Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Windows 10 / Find The Cause of Windows Slow Boot with Process Monitor

December 8, 2023

Find The Cause of Windows Slow Boot with Process Monitor

To identify drivers, programs, and services that cause Windows to bool slowly, you must enable startup logging. In this guide, we will have a look at how to create a Windows boot log and analyze slow processes with the Process Monitor tool.

The Process Monitor system tool is typically used to monitor the activity of running processes, access to files and the registry in real-time. ProcMon also allows you to enable logging of all processes that run at Windows startup, get the execution time of each process, and save the log to a file for further analysis.

  1. Download and extract the Process Monitor archive (http://download.sysinternals.com/files/ProcessMonitor.zip)
  2. Run procmon.exe as an administrator;
  3. Select Enable Boot Logging in the Options menu; Process Monitor Enable Boot Logging
  4. Select the option Generate thread profiling events -> Every second. In this mode, the procmon driver will capture the state of all processes every second; Generate thread profiling events
  5. Save changes. ProcMon copies the procmon24.sys driver to the %SystemRoot%\System32\Drivers directory and creates a separate service PROCMON24 (under the reg HKLM\SYSTEM\CurrentControlSet\Services). This service starts after Winload.exe and logs the activity of all processes while Windows is booting and the user logs on;
    To disable boot logging mode, run: procmon.exe /noconnect
    procmon24 service
  6. Restart your computer and wait for the desktop to appear;
  7. The procmon24.sys driver will continue to write to the event log until the user manually starts the Process Monitor. This will disable the boot logging mode.
  8. Accept the proposal to save the collected data in the bootlog.pml file. save boot time activity log
    Note. If you don’t stop Process Monitor, the temporary log file %windir%\procmon.pmb will eventually take up all the free space on your system drive.  
  9. The size of the bootlog.pml file is about 500MB in my case. Open this file with ProcMon;
  10. In the ProcMon click on the header of the table, then click on Select Columns and enable the Duration column; event duration column
  11. Create a new Filter;create new event filter
  12. Select Duration as the filter parameter, more than as the condition, and specify the value 5. Click Add and OK; process monitor filter
  13. Only those actions that took more than 5 seconds will remain in the list of processes (for clarity, I have chosen 5 seconds); long process list
  14. To analyze the boot process, you can also use Tools -> Process Tree feature which displays all processes as a graphical tree showing when each process started, ran, and finished.procmon - boot Process Tree

You just have to analyze the list of processes you have got, match processes and services, apps, or drivers. Antivirus apps and other ‘heavy’ software are most likely to appear on this list.

In this example, the Edge browser update process started when the computer started and took almost 4 minutes.

procmon: find slow process at boot

The Edge browser is updated by a separate MicrosoftEdgeUpdateTaskMachineCore scheduler task which runs at any user sign-in. If you find that this problem occurs frequently, you can delay the task by adding a delay to its schedule.

add delay to scheduled task

You can also get CPU, RAM, and disk usage information for processes started when Windows boots. To do this, select the Process Activity Summary option from the Tools menu.

Process Activity Summary

Sort processes to find the most resource-intensive processes that use a lot of CPU or RAM during boot.

Process CPU and RAM usage at Windows startup

You can use Network Summary to find slow network requests and processes that are downloading or sending large amounts of data over the network when Windows starts up. For example, the screenshot shows that the computer received approximately 0.5 MB of data from the domain controller when it started.

process network activity at windows startup

Network traffic analysis can also help you understand why GPO settings are taking so long to apply.

Analyze all the processes that are slowing down the booting of Windows (first of all, you need to analyze the child processes of Winlogon.exe). You need to optimize the system based on the information collected: remove/update problem apps or drivers, disable some services or change their startup type (Set to delayed or manual start), remove some apps from Startup, etc.

0 comment
2
Facebook Twitter Google + Pinterest
Windows 10Windows 11
previous post
Fix: Slow Logins Caused by Long Group Policy Processing
next post
How to Configure and Deploy Screensaver on Windows with Group Policy

Related Reading

Unable to Connect Windows 10 Shared Printer to...

March 11, 2024

How to increase KMS current count (count is...

March 12, 2024

Error 0x0000007e: Windows cannot connect to network printer,...

March 11, 2024

How to Clear Event Viewer Logs on Windows

November 9, 2023

Removable USB Flash Drive as Local HDD in...

March 11, 2024

Booting Windows from GPT Disk on BIOS (non-UEFI)...

March 11, 2024

Recovering Files from a RAW Partition using TestDisk

March 16, 2024

Fix: Limited Wi-Fi Access in Windows

March 11, 2024

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Booting Windows from GPT Disk on BIOS (non-UEFI) Computer
  • Removable USB Flash Drive as Local HDD in Windows
  • How to increase KMS current count (count is insufficient)
  • Unable to Connect Windows 10 Shared Printer to Windows XP
  • Auto-mount VHD/VHDX File at Startup in Windows
  • Error 0x80073CFA: Can’t Uninstall Apps using Remove-AppxPackage in Windows 10
  • Fix: Limited Wi-Fi Access in Windows
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top