There are many reasons for slow performance immediately following logon. In my last post I explained how you can troubleshoot slow logon by limiting the user profile size. This post explains how to keep the 3-headed monster from becoming one of them.

While constantly checking Task Manager and Resource Manager, I would sometimes notice high CPU utilization due to what I call the 3-headed monster. Here’s the definition for that:

3-headed monster ^

The user experience of Windows Indexing, System Restore, and/or Windows Error Reporting causing less than desirable states of desktop responsiveness especially during logon process. These are three Windows “features” I would consider disabling to improve performance immediately following logon. Disabling these will also improve overall performance.


Let’s start with indexing. The theory of indexing is sound and I think can be applicable to home desktop users. However; on workstations in the business environment, I’m not so sure.

I’ve seen indexing cause slow performance when the Users directory is included in indexing. If you read my previous post, you learned how to reduce the size of the user’s roaming profile. That is helpful for the profile synchronization process but doesn’t reduce the size of the local profile. This local profile can be very large and could contain a very large number of files. I’ve found that removing this directory from indexing can greatly improve performance.

Here’s how to disable it.

From the Control Panel search for Indexing. Click Change how Windows searches. The Indexing Options dialog box will display showing you the number of items indexed. Click Modify to disable Indexed Locations.

Slow logon - Indexing Options and Indexed Locations

Indexing Options and Indexed Locations

System Restore ^

Now on to System Restore. This is another feature that I feel has a better place in the home environment. It allows you to recover easily should something go wrong. But again, I have seen this cause massive system lagging when it’s running. I recommend disabling it and here’s why. Most shops have at least one spare machine lying around. Keep that as a hot spare and replace that machine that took a nose dive into the concrete-filled swimming pool. Roaming profiles and server data storage mean that in this case that machine is just a dumb terminal anyways. Turn off the extra services in favor of performance for your users and they’ll be much happier.

Here’s how to disable it.

Right-click Computer and select Properties. Click Advanced system settings and then the System Protection tab. Select a drive and then click Configure. Select radio option to Turn off system protection.

Slow logon - Disable System Restore

Disable System Restore

Windows Error Reporting ^

Just a quick disclaimer, I’m a big fan of Microsoft. They’re aren’t perfect but they sell good products that are universally recognized by anyone. In fact, I think they’re so great that I’m willing to bet they don’t really need every one of my workstations reporting every little problem. As with System Restore, I’m interested in removing anything that is going to cause lagginness (if that’s a word) for my end user.

Very rarely, I’ve seen the WER directory grow very large. Disabling indexing on the Users directory should mean that a large WER directory isn’t too big of a deal. The location of the WER directory is typically C:\Users\%username%\AppData\Local\Microsoft\Windows\WER.

Here’s how to disable it.

Windows Error Reporting can be disabled using group policy. If you want to disable by computer, create a GPO and configure Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings. To disable by user, customize the GPO section User Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings.

Slow Logon - Turn of Windows Error Reporting

Turn off Windows Error Reporting

In both the computer and user settings, there are also several other communication settings that I would highly recommend you review and consider disabling.

For additional information please refer to this TechNet article.

A couple other reminders that I may be helpful: Make sure that anti-virus and anti-malware are set to scan at times when user’s are not active. Also make sure that server backup activity is not affecting user performance.

Also read 10.5 ways how to speed up a slow Windows


Leave a reply

Your email address will not be published.


© 4sysops 2006 - 2022


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account