User Logon Details Test

The process of a user logging into a VMware Horizon View RDS server is fairly complex. First, the domain controller is discovered and the login credentials are authenticated. Then, the corresponding user profile is identified and loaded. Next, group policies are applied and logon scripts are processed to setup the user environment. In the meantime, additional processing may take place for a user – say, applying system profiles, creating new printers for the user, and so on. A slowdown in any of these steps can significantly delay the logon process for a user. Since logons on Windows happen sequentially, this may adversely impact the logins for other users who may be trying to access the VMware Horizon View RDS server at the same time. Hence, if a user complains that he/she is unable to access an application/desktop published on Citrix, administrators must be able to rapidly isolate exactly where the logon process is stalling and for which user.

This test periodically monitors the user login and profile loading process and accurately identify where the process is bottlenecked. This test helps administrators to capture anomalies in the user login and profile loading process and report where the process is bottlenecked - in the authentication process? during profile loading? during GPO processing and if so, which GPO?

By default, this test is disabled by default. To enable the test, go to the enable / disable tests page using the menu sequence : Agents -> Tests -> Enable/Disable, pick the VMware Horizon View RDS as the desired Component type, set Performance as the Test type, choose the test from the disabled tests list, and click on the < button to move the test to the ENABLED TESTS list. Finally, click the Update button.

Target of the test : A VMware Horizon View RDS server

Agent deploying the test : An internal agent

Outputs of the test : One set of results for every user to the VMware Horizon View RDS server monitored.

Configurable parameters for the test
Parameters Description

Test period

This indicates how often should the test be executed.

Host

The host for which the test is to be configured.

Port

Refers to the port at which the host listens.

Report Total

By default, this  flag is set to No. In this case therefore, the test will only report metrics for every user to the target server. If this flag is set to Yes, then the test will report metrics for a Total descriptor - the metrics reported by this descriptor will be aggregated across all users to the target server. This way, the administrators will receive a system-wide overview of the health of the profile loading/unloading process.

DD Frequency

Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against dd frequency.

Detailed Diagnosis

To make diagnosis more efficient and accurate, the eG Enterprise suite embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option.

The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

  • The eG manager license should allow the detailed diagnosis capability
  • Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.
Measurements made by the test
Measurement Description Measurement Unit Interpretation

Logon duration

Indicates the average time taken by this user for logging in during the last measurement period.

Secs

If this value is abnormally high for any user, then, you can compare the User account discovery, LDAP bind time to active directory, Client side extension processed time, DC discovery time, Total group policy object file accessed time and User profile duration measures to know exactly where that user's login process experienced a bottleneck - is it when loading the profile? is it when processing system policies? is it when processing group policies? is it when interacting with AD for authenticating the user login?

Network providers duration

Indicates the amount of time taken by the network provider to authenticate this user on their network.

Secs

A Network Provider is a DLL which is responsible for a certain type of connection protocol. On each logon, Winlogon notifies these Network Providers so that they can collect credentials and authenticate the users on their network. Citrix PnSson is a common network provider found on XenApp and XenDesktop VM's.

If the value of this measure is 0 for a unusually longer duration, then administrators should verify if the pre-requisites are fulfilled. Once the pre-requisites are fulfilled, this measure will report the values using which administrators can accurately identify where exactly has the logon process stalled.

Citrix profile management duration

Indicates the amount of time taken to load the Citrix profile of this user successfully during the last measurement period.

Secs

During logon, Citrix UPM copies the users' registry entries and files from the user store to the local profile folder. If a local profile cache exists, the two sets are synchronized.

User profile duration

Indicates the amount of time it took to load this user's profile successfully in the last measurement period.

Secs

Compare the value of this measure across users to know which user's profile took the longest time to load. One of the common reasons for long profile load times is large profile size. In such circumstances, you can use the User Profile test to determine the current size of this user's profile. If the profile size is found to be large, you can conclude that it is indeed the size of the profile which is affecting the profile load time.

Another reason would be the absence of a profile. If the user does not already have a profile a new one is created. This slows down the initial logon quite a bit compared to subsequent logons. The main reason is that Active Setup runs the IE/Mail/Theme initialization routines.

Moreover, this measure reports the average time taken for loading a user’s profile across all the sessions of that user. To know the profile load time per user session, use the detailed diagnosis of this measure. This will accurately pinpoint the session in which the profile took the longest to load.

Group policy time

Indicates the time taken for applying group policies for this user in the last measurement period.

Secs

This measure enforces the domain policy and settings for the user session and in case of synchronous processing, the user will not see their desktop at logon until user GP processing completes.

If the value of this measure is 0 for a unusually longer duration, then administrators should verify if the pre-requisites are fulfilled. Once the pre-requisites are fulfilled, this measure will report the values using which administrators can accurately identify where exactly has the logon process stalled.

GP scripts duration

Indicates the time taken for executing group policy scripts for this user in the last measurement period.

Secs

The output of the script will showow if the Group policy scripts were executed in synchronous mode or asynchronous mode. When running the logon scripts configured in the relevant GPO's, in a case of synchronous logon scripts, Windows Explorer does not start until the logon scripts have finished running.

If the value of this measure is 0 for a unusually longer duration, then administrators should verify if the pre-requisites are fulfilled. Once the pre-requisites are fulfilled, this measure will report the values using which administrators can accurately identify where exactly has the logon process stalled.

Pre-Shell duration

Indicates the time taken to execute Userinit.exe for this user during the last measurement period.

Secs

The Winlogon service runs Userinit.exe, which runs logon scripts, reestablishes network connections, and then starts Explorer.exe, the Windows user interface. On RDSH sessions, Userinit.exe also executes the Appsetup entries such as cmstart.exe which in-turn calls wfshell.exe.

A low value is desired for this measure. A sudden/gradual increase in the value of this measure is a cause of concern.

If the value of this measure is 0 for a unusually longer duration, then administrators should verify if the pre-requisites are fulfilled. Once the pre-requisites are fulfilled, this measure will report the values using which administrators can accurately identify where exactly has the logon process stalled.

Shell duration

Indicates the time interval between the beginning of desktop initialization and the time the desktop became available to this user including the Active Setup Phase during the last measurement period.

Secs

A low value is desired for this measure.

If the value of this measure is 0 for a unusually longer duration, then administrators should verify if the pre-requisites are fulfilled. Once the pre-requisites are fulfilled, this measure will report the values using which administrators can accurately identify where exactly has the logon process stalled.

Group policy

Indicates the current status of the Group policy that is applied for this user.

 

The values reported by this measure and their corresponding numeric equivalents are described in the table below:

Measure Values Numeric Values
Success 1
Warning 2
Error 3

Note:

By default, this measure reports the above-mentioned Measure Values while indicating the current status of the Group policy. However, in the graph of this measure, the values will be represented using the corresponding numeric equivalents i.e., 1 to 3.

User account discovery

Indicates the amount of time taken by the LDAP call for this user to connect and bind to Active Directory during the last measurement period.

Secs

Compare the value of this measure across users to know which user’s logon process spent maximum time in retrieving account information.

LDAP bind time to active directory

Indicates the amount of time taken by the LDAP call for this user to connect and bind to Active Directory during the last measurement period.

Secs

Compare the value of this measure across users to know which user’s logon process spent maximum time in connecting to Active Directory. Besides impacting authentication time, high LDAP bind time may also affect group policy processing.

DC discovery time

Indicates the time taken to discover the domain controller to be used for processing group policies for this user during the last measurement period.

Secs

Compare the value of this measure across users to know which user’s logon process spent maximum time in domain controller discovery.

Total group policy object file accessed time

Indicates the amount of time the logon process took to access group policy object files for this user during the last measurement period.

Secs

Compare the value of this measure across users to know which user’s logon process spent maximum time in accessing the group policy object file.

To know which files were accessed and the time taken to access each file, use the detailed diagnosis of this measure. With the help of the detailed diagnostics, you can identify the Group Policy that is associated with the user, accurately isolate the object file that took the longest to access, and thus delayed the logon process.

Number of CSE applied

Indicates the total number of client side extensions used for processing group policies for this user during the last measurement period.

Number

 

Number of CSE success

Indicates the number of client side extensions that were successfully used for processing group policies for this user during the last measurement period.

Number

 

Number of CSE warning

Indicates the number of warnings received when client side extensions were used for processing group policies for this user during the last measurement period.

Number

 

Number of CSE error

Indicates the number of errors registered when client side extensions were used for processing group policies for this user during the last measurement period.

Number

Ideally, the value of this measure should be zero. A sudden/gradual increase in the value of this measure is a cause of concern.

Client side extension processed time

Indicates the amount of time that client side extensions took for processing group policies for this user during the last measurement period.

Secs

Compare the value of this measure across users to know which user's logon process spent maximum time in group policy processing.

If this measure reports an unusually high value for any user, then, you may want to check the value of the LDAP bind time to active directory measure for that user to figure out if a delay in connecting to AD is affecting group policy processing. This is because, group policies are built on top of AD, and hence rely on the directory service's infrastructure for their operation. As a consequence, DNS and AD issues may affect Group Policies severely. One could say that if an AD issue does not interfere with authentication, at the very least it will hamper group policy processing.

You can also use the detailed diagnosis of this measure to know which client side extension was used to process which group policy for a particular user.