May 26, 2010

Startup-01

If your Windows 7 systems need half an eternity to boot up, there’s clearly something odd going on. Dealing with slow boot problems is annoying and – let’s face it – is mostly guesswork. Guesswork that costs money and time. We have got you covered: Learn how to analyze the startup process, find the cause in no time, and get rid of bottlenecks once and for all!

Windows 7 is a fast beast, especially when it comes to its startup process which was optimized dramatically compared to Windows Vista. No wonder, as Microsoft has a dedicated team focusing strictly on startup performance. And it shows: On one- to two-year-old hardware, Windows 7 usually takes only 20 to 40 seconds to boot up. Even the performance-wise challenged netbooks rarely need more than a minute to be ready for work!

Certainly, boot times vary significantly from one computer to another. This is nothing new. But if Windows 7 clients need way longer – and we’re talking way over one or two minutes – then you’re looking at a resource hog. So what could be causing the problem?

  • You just installed a new driver, which hasn’t been WHQL-certified and delays the boot up process. It could be a simple driver bug!
  • You installed a piece of resource-intense software that initializes a process or a service during startup.
  • You updated existing software or Windows 7 itself. Yes, it’s not unheard of that some updates cause a significant boot delay.


Maybe it’s a combination of all three causes. In any case, something is clearly taking up too much resources during startup time. To get to the bottom of the mystery, you need to follow a couple of step-by-step instructions to find and resolve the issue. Ready? Here’s how!

Find Out Exactly How Long Windows 7 Needs to Start Up

Let’s start off by finding out the exact time the Windows 7 client needs to start up. And guess what, no stopwatch is required! Windows 7’s very own Event Viewer does the trick. In the following four steps you learn to measure both the raw boot time and the real life boot time (and what both mean).

  1. Open up “Control Panel,” go to “System and Security” and head over to “Administrative Tools.” From here, launch “Event Viewer.”Startup-01
  2. Expand “Applications and Services Logs,” “Microsoft,” “Windows,” “Diagnostics / Performance,” and finally “Operational.” Now look out for the Event ID 100:
    Startup-02

    This Event details how long your Windows 7 client takes for a full boot. This is what I call raw boot time.
    Startup-03
    The value represents the exact time necessary to go from the first startup phase (right before the animated Windows boot logo appear) to the final stages. This is when the desktop is visible, startup programs are being loaded, and network connectivity is up and running. Remember to take this value with a grain of salt — more in Step 4!

  3. As seen on the screenshot above, my test bed needed 103 seconds. That’s okay, but pretty bad compared to the original performance. The week after I installed and configured Windows 7, it needed about 46 seconds to start:
    Startup-04
    In my example, this is quite a loss in performance: From 46 to 103 seconds!

    You can find the original boot up time if you sort the list by “Event ID” and look for the earlier couple of entries.

    Note: I wouldn’t necessarily take the very first boot log for a comparison. In the first couple of days after installation, Windows 7 needs to adapt the SuperFetch feature to all programs and install updates during boot up.

  4. You have the “Raw boot time” value now. As I said, this value doesn’t necessarily represent the actual startup performance. Even though the desktop is visible and you have a working internet connection your PC may behave incredible sluggishly. For example, even launching a small footprint browser like Google Chrome can take up to 10 seconds in the first minute after boot. No surprise here; Windows is still busy initializing services and paging data in and out of RAM.To get the real life boot time, double-click on the latest Event ID 100 entry, go to “Details” and check the “MainPathBootTime” value:
    Startup-05
    Phew! Another 38 seconds until Windows 7 is done with all its “post-boot” workload and I am actually able to work with the PC.

It’s important to watch both the raw boot time and real life boot time to troubleshoot a slow startup!

Step-by-Step: Finding Boot Delays

If you’re plagued by a slow startup, there is probably more than one problem going on. And guess what: Windows 7 knows them all. The “Diagnostic Performance” category (mentioned above) keeps a record of all startup issues. Simply sort the list by “Task Category”…
Startup-06
…and go through all the events you see in the “Boot Performance” category. Look for “Warnings” and “Critical” errors. The following entry is a prime example:

Startup-07

This event clearly shows that MsMpEng.exe needs 26 seconds to start, which is 10 seconds longer than normal! If this event only crops up once, you don’t need to go to Red Alert. However, if you see the same warning more than once, then this is definitely a call to action.

Eliminating Boot Delays

Next up: Commonly found causes for boot delays! The following problems originate from a dozen computers of a client who asked me for troubleshooting advice. In each case, I’ll explain how I treated these issues.

Startup-08

Startup-09
Problem: WLIDSVC.EXE needs more time to start up.
Diagnosis/Solution: First of all, I evaluated if my client really needs the Windows Live ID Service,  which is responsible for linking a local user account to the Windows Live ID for an automatic logon. As he really did not know what it is and never used it, I decided to completely uninstall the service:

Problem solved! That actually took three seconds off the startup process. It’s not much, but a penny saved is a penny earned.  If his business depended on Windows Live, I would have used the repair option to reinstall the service or I would have looked for a newer version.

Startup-10
Problem: The Eventlog service suddenly needs more time to run.
Diagnosis/Solution:
I did absolutely nothing. It’s important to pay attention to which service is slow; explicitly check the service or file you see (“File Name”). Make sure it’s not in any way crucial to your business. Google for it, if necessary! Also, “Total Time” and “Degradation Time” are in the milliseconds – nothing to worry about.

Startup-11
Problem: Prefetching took longer than usual.
Solution: Windows 7’s optimization features (Prefetch and SuperFetch) took longer than usual to optimize performance. This may be due to a newly installed program or a program that you start much more frequently. Both may cause Windows 7 to optimize its cache for faster application launch times.
In this particular case, I didn’t see a reason to react. I noticed this event coming up every one or two weeks; that’s normal behavior for Windows 7 as it’s adapting its caching routines mentioned above.

Startup-12
Problem: The Windows Audio service causes a delay during startup.
Diagnosis/Solution: This seemed like a bigger problem. Apparently, the Windows Audio service needs more time to get started. Hmm…a problem with the sound card, maybe? My first reaction proofed to be the answer. I checked the driver version of the build-in “Realtek HD Audio” sound chip and noticed that it was last updated in September 2008. I downloaded the latest drivers from Realtek and installed it; the error never came up again!
If you see these kinds of driver related issues in your event log, I suggest updating the related driver. This IT Expert Voice article helps: “Doing the Driver Dance: Updating and Maintaining PC Drivers.”

Startup-13
Problem: MsMpEng.exe causes a noticeable boot delay.
Diagnosis/Solution: Microsoft Security Essentials (MsMpEng.exe) added a significant amount of startup time to the boot process. Obviously, disabling it was out of the question; security comes first! Reinstalling MSE did not help things. In this case, I am basically powerless and need to wait for an update that might improve the performance of MSEs antivirus engine during startup.

Startup-14
Problem: NVIDIA Driver Helper Service causes a delay in startup time.
Diagnosis/Solution:
The helper service that comes with all nVidia drivers doesn’t actually do much except maintain overclocked display settings. That ‘s something my client did not need. I immediately opened up “msconfig” and disabled the NVIDIA Driver Helper Service using the “Services” tab:
Startup-15
That took care of it.

Startup-16
Problem: Windows Live Messenger causes a boot delay.
Diagnosis/Solution:
Although the client needed Live Messenger for external business communication, he did not necessarily want it to launch right after Windows 7’s startup. I opened up “msconfig” (see above), clicked on “Startup,” and removed the entry that belongs to “msnmsgr.exe.”

You get the drift: In each individual case I decided if the startup program or service was needed and tried to patch it. If it’s not needed, I uninstalled or disabled it. Keeping all the drivers up-do-date was also essential in reducing the Warning and Critical entries found in Event Viewer.

Step-by-Step: Finding CPU Hogs

In some cases, boot delays are not detected by Event Viewer, possibly because a specific process eats up CPU for a constant period of time. Finding this bottleneck is pretty easy using the Sysinternals Process Monitor utility. Here’s how it works:

  1. Download Process Monitor. Unzip the file and open Procmon.exe with administrative privileges: Startup-17
  2. Stop Process Monitor from logging all the current events by clicking on “File/Capture Events.” Now go to “Options,” where you will find the crucial entry: “Enable Boot Logging.” Enable it, click on “Generate profiling events” and click “OK.” Startup-18
  3. Now reboot your PC. After the startup process is done, launch Process Monitor again and click on “Yes” once you see the following message: Startup-19
  4. Save the boot log wherever you want (on your desktop, for example). Process Monitor now generates a huge list of basically each and every boot event.
    Startup-20
    591,892 events?! This is too much to bear, even for the geekiest of us. Instead, let’s focus on process that use a lot of CPU usage during boot time. To do that, click on “Tools” and go to “Process Activity Summary.”
    Startup-21
    You’ll get a list of all processes that keep your PC busy. Click on “CPU” and see for yourself which is the all-time CPU hog:
    Startup-22
    To get more information of its resource usage, double-click on the entry. In our example, CPU hog number one is – yet again – Microsoft’s Security Essentials. While it is relatively lightweight when Windows 7 is up and running, it can be quite a boot hog.
    All the advice I gave above still stands: Go through the entire list and get rid of processes and programs that you don’t need. If you don’t know what is behind certain entries like this one…
    Startup-23

    …use your search engine to find and troubleshoot them.

  5. In this list you might come across a (unnecessary) process that you can’t find using any conventional means (for example, using msconfig). In that case, try out SysInternals very own Autoruns. Autoruns lists all processes and files that are used during boot up and lets you disable them individually – no exception!
  6. Startup-24

That’s it! With all the given advice you should be able to handle each and every boot delay that crosses your way. Go back to the Event Viewer to check if and how much all these steps affected raw boot time and real life boot time — I bet there’s a huge difference! On my client’s PCs I was able to cut boot times in half (or even less). A nice side effect that you should also consider: Now that you’ve gotten problematic services and processes out of the way, overall Windows responsiveness and performance probably has gotten a lot of better as well.


Want more like this? Sign up for the weekly IT Expert Voice newsletter so you don’t miss a thing!

Want more like this? Sign up for the weekly IT Expert Voice Newsletter so you don't miss a thing!

COMMENTS

  • [...] This post was mentioned on Twitter by Esther Schindler, Shane O'Neill, sjvn, Vesta Schindler, How To Projects and others. How To Projects said: What?s Taking So Long? How to Fight Slow Startup Times in Windows 7 #howto http://bit.ly/ba3wEJ [...]

  • Great guide… Thank you for taking the time to do such a complete job.

    Thanks again

  • May 26, 2010 | bob says:

    I expected some crap advice, but this was actually legit expert advice. Good job.

  • Very nice writeup! You've hit more important things but I'd hate to have you overlook my favorite Windows 7 glitch: "The Welcome screen may be displayed for 30 seconds during the logon process after you set a solid color as the desktop background in Windows 7 or in Windows Server 2008 R2."http://support.microsoft.com/kb/977346

  • May 26, 2010 | Raul says:

    Best way to improve start-up time is to install Ubuntu 10.04 LTS. Boots quick and shuts down quick.

  • Hey Bruce :) thanks, appreciate it. Actually, I already covered the 30 second logon glitch right here: http://itexpertvoice.com/home/get-rid-of-slow-log… Check it out!
    ;)

    Best, Sandro

  • [...] asking for Windows boot time… make sure they use the exact value from Event Viewer. http://itexpertvoice.com/home/what%E…-in-windows-7/ __________________ [...]

  • [...] the full article: What’s Taking So Long How to Fight Slow Startup Times in Windows 7 « IT Expert Voice Send via e-mail | Submit to Digg | Add to Live Favorites 0 [...]

  • [...] What’s Taking So Long? How to Fight Slow Startup Times in Windows 7 « IT Expert Voice. [...]

  • Jun 10, 2010 | Dennis Beatty says:

    And won't run a single Windows-application with any consistency, requires retraining for all users and support staff and is full of bugs/exploits unless protected property, just like Windows. And no one to call for support.

    I'm not seeing the upside?

  • Jun 10, 2010 | Bob says:

    msconfig is for troubleshooting so I would recommend going directly to the Services in the Administrative Tools and turning services off there.

  • Jun 10, 2010 | garyk says:

    just pointing out to watch for the boot times after installing windows updates. these will typically add time and should be ignored if doing a comparison.

  • Jun 11, 2010 | Steve says:

    If the computer is in a domain, then there are lots of other things that can disrupt and slow down the overall starup time before the users gets to their desktop.
    But thats a whole area that needs an article of its own

  • Jun 11, 2010 | Lapoki says:

    Very good guide indeed. I was expecting some run of the mill stuff which i've encountered a lot in the past but this is really good.
    Looking forward to more articles from you Sandro.

  • [...] En este artículo aprenderemos cómo detectar problemas y solucionarlos paso a paso. Son pautas ofrecidas por Sandro Vilinger de IT Expert Voice que nos guiarán para medir primero la velocidad de inicio y luego en el análisis del proceso de [...]

  • Jun 11, 2010 | Ankit says:

    Great Article. Thanks for the writeup and Bink for posting it :)

  • Jun 11, 2010 | tekystuff says:

    a small typo error in the line, "In our example, CPU hog number one is – yet again – Microsoft’s Security Essentials" —> the application is infact MCAFEE.

  • [...] Read the full article: What’s Taking So Long How to Fight Slow Startup Times in Windows 7 « IT Expert Voice [...]

  • Jun 12, 2010 | melissa says:

    these informations in Event Viewer are also present in Vista, there's nothing new in Win7.

  • the only way to see in detail what Windows is doing during boot, is to make a boot trace with the xbootmgr and analyze the trace file:

    http://www.msfn.org/board/index.php?showtopic=140…

  • Jun 13, 2010 | Gis Bun says:

    I guess the Linux zealots like to crawl out of the wordwork every once in a while. [If Linux is such a great OS, why is it that the Os has flatlined at 1.18% of the OS share?]

  • Thank's alot for this nice work !

  • [...] En este artículo aprenderemos cómo detectar problemas y solucionarlos paso a paso. Son pautas ofrecidas por Sandro Vilinger de IT Expert Voice que nos guiarán para medir primero la velocidad de inicio y luego en el análisis del proceso de [...]

  • Jun 23, 2010 | Dani says:

    I Just installed Soluto and all is done. Your guide is great but very technical and for win 7 only…

    Soluto is an awesome tool that does the job.

    Thanks!

  • Jun 27, 2010 | nailzuk says:

    bad u shouldnt use msconfig/services tab to disable a service NEVER tut

  • Jun 30, 2010 | Lance says:

    What does it mean when no isdegradation time is given? It just says True or It says False. The errors are on boot and some are warnings a few are critical. This is my pc. Win 7 -64 bit. New Emachines 1831-07

  • Jul 25, 2010 | yaron says:

    one of the best articles i read in the past year

  • Aug 23, 2010 | S. Sandra says:

    most programs when they are uninstalled from the newest win 7 leave behind registry keys which become corrupted … running a registry cleaning scan with reginout can fix the boot up time in win 7….

  • Pretty simple really: it hasn't. Linux/Unix runs plenty of server systems where serving up files and handling databases is the main purpose. You were probably referring to it's abysmal market share on desktop systems. And the reason for this is simple, too: it was designed by engineers for engineers, and as long as neither of those (heh) takes user interface design seriously, it isn't likely to get adopted widely outside of engineer circles.

    Linux really is the Caterpillar bulldozer of the automobile world. Nobody will drive one on the way to work unless they're working in construction. Some people have made efforts to make utility vehicles attractive to "ordinary" folk, for instance in the form of the Hummer. But the linux community has yet to get interested in doing something that would lead to wide adoption of their OS.

  • Oct 23, 2010 | Lena says:

    hey, my computer is starting up very very slow. i tried your guide, but there is a problem: I have about 2.097.509 events and when I go to the Process Acivity Summary there are 51 events. Many of them are svchost.exe. I don't get if I am allowed to deinstall or remove them. What shall I do? On my startup at msconfig there are just two programs. Please help me to make the boot faster!

  • well. i fixed my laggy win7 boot with a brand new SSD disk.. from 3 minute boot time down to 45sec.
    best buy ever…!

DELL
FM IT Expert Voice is a partnership between Dell and Federated Media. Privacy Statement