is hanging, though I am able to start/restart it properly after getting logged in. Event Error 7001: The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

This is a virtual server running on ESXi 5.0 so removing/re-adding the nic is simple. If I boot the server without the NIC and login, I can easily add the NIC and everything seems to work properly.

I don’t know if this is a problem with the NIC or the Services. I ran an SFC /SCANNOW both in the active session and also booting to the repair cd using offline mode. No issues were found and it hasn’t helped.

Don’t know what step to take next. Any suggestions? Thank you!

~Jake

Problem Description

Windows 2008 R2 vCenter stuck on applying computer settings.

Event logs shows the following errors:

Event 4, Security Kerberos, The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc01-ad01$. The target name used was GC/DC01-AD01.gascompany.com/gascompany.com. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (GASCOMPANY.COM) is different from the client domain (GASCOMPANY.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

Event 7038, Service Control Manager, The vpxd service was unable to log on as GASCOMPANYService.vCenter with the currently configured password due to the following error:
The trust relationship between this workstation and the primary domain failed.

Event 7000, Service Control Manager, The VMware VirtualCenter Server service failed to start due to the following error:
The service did not start due to a logon failure.

Resolution

The key is Event 7038, the trust relationship between this workstation and the primary domain failed.  To resolve the issue perform the following steps:

• Power off vCenter and edit settings to disconnect the Network Adapter.  By doing this, you will be able to get to the login screen.

• Login to vCenter using Local Credentials (in my case this was DC01-VCT01Administrator).  Re-enable Network Adapter and perform a ping using DNS to another server to confirm that the TCP/IP network stack is functioning

Now that we are in the server, it is time to resolve the actual issue, being the trust relationship with the primary domain.

• Run CMD as Administrator
• Type netdom resetpwd /Server:DomainControllerName /UserD:DomainAdministrator /PasswordD:*

You will be prompted to enter your password.  If all details are correct, you will be prompted to say machine account has been reset.

• Reboot your vCenter

When you login you will now see the prompt to state ‘the trust relationship between this workstation and the primary domain failed’

• Select > Switch User and login using Local Credentials
• Remove vCenter from the domain and join to a Workgroup
• Remove the vCenter Computer Object from Active Directory
• Reboot vCenter
• Join the domain