Slow Boot Slow Logon (SBSL), A Tool Called XPerf and Links You Need To Read



AskPFEPlat is in the process of a transformation to the new Core Infrastructure and Security TechCommunity, and will be moving by the end of March 2019 to our new home at (hosted at Please bear with us while we are still under construction!

We will continue bringing you the same great content, from the same great contributors, on our new platform. Until then, you can access our new content on either as you do today, or at our new site Please feel free to update your bookmarks accordingly!

Why are we doing this? Simple really; we are looking to expand our team internally in order to provide you even more great content, as well as take on a more proactive role in the future with our readers (more to come on that later)! Since our team encompasses many more roles than Premier Field Engineers these days, we felt it was also time we reflected that initial expansion.

If you have never visited the TechCommunity site, it can be found at On the TechCommunity site, you will find numerous technical communities across many topics, which include discussion areas, along with blog content.

NOTE: In addition to the AskPFEPlat-to-Core Infrastructure and Security transformation, Premier Field Engineers from all technology areas will be working together to expand the TechCommunity site even further, joining together in the technology agnostic Premier Field Engineering TechCommunity (along with Core Infrastructure and Security), which can be found at!

As always, thank you for continuing to read the Core Infrastructure and Security (AskPFEPlat) blog, and we look forward to providing you more great content well into the future!


For the last 6 months I’ve been saying I was going to write a series of posts around the topics of slow boot slow logon (SBSL) and how to use Xperf, but stuff kept coming up. While I kept missing the boat some other awesome engineers totally ate my lunch on this topic and posted them online, but we’ll get to those. This post is really going to aggregate all the posts that are out there in an easy one stop shop to them, fill in some gaps and get you started on troubleshooting your boot time.


Slow Boot Slow Logon All Up In The End Users Face

A huge impact to a user’s perception of how well a system performs is their actual logon experience. I frequently hear stories while I’m with customers where the user comes in, turns on their computer, starts the login process and then goes to get coffee while the system does whatever it needs to do. When they get back it’s usually done. A shiver goes up my spine. Don’t think this is a big deal? This is costing you money! Some of the folks in CTS put together an awesome graph so you can calculate just how much money is being lost. So what is your boot time? 1 minute? 5 minutes? 10 minutes? I’ll keep going. PFE is here to help. First and foremost we have a Windows Desktop Risk Assessement Program service, or WDRAP for short, if you are a Premier member. Simply contact your TAM and tell them you cannot live another minute with out it and say this post said so. Don’t have a Premier contract? Contact this blog and I’ll do my best to get you in touch with the right people so you can. Until then follow this post by CTS to define how long your boot process is for now.


A Tool Called Xperf

As SNL’s Stefon would say, Xperf has everything; graphical charts, ability to do stack tracing, process lifetimes, Spud Webb (kidding), and so much more. Xperf is a FREE tool that is part of the Windows Performance Tool Kit. This CTS post walks you through where you can get the install but I want to point out tip. When select the components to install, you can deselect everything besides the Windows Performance Tool Kit and if you want to install this on other machines, the Redistributable package.





Time To Take A Trace

If you are following the CTS guide from above (you should be), you will take a boot trace with the following command, xbootmgr -trace boot -traceflags base+latency+dispatcher -stackwalk profile+cswitch+readythread -notraceflagsinfilename -postbootdelay 10

Once it’s done open the trace with Xperf view. Here is some hints in what to look for during your analysis. Got it? Alright I’ll get you started with a few tips. First scroll down to the bottom and look for a graph called “Boot Phases” It should look something like this.


A few things should jump out at you, first the boot process is broken out into very distinct phases. CTS did an AMAZING job of breaking them out, you can read about it here. Something else to notice, the red arrow is a dead giveaway, that seems like a major part of our boot time is spent during the Winlogon session. Now we have something to target in trying to reduce our boot time. Finally you should notice that we can tell exactly how long our boot time is taking, 119 seconds.


Other things to look for is the Services chart. You’ll want to look for any services that seem to be running longer than the other services. Here is an example.




There are many things wrong with this but the one that really should stick out is the sftlist which is….APP-V. This is fixed in a hotfix, I documented this entire process over here.


 Alright one last hint, in CPU keep an eye out for large spikes or things that look interesting like “teeth”. Constant rows of spikes are not good. Here is another example.


Look at those spikes. Something is going on there. The CTS guys have compiled a list of some common root causes that you can read about here.

A tip I would give is the more traces you take and look at, the better you will get at them. You will see things that don’t seem normal quickly. If this is a topic of interest to the community I can write some future posts of SBSL and what the root causes were.


Update: It seems that many people find this page without checking out the rest of the Xperf posts we have so I’ll start listing them here to make it easier. 

Becoming an Xperf Xpert: The Slow Boot Case of the NetTCPPortSharing and NLA Services

Becoming an Xperf Xpert Part 2: Long Running Logon Scripts, Inconceivable!

Becoming an Xperf Xpert Part 3: The Case of When Auto “wait for it” Logon is Slow

Becoming an Xperf Xpert Part 4: What Did the WDIService Host Ever Do To You?

Becoming an Xperf Xpert Part 5: Gaps Of Time For Explorer.exe

-Mark Morowczynski