Troubleshooting the Windows logon process

Posted on August 19th, 2008

To troubleshoot the logon process, debug logging can be enabled. This is useful in a Citrix environment as the logon could be slow and the debug log file will show where the pauses occur during the logon.

Microsoft Technet article can be found here: Q221833

Use Registry Editor to add or to modify the following registry entry:

Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: UserEnvDebugLevel
Type: REG_DWORD
Value data: 10002 (Hexadecimal)

UserEnvDebugLevel can have the following values:

NONE 0×00000000
NORMAL 0×00000001
VERBOSE 0×00000002
LOGFILE 0×00010000
DEBUGGER 0×00020000

The default value is NORMAL|LOGFILE (0×00010001).

Note To disable logging, select NONE (0×00000000).

You can combine these values. For example, you can combine VERBOSE 0×00000002 and LOGFILE 0×00010000 to get 0×00010002. Therefore, if UserEnvDebugLevel is given a value of 0×00010002, LOGFILE and VERBOSE are both turned on. Combining these values is the same as using an OR statement.

0×00010000 OR 0×00000002 = 0×00010002

Note If you set UserEnvDebugLevel to 0×00030002, the most verbose details are logged in the Userenv.log file.

The log file is written to the %Systemroot%\Debug\UserMode\Userenv.log file. If the Userenv.log file is larger than 300 KB, the file is renamed Userenv.bak, and a new Userenv.log file is created. This action occurs when a user logs on locally or by using Terminal Services, and the Winlogon process starts. However, because the size check only occurs when a user logs on, the Userenv.log file may grow beyond the 300 KB limit.

The 300 KB limit cannot be modified.

Summary

RegKey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel

For full debug logging set to: 30002

Log file: c:\windows\debug\UserMode\userenv.log

Tags: debug, environment, logon, user, UserEnvDebugLevel, Windows 2003
Filed under Windows 2003 |

2 Responses to “Troubleshooting the Windows logon process”

1. RP Says:
   August 27th, 2008 at 1:12 pm

   Note – On a x64 version of Windows add the registry value as described above. It does not need to be in the WOW6432Node location.

2. Slow logons at ‘applying registry policy’ stage on a Windows 2003 Citrix Server | Richard Parmiter Says:
   September 24th, 2008 at 9:50 am

   [...] enabled User Environment Debug Logging (see here for details on how to enable this) with full debug logs. I spotted the following in these [...]

Leave a Reply