Logging Windows Boot & Startup Activity

Hi All
Thanks for taking a moment to read this. Before I dive into my question, a
little environment information: We're a Windows XP Pro environment (with a
few Win 7 clients) naturally running AD authenticating to Win 2003 DC's.

I'm looking for some way of logging exactly what the system is doing from
the time Windows starts to load all, to the time a user reaches their
desktop. This includes booting up until the GUI starts the load or is
loaded, the login screen & would continue until the desktop is fully loaded &
has processed Startup Programs, Run/RunOnce registry entries etc. I'm looking
for an in depth, detailed tool, something along the lines of BootLog XP,
which lists the drivers, EXE's & associated DLL's, complete with time stamps
and timing information. (Standard Windows Boot logging wasn't enough.)

Unfortunately, what BootLogXP doesn't capture is what the machine is doing
right as the GUI loads, (the moment you see the background/wallpaper), what
its doing until the login screen appears (applying computer settings,
preparing network connections etc), and what it processes during and after a
user logs on.

I've enabled verbose status messages, which work fine, but I need to be able
to log those messages to a file and capture things like:
What GPO policies is it checking & where its pulling this information from.
Which GPO policies is it applying and how long it takes for it to process
the policies.
Which DC's is it attempting to communicate with and timing communication
between the machine & said DC.

Is this possible?

If you're asking yourself 'what problem is he trying to solve?' its hard to
say because this isn't necessarily in response to a specific problem. I
suspect there are DC or DNS issues because of some information found in logs
and the way machines behave from time to time. (e.g.: a machine in
Washington D.C . used a DC in Silicon Valley; a London DC might get updated
with DNS info for a machine in Denver before the local DC.)

Also, for my own sanity, I'm looking to track what processes start & stop,
how long the machine stalls before moving onto the next directive etc. If I
can log registry queries as well, that would be great. (sounds like a job
for procmon (process monitor), but how can I ensure its the first possible
exe loaded?)

If you've read this far, thank you kindly for taking a moment to read.
--
Julius G. Perkins, IV
Enterprise Systems
Workstation Architect

Try Bootlog XP
http://www.greatis.com/utilities/bootlogxp/
---
Leonard Grey
Errare humanum est

On 12/11/2009 11:05 AM, JuliusPIV wrote:
Hi All
Thanks for taking a moment to read this. Before I dive into my question, a
little environment information: We're a Windows XP Pro environment (with a
few Win 7 clients) naturally running AD authenticating to Win 2003 DC's.

I'm looking for some way of logging exactly what the system is doing from
the time Windows starts to load all, to the time a user reaches their
desktop. This includes booting up until the GUI starts the load or is
loaded, the login screen& would continue until the desktop is fully loaded&
has processed Startup Programs, Run/RunOnce registry entries etc. I'm looking
for an in depth, detailed tool, something along the lines of BootLog XP,
which lists the drivers, EXE's& associated DLL's, complete with time stamps
and timing information. (Standard Windows Boot logging wasn't enough.)

Unfortunately, what BootLogXP doesn't capture is what the machine is doing
right as the GUI loads, (the moment you see the background/wallpaper), what
its doing until the login screen appears (applying computer settings,
preparing network connections etc), and what it processes during and after a
user logs on.

I've enabled verbose status messages, which work fine, but I need to be able
to log those messages to a file and capture things like:
What GPO policies is it checking& where its pulling this information from.
Which GPO policies is it applying and how long it takes for it to process
the policies.
Which DC's is it attempting to communicate with and timing communication
between the machine& said DC.

Is this possible?

If you're asking yourself 'what problem is he trying to solve?' its hard to
say because this isn't necessarily in response to a specific problem. I
suspect there are DC or DNS issues because of some information found in logs
and the way machines behave from time to time. (e.g.: a machine in
Washington D.C . used a DC in Silicon Valley; a London DC might get updated
with DNS info for a machine in Denver before the local DC.)

Also, for my own sanity, I'm looking to track what processes start& stop,
how long the machine stalls before moving onto the next directive etc. If I
can log registry queries as well, that would be great. (sounds like a job
for procmon (process monitor), but how can I ensure its the first possible
exe loaded?)

If you've read this far, thank you kindly for taking a moment to read.

Try Bootlog XP
http://www.greatis.com/utilities/bootlogxp/
---
Leonard Grey
Errare humanum est

On 12/11/2009 11:05 AM, JuliusPIV wrote:
Hi All
Thanks for taking a moment to read this. Before I dive into my question, a
little environment information: We're a Windows XP Pro environment (with a
few Win 7 clients) naturally running AD authenticating to Win 2003 DC's.

I'm looking for some way of logging exactly what the system is doing from
the time Windows starts to load all, to the time a user reaches their
desktop. This includes booting up until the GUI starts the load or is
loaded, the login screen& would continue until the desktop is fully loaded&
has processed Startup Programs, Run/RunOnce registry entries etc. I'm looking
for an in depth, detailed tool, something along the lines of BootLog XP,
which lists the drivers, EXE's& associated DLL's, complete with time stamps
and timing information. (Standard Windows Boot logging wasn't enough.)

Unfortunately, what BootLogXP doesn't capture is what the machine is doing
right as the GUI loads, (the moment you see the background/wallpaper), what
its doing until the login screen appears (applying computer settings,
preparing network connections etc), and what it processes during and after a
user logs on.

I've enabled verbose status messages, which work fine, but I need to be able
to log those messages to a file and capture things like:
What GPO policies is it checking& where its pulling this information from.
Which GPO policies is it applying and how long it takes for it to process
the policies.
Which DC's is it attempting to communicate with and timing communication
between the machine& said DC.

Is this possible?

If you're asking yourself 'what problem is he trying to solve?' its hard to
say because this isn't necessarily in response to a specific problem. I
suspect there are DC or DNS issues because of some information found in logs
and the way machines behave from time to time. (e.g.: a machine in
Washington D.C . used a DC in Silicon Valley; a London DC might get updated
with DNS info for a machine in Denver before the local DC.)

Also, for my own sanity, I'm looking to track what processes start& stop,
how long the machine stalls before moving onto the next directive etc. If I
can log registry queries as well, that would be great. (sounds like a job
for procmon (process monitor), but how can I ensure its the first possible
exe loaded?)

If you've read this far, thank you kindly for taking a moment to read.

He already tried that Leonard, see the arrow.

Questor


Try Bootlog XP
http://www.greatis.com/utilities/bootlogxp/
---
Leonard Grey
Errare humanum est

On 12/11/2009 11:05 AM, JuliusPIV wrote:
Hi All
Thanks for taking a moment to read this. Before I dive into my
question, a
little environment information: We're a Windows XP Pro environment
(with a
few Win 7 clients) naturally running AD authenticating to Win 2003 DC's.

I'm looking for some way of logging exactly what the system is doing from
the time Windows starts to load all, to the time a user reaches their
desktop. This includes booting up until the GUI starts the load or is
loaded, the login screen& would continue until the desktop is fully
loaded&
has processed Startup Programs, Run/RunOnce registry entries etc. I'm
looking
for an in depth, detailed tool, something along the lines of BootLog XP,
which lists the drivers, EXE's& associated DLL's, complete with time
stamps
and timing information. (Standard Windows Boot logging wasn't enough.)


-----
Unfortunately, what BootLogXP doesn't capture is what the machine is
doing
right as the GUI loads, (the moment you see the background/wallpaper),
what
its doing until the login screen appears (applying computer settings,
preparing network connections etc), and what it processes during and
after a
user logs on.

I've enabled verbose status messages, which work fine, but I need to
be able
to log those messages to a file and capture things like:
What GPO policies is it checking& where its pulling this information
from.
Which GPO policies is it applying and how long it takes for it to process
the policies.
Which DC's is it attempting to communicate with and timing communication
between the machine& said DC.

Is this possible?

If you're asking yourself 'what problem is he trying to solve?' its
hard to
say because this isn't necessarily in response to a specific problem. I
suspect there are DC or DNS issues because of some information found
in logs
and the way machines behave from time to time. (e.g.: a machine in
Washington D.C . used a DC in Silicon Valley; a London DC might get
updated
with DNS info for a machine in Denver before the local DC.)

Also, for my own sanity, I'm looking to track what processes start&
stop,
how long the machine stalls before moving onto the next directive
etc. If I
can log registry queries as well, that would be great. (sounds like a
job
for procmon (process monitor), but how can I ensure its the first
possible
exe loaded?)

If you've read this far, thank you kindly for taking a moment to read.

He already tried that Leonard, see the arrow.

Questor


Try Bootlog XP
http://www.greatis.com/utilities/bootlogxp/
---
Leonard Grey
Errare humanum est

On 12/11/2009 11:05 AM, JuliusPIV wrote:
Hi All
Thanks for taking a moment to read this. Before I dive into my
question, a
little environment information: We're a Windows XP Pro environment
(with a
few Win 7 clients) naturally running AD authenticating to Win 2003 DC's.

I'm looking for some way of logging exactly what the system is doing from
the time Windows starts to load all, to the time a user reaches their
desktop. This includes booting up until the GUI starts the load or is
loaded, the login screen& would continue until the desktop is fully
loaded&
has processed Startup Programs, Run/RunOnce registry entries etc. I'm
looking
for an in depth, detailed tool, something along the lines of BootLog XP,
which lists the drivers, EXE's& associated DLL's, complete with time
stamps
and timing information. (Standard Windows Boot logging wasn't enough.)


-----
Unfortunately, what BootLogXP doesn't capture is what the machine is
doing
right as the GUI loads, (the moment you see the background/wallpaper),
what
its doing until the login screen appears (applying computer settings,
preparing network connections etc), and what it processes during and
after a
user logs on.

I've enabled verbose status messages, which work fine, but I need to
be able
to log those messages to a file and capture things like:
What GPO policies is it checking& where its pulling this information
from.
Which GPO policies is it applying and how long it takes for it to process
the policies.
Which DC's is it attempting to communicate with and timing communication
between the machine& said DC.

Is this possible?

If you're asking yourself 'what problem is he trying to solve?' its
hard to
say because this isn't necessarily in response to a specific problem. I
suspect there are DC or DNS issues because of some information found
in logs
and the way machines behave from time to time. (e.g.: a machine in
Washington D.C . used a DC in Silicon Valley; a London DC might get
updated
with DNS info for a machine in Denver before the local DC.)

Also, for my own sanity, I'm looking to track what processes start&
stop,
how long the machine stalls before moving onto the next directive
etc. If I
can log registry queries as well, that would be great. (sounds like a
job
for procmon (process monitor), but how can I ensure its the first
possible
exe loaded?)

If you've read this far, thank you kindly for taking a moment to read.

Thanks you two for checking this out. I know that what I'm looking for is
quite obscure and specific. It may not exist, or at least not for free.

--
Julius G. Perkins, IV
Enterprise Systems
Workstation Architect

Thanks you two for checking this out. I know that what I'm looking for is
quite obscure and specific. It may not exist, or at least not for free.

--
Julius G. Perkins, IV
Enterprise Systems
Workstation Architect