Report Request: How long did it take a user to login?

[francisswest]

Good morning!  

We have around 3000 Windows devices, a lot of which are used by the public.  We have been receiving reports of devices taking 10, 15, even 18 minutes to go from 'login' to a usable desktop.  Our workaround right now is to just reimage that machine, but that requires us to have it reported.  By the time the user gets logged in, they are already way too frustrated (understandably) to submit a ticket.  

We are looking for a report of machines and how long it takes them to go from the login screen to a usable desktop.  This could probably be measure by when they are finally able to open a web browser as the 'success' marker.  We want to be able to start seeing trends and getting out ahead of them, rather than have our users endure a frustrating experience.  If we could see for instance, which machines are taking say, >4 minutes to log in, we could plan to reimage those proactively.

Note: We are working on finding the issue causing this, but while we navigate those waters, we want to have some proactive actions we can take.

Any thoughts on how to generate such a report?  Would it require additional scanning of sorts?

Thanks!

[Hendrik_VE · Accepted solution]

What you could try is run the following powershell script (eg. as a deployment package):

# Get the last system shutdown event
$shutdownEvent = Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID = 13
} -MaxEvents 1
$shutdownTime = $shutdownEvent.TimeCreated
# Get the start of WMI subsystems event
$wmiEvent = Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    ID = 5617
} -MaxEvents 1
$wmiStartTime = $wmiEvent.TimeCreated
# Calculate the time difference
$uptime = $wmiStartTime - $shutdownTime
# Create a new event log message
$eventMessage = "Time between last system shutdown and start of WMI subsystems: $uptime"
# Create a new event log entry
EventCreate /L Application /T Error /ID 1000 /D $eventMessage

As a result, you will have an error event which can be scanned by Lansweeper and where you can run a custom report against. The result looks like this (on my testsystem):
Time between last system shutdown and start of WMI subsystems: 00:01:59.1344480

Meaning it took 1'59" between the last shutdown message and consequent startup of WMI services message.

Surely you could tweak the powershell script a bit to use more meaningful shutdown or startup events for your environment.