Troubleshooting the Windows logon process
To troubleshoot the logon process, debug logging can be enabled. This is useful in a Citrix environment as the logon could be slow and the debug log file will show where the pauses occur during the logon.
Microsoft Technet article can be found here: Q221833
Use Registry Editor to add or to modify the following registry entry:
Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: UserEnvDebugLevel
Type: REG_DWORD
Value data: 10002 (Hexadecimal)UserEnvDebugLevel can have the following values:
NONE 0×00000000
NORMAL 0×00000001
VERBOSE 0×00000002
LOGFILE 0×00010000
DEBUGGER 0×00020000The default value is NORMAL|LOGFILE (0×00010001).
Note To disable logging, select NONE (0×00000000).
You can combine these values. For example, you can combine VERBOSE 0×00000002 and LOGFILE 0×00010000 to get 0×00010002. Therefore, if UserEnvDebugLevel is given a value of 0×00010002, LOGFILE and VERBOSE are both turned on. Combining these values is the same as using an OR statement.
0×00010000 OR 0×00000002 = 0×00010002Note If you set UserEnvDebugLevel to 0×00030002, the most verbose details are logged in the Userenv.log file.
The log file is written to the %Systemroot%\Debug\UserMode\Userenv.log file. If the Userenv.log file is larger than 300 KB, the file is renamed Userenv.bak, and a new Userenv.log file is created. This action occurs when a user logs on locally or by using Terminal Services, and the Winlogon process starts. However, because the size check only occurs when a user logs on, the Userenv.log file may grow beyond the 300 KB limit.
The 300 KB limit cannot be modified.
Summary
RegKey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel
For full debug logging set to: 30002
Log file: c:\windows\debug\UserMode\userenv.log
Tags: debug, environment, logon, user, UserEnvDebugLevel, Windows 2003
August 27th, 2008 at 1:12 pm
Note - On a x64 version of Windows add the registry value as described above. It does not need to be in the WOW6432Node location.
September 24th, 2008 at 9:50 am
[...] enabled User Environment Debug Logging (see here for details on how to enable this) with full debug logs. I spotted the following in these [...]