Tuesday, December 3, 2013

Fast Logon Optimization

By default in Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows XP, the Fast Logon Optimization feature is set for domain and workgroup members. Policy settings apply asynchronously when the computer starts and when the user signs in. As a result, these operating systems do not wait for the network to be fully initialized at startup and sign-in. Existing users are signed in by using cached credentials. This results in shorter sign-in times. Group Policy is applied after the network becomes available.

With Fast Logon Optimization, enabled Group Policy foreground processing runs asynchronously. When a CSE requires synchronous processing:

  • Policy settings do not apply during the asynchronous processing cycle.
  • The CSE that requires synchronous policy application can still be called during asynchronous policy application. Instead of applying policy settings, the CSE signals for synchronous processing to be applied at the next startup or sign-in.

When synchronous policy application is required and Fast Logon Optimization is enabled, it can take up to two reboots or two sign-ins for the policy settings to apply. This is demonstrated in the following examples.

  • Example 1: Fast Logon Optimization with synchronous processing when the user is not signed in. A user is not signed in to the client computer when a change is made to user policy settings, and synchronous processing is not requested. In this case, the policy settings are applied after two sign-ins.
    • policy settings changed 
    • -> user signs in
    • -> group policy engine determines the change and call client-side extensions 
    • -> CSE determines that it requires synchronous processing and exits without applying the policy
    • -> CSE signals to the group policy engine that synchronous processing is needed for the next sign-in 
    • -> second sign-in 
    • -> group policy engine determines that CSE did not completely process the policy settings during the last sing-in session 
    • -> group policy engine calls the CSE and the CSE determines that group policy is processing synchronously and applies the policy settings.
  • Example 2: Fast Logon Optimization with synchronous processing when the user is signed in. A user is signed in to the client computer when a change is made to user policy settings, and the user stays signed in to the computer so that background processing takes place prior to sign-out. In this case, the policy settings are applied after one sign-in.
    • user signed in
    • -> policy setting changed
    • -> group policy background processing ((((
    • -> the group policy engine determines the change and calls the CSE
    • -> the CSE determines that it requires synchronous processing and exits
    • -> the CSE signals to the group policy engine that synchronous processing is needed for the next sign-in
    • -> subsequent background refreshes will call CSE as well, but CSE exits because it still requires synchronous processing. )))
    • -> next sign-in
    • -> group policy process synchronously and the group policy engine determines that CSE did not complete processing during the last sign-in session
    • -> group policy engine calls the CSE and the CSE applies the policy settings

Group Policy settings or scripts that are applied during startup or shutdown might not be applied on computers that are running Windows 8.1 or Windows 8 because, by default, these computers are not fully shut down by the Shut down command. Instead, the computer enters a hibernate state. Full shutdown only occurs when the system is set to reboot or when a pending software update or other event causes the computer to process a full shutdown. You can use the Restart Computer command in Windows 8.1 and Windows 8 to achieve startup or shutdown on client computers.

If you do not want fast startup to apply to computers in your enterprise, you can apply a GPO that disables the Computer Configuration/Policies/Administrative Templates/System/Shutdown/Require use of fast startup policy setting. Be aware that disabling this policy setting results in full shutdowns and longer startup times for client computers. The enabled state of the Require use of fast startup policy setting does not take precedence over any Group Policy setting that disables hibernation.

Also, you can disable Fast Logon Optimization by using the following policy: Administrative Templates\System\Logon\Always wait for the network at computer startup and logon.

See More details

No comments:

Post a Comment