The next frame’s function, WNetRestoreAllConnectionsW, combined with the deeper calls into file server functions, led me to conclude that Winlogon was trying to restore file server drive letter mappings before proceeding to launch my shell and give me access to the desktop. It was many frames deep, including calls into functions of the Multiple UNC Provider (MUP) and Distributed File System Client (DFSC) drivers, both related to accessing file servers: The stack of the third thread was much more interesting. My eye was drawn to a pattern of the same four threads sampled every second throughout the entire black-screen period.

Instead of scanning the several million events that had been captured, which would have been like looking for a needle in a haystack, I used this Process Monitor filter to look for operations that took more than one second, and hence might have caused the slow down: Being locked out of your computer for that long is annoying to say the least.Īfter I rebooted, I logged on, waited for five minutes looking at a black screen, then finally got to my desktop, where I ran Process Monitor again and saved the boot log. I’d typically chalk up an isolated delay like this to networking issues, common at conferences and with hotel WiFi, but I hit the issue consistently switching between the laptop’s Windows 8 installation, where I was doing testing and presentations, and the Windows 7 installation, where I have my development tools.

While I was there I began to experience five minute black-screen delays when I logged on to my laptop’s Windows 7 installation: The story unfolds the week before last when I made a trip to Orlando to speak at Microsoft’s TechEd North America conference. Fun debugging story unreachable mapped network drives caused the logon process to stall for ~5s on every boot.

Process monitor boot logging