I started a new job at a school district as a systems manager and one of our bigger problems is our new Windows 11 AIOs are getting stuck on a “please wait” screen at boot which, after enabling verbose, saw it’s actually “Applying Computer Settings”
Slight background I came in since they were renewing the entire district, I’ve been with them about 6 month now and have primarily been their JAMF admin in all honesty. We use WSUS, on prem AD, and an older MDM called ZenWorks or MicroFocus. (Idk but all the docs are for XP and Win7 when I look at it…)
I’ve worked closely with the network engineer and have taken out any ACL or possible blocking.
It happens on Wi-Fi and ethernet. At seemingly random times, I can never consistently get it to reproduce but one room at one of our schools is having it happen about once a day.
And yes, we’re investigating DNS but it all seems in order when we check.
One thing it could be is the server admin was also shouldering my job when I got there so he just simply kept the old Win10 GPOs and never did any updating or checking. I’m not in control of this but he’s really helpful and is going to take a look when he can.
I’ve been grasping at straws and I’m not looking for answers but a bit of venting and curious if anyone else has come across the same thing because I don’t have many more straws to grab at.
What does Event Viewer say?
Whole lotta nothing. I see where they do a scheduled shut down and start up but when it happens all I see is everything starting then an error that points out that I had to hard power off the device “last shutdown was unexpected.”
If you expand the applications and services part, you can drill down to a group policy specific log which is awfully verbose.
Another thing it might relate to is if the DC that the client is talking to is busy (this is a long shot, though!).
Once you find the pattern of gpo refresh taking ages and start to map that out (chuck the various phases into a spreadsheet, it’s complicated, you’re looking for scripts processing took a bazillion seconds - but it could be registry or any of the other components) across a few PCs, you’ll be able to validate whether its a single DC
That’s during group policy application, isn’t it? Run an rsop report against that PC and see if anything sticks out.
Also enable verbose logon messages to see if there’s a particular step it gets hung on.
And if you’re moving to W11, if you haven’t already, you should install the ADMX templates: https://www.anoopcnair.com/administrative-templates-for-windows-11-22h2/
But you should know that MS, in typical fashion, does not make the W11 ADMX templates compatible with W10. You’ll probably be fine managing both with just the W11 templates unless you’re doing some really specialized stuff. Just something to keep in mind.
I forgot to update this since there was Thanksgiving break and the whole family got covid.
Anyways, seems to be related to Cisco Secure Endpoint. We uninstall that and the issue never happens. Install endpoint and was able to reproduce.
