Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Windows 10 / Using Process Monitor to Solve a Slow Boot Problems

June 20, 2017 Windows 10Windows 7

Using Process Monitor to Solve a Slow Boot Problems

To diagnose the reasons of slow Windows boot, there is a number of quite powerful tools and techniques of log analysis that allow performing the detailed debugging of all steps of system boot and start of services (xperf/xbootmgr from Windows Performance Toolkit / Analyzer). But their use can cause some troubles, especially, for a beginning system administrator. In this article we’ll show how to easily and quickly detect, which apps, services and drivers work slow during the system start, thus increasing the total boot time.

Certainly, all Windows system administrators should be familiar with Process Monitor from from the Sysinternals system utilities kit. Process Monitor allows monitoring the activities of running processes, access to the file system and the registry in real time. One of the little-known Process Monitor features is the opportunity to enable monitoring of processes started during Windows startup.

To diagnose the boot stage, Process Monitor creates a separate service in HKLM\SYSTEM\CurrentControlSet\Services section of the registry. This service loads the boot mode driver procmon23.sys that starts after Winload.exe is launched and logs the activity of all processes run during system boot and user logon.

  1. Download and unpack the archive containing Process Monitor (http://download.sysinternals.com/files/ProcessMonitor.zip)
  2. Run procmon.exe with the administrator privileges
  3. Select Enable Boot Logging in the Options menuProcess Monitor Enable Boot Logging
  4. In the next window, select Generate thread profiling events -> Every second. In this mode, procmon driver will capture the state of all processes every second Generate thread profiling events
  5. Restart your computer and wait till your desktop appears
  6. procmon23.sys will log all events until a user starts Process Monitor. After that the boot logging mode is disabled
  7. In Process Monitor window, accept the offer to save the collected data to a file.save boot time activity log
Note. If you don’t stop Process Monitor, the temporary log file %windir%\procmon.pmb will eventually take up all free space on the system drive.
  1. Select the directory you want to save the file to and wait till it is saved. In my case, three files: Bootlog .pml, Bootlog-1.pml and Bootlog-2.pml with the total size 700 MB appeared in the target directory.
  2. In ProcMon window, click the header of the table, then click Select Columns and enable the display of the Duration columnevent duration column
  3. Create a new filter in the Filter menu.create new event filter
  4. Select Duration as the parameter of the filter, more than as the filter condition and specify the value 10.process monitor filter
  5. Thus, in the list of processes you will have only the processes that spend more that 10 seconds to perform some operations. (I have chosen 10 seconds to make the example more demonstrative).long process list
  6. To analyze the boot process, you can also use Tools ->Process Tree feature that displays all processes as a graphic tree containing the information about the beginning, duration and completion of each process. procmon - boot Process Tree

You just have to analyze the list of processes you have got (if necessary, you can carry out further analysis of the problem process having enabled the filter by the name of the executable file), match processes and services, apps or drivers, and optimize your system.

As a rule, this type of analysis helps to detect slow processes, infected programs (first of all, you should analyze the children processes of Winlogon.exe), make a decision on uninstallation/update of the problem software or driver, disable some services or change the type of their start (delayed or manual start), remove some apps from Autostart. Often antivirus software and other resource-consuming software get into this list.

0 comment
0
Facebook Twitter Google + Pinterest
previous post
Using PowerShell PackageManagement In Windows 10
next post
How to Configure a Slideshow Screensaver Using GPO

Related Reading

Configure User’s Folder Redirection with Group Policy

February 3, 2023

Disable Built-in PDF Viewer in Microsoft Edge

February 3, 2023

Join a Windows Computer to an Active Directory...

February 2, 2023

Using Previous Command History in PowerShell Console

January 31, 2023

How to Install the PowerShell Active Directory Module...

January 31, 2023

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Configure User’s Folder Redirection with Group Policy

    February 3, 2023
  • Using Previous Command History in PowerShell Console

    January 31, 2023
  • How to Install the PowerShell Active Directory Module and Manage AD?

    January 31, 2023
  • Finding Duplicate E-mail (SMTP) Addresses in Exchange

    January 27, 2023
  • How to Delete Old User Profiles in Windows?

    January 25, 2023
  • How to Install Free VMware Hypervisor (ESXi)?

    January 24, 2023
  • How to Enable TLS 1.2 on Windows?

    January 18, 2023
  • Allow or Prevent Non-Admin Users from Reboot/Shutdown Windows

    January 17, 2023
  • Fix: Can’t Extend Volume in Windows

    January 12, 2023
  • Wi-Fi (Internet) Disconnects After Sleep or Hibernation on Windows 10/11

    January 11, 2023

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Booting Windows 7 / 10 from GPT Disk on BIOS (non-UEFI) systems
  • Removable USB Flash Drive as Local HDD in Windows 10 / 7
  • How to increase KMS current count (count is insufficient)
  • Unable to Connect Windows 10 Shared Printer to Windows XP
  • Using the BitLocker Repair Tool to Recover Data on Encrypted Drive
  • Auto-Mount a VHD/VHDX File at Startup in Windows 10, 8.1
  • Error 0x80073CFA: Can’t Uninstall Apps using Remove-AppxPackage in Windows 10
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top