mikegb

I performed the boot capture of my Windows 8.1 PC using the instructions at the start of this thread. The PreSMSS to WinlogonInit timing I get is this: <interval name="PreSMSS" startTime="0" endTime="9372" duration="9372"><interval name="SMSSInit" startTime="9372" endTime="20936" duration="11564"><interval name="WinlogonInit" startTime="20936" endTime="30527" duration="9591">In looking at the <pnp> nodes, I can see that the bulk of the PreSMSS phase is spent in the SATA/SAS device initialization. Perhaps time spent longer than I would like but at least I understand where the time is spent. That then takes me to the SMSSInit phase. I open up my ETL file in the Windows Performance Analyzer. I open System Activity->Boot Phases like you see here: I want to understand what the Session Init phase is doing for the 11.5+ seconds but I can't figure out why. I highlighted the "Session Init" phase so I could see what overlapped with it. Here is what I tried: Dragged "Processes" to be just below the "Boot Phases" diagram. The only this showed me was that "smss.exe" overlapped almost the entire period and the start of csrss.exe started toward the very end of the "Session Init" phase. I could not find a way to dig deeper to find out what was happening. The "Threads" and "Images" options show the same thing. Dragged "Device I/O" onto the timeline. The one driver that showed almost continual access was storport.sys so my SSD was continually being accessed during this phase but by whom? Dragged "Services" onto the timeline. All "Services" show activity *after* the Session Init phase. Dragged"Generic Events" onto the timeline. This shows several providers that overlap but nothing continually. Closest one is diskIo which has regular activity.What should I look for to find out what is occurring during this phase? Same as Winlogon Init, I see various processes start during this phase (e.g. wininit.exe, csrss.exe, services.exe, lsass.exe, winlogon.exe, etc.) but I'm not sure what to look for, for anything taking longer than expected. The graph shown to start this thread (the Boot_WinLogonInitPhase.png) does not appear for me in the Windows Performance Analyzer. I can't seem to find the location where services are initiated. If someone could provide a pointer on what I should look for, I would appreciate it. Thank you.

Regarding my Post #327, I think I stumbled onto something. I use Hyper-V on this system and I have XDC and Virtualization Technology both enabled in the BIOS. If I disable either one, this 15 second pre osloader hang goes away. I only get this 15 second "freeze" if both XDC and Virtualization Technology are enabled. I checked with HP and my system has the last BIOS available for the system. Any ideas? Thanks.

I have a Server 2012 R2 system booting from an Intel SSD. Since installing Chrome, I noticed a 15 second hang during boot every time. Uninstalling Chrome doesn't change the behavior and I don't really think Chrome is the issue. I followed the steps in this posting no how to trace the boot times and the results do NOT show this 15 second hang. However, I isolated it down to the OSLoader. The problem does NOT show up in the ETL file. For example, osLoaderDuration only shows 877 as the time: <timing bootDoneViaExplorer="15107" bootDoneViaPostBoot="-1" osLoaderDuration="877" postBootRequiredIdleTime="10000" postBootDisturbance="9223372011747" pnpBootStartStartTime="37" pnpBootStartEndTime="854" pnpBootStartDuration="817" pnpSystemStartStartTime="1013" pnpSystemStartEndTime="1381" pnpSystemStartDuration="368"> So what I did during boot is press <F8> to get to the boot options. I think put the cursor over the enable boot logging option and at exactly 14:19:00, I pressed <Enter>. When I did that, there was very brief disk activity and then no disk activity for ~15 seconds. Then the boot continued as normal. What's interesting is looking at ntblog.txt as you see here: 5 18 2014 14:19:16.499 BOOTLOG_LOADED \SystemRoot\system32\ntoskrnl.exe So there was an ~15-16 second delay from when I told Windows to boot to when the boot log started logging activity. Any idea what is causing this ~15 second hang? Since ETL doesn't show the problem, how can I figure out what Windows is doing during this time? THANKS!!!