Windows Explored

Everyday Windows Desktop Support, Advanced Troubleshooting & Other OS Tidbits

Posts Tagged ‘Performance’

Random Workstation Hangs

Posted by William Diaz on April 26, 2013

A user recently complained to me of application hangs. After pressing her, it turns out the entire workstation was hanging randomly and after some time would return to normal. I often refer to these as “soft hangs”, a hang in which the workstation-OS eventually recovers from (opposite a “hard hang” in which the system has halted and needs to be restarted with manual “button-intervention”). Often, this is caused by an excessively large disk queue that needs to be handled or a processor hog. Looking at the Windows Event Viewer under the System logs, I noticed an error on the primary storage device. I sorted the logs by the Source and could see that this had been happening practically everyday. The error was reported as “The device, \Device\Ide\iaStor0\, did not respond within the timeout period.” with an Event ID of 9 and source of iaStor:


Furthermore, she had complained of the issue before with her previous workstation before it was swapped out for the current one so I also decided to look at her previous workstation and noted the same daily errors. Both workstations were of the same model. With that, I decided to setup Event Forwarding for this error and saw that ALL workstations of the same model were reporting the this error. Some quick research pointed me to a known issues with the Intel Array Storage Technology (aka Rapid Storage) and SSDs that do not support one of its features known as Link Power Management.

To resolve

  1. Go to HKLM\System\CurrentControlSet\Services\iaStor\Parameters\Portn, where n=the hard disk (often Port0 for the primary storage). If the key Portn does not exist, create it*.
  2. Create the following DWORDS with a value of 0: LPM, LPMDSTATE, DIPM.

Since we have hundreds of these, a group policy preference was used to target the PC model hard drives affected (via wmi query) and push the reg hack firm wide. Afterward applying, the errors went away.

*The existence of the Portn key depends on the driver version of the Intel Array Storage driver. Version 10 and higher does not require the existence of the keys and values to enable LPM, only to disable.

Posted in Troubleshooting | Tagged: | Leave a Comment »

A Perfmon View of Bad Blocks

Posted by William Diaz on March 6, 2013

In the past week or so a couple workstations were brought to my attention in different offices that were exhibiting poor performance. Suspicious of disk bottlenecks, I remotely connected perfmon physical disk counters to both and saw a excessive time spent writing to the disk and the current disk queue length spiking when the workstations were logged on but idle. Here is a snapshot of both PCs:



Looking at the System event logs revealed numerous Errors with Source as disk and Event ID 7, otherwise known as bad blocks. On one of the problem workstations the print spooler kept on shutting down after starting it. If system files or program critical files are resident across these bad blocks on the disk, performance issues or otherwise abnormal behavior is bound to ensue. Run a Chkdsk to attempt to resolve.

Posted in Troubleshooting Tools | Tagged: | Leave a Comment »

Windows 7 Black Screen and Mouse Cursor After Logon

Posted by William Diaz on November 6, 2012

We started to see a rash of complaints from users who were encountering a black screen after logging onto their Windows 7 workstations. Except for the mouse cursor nothing else was functional, even the Task Manager couldn’t be started.


Most often this was encountered at the first logon of the day after the workstation has been logged out of the previous day and then left idle for several hours. Recovery required that a hard reboot was performed, and afterwards the user could logon normally. I actually encountered this a few times on one of my test workstations and a review of the event logs reveals the following warning message: “The wnlogon notification subscriber < GPClient > is taking too long to handle the event notification event (StartShell).”


I’m assuming the StartShell is explorer.exe. In a couple cases, if I let it sit long enough, the desktop might load or the TM would launch, but the overall experience was plagued by various performance issues and errors. A corresponding event follows after 10 minutes: “The winlogon notification subscriber < GPClient > took 600 second(s) to handle the norification event (StartShell).”


A brief email to our Microsoft PFE was answered with possible hotfix described here: Results since applying to affected user workstations seems to be promising.

If this doesn’t apply to you, there is also a Mark Russinovich blog on a similar issue he was encountering due to inaccessible mapped drives.

And, finally, another MS Hotfix-KB that you may also want to take examine:

Posted in Troubleshooting | Tagged: | Leave a Comment »

Troubleshooting Excessive Interrupts & DPCs

Posted by William Diaz on May 14, 2012

After logging onto my main home PC and opening IE, I noticed lag while repositioning the window around the screen. I opened the Task Manager, sorted by the CPU column and saw no single process reporting excessive usage:
Nor was the hard disk light blinking or solid. However, looking at the Performance tab revealed two of the CPU cores hovering around 100%:

Read the rest of this entry »

Posted in Troubleshooting, Troubleshooting Tools | Tagged: | Leave a Comment »

Citrix Receiver Excessive Registry Polling?

Posted by William Diaz on April 4, 2012

While running Process Monitor on my primary workstation, I noticed repetitive registry operations coming from Citrix Receiver application on the same keys:
How repetitive? 13,000+ registry operations per minute on my idle workstation with no active Citrix connections:
This applies to the Windows 7 client. I don’t see the same activity for the Windows XP client.

I recalled a reading in the Windows Internals 5th Edition:

“Because the registry implements the RegNotifyChangeKey function that applications can use to request notification of registry changes without polling for them, when you launch Process Monitor on a system that’s idle you should not see repetitive accesses to the same registry keys or values. Any such activity identifies a poorly written application that unnecessarily affects a system’s overall performance.”

I don’t know the internals of the Receiver application, but this leaves me wondering if there is some room for improvement by implementing RegNotifyChangeKey to make it less “noisy”.

Posted in Uncategorized | Tagged: , | Leave a Comment »

SSDs, Windows 7 & Lackluster Boot Performance

Posted by William Diaz on March 2, 2012

I came across a Technet blog recently that described an issue where boot performance on newly imaged workstations with Windows 7 and Solid State Drives was inhibited because the Windows System Assessment Tool was disabled in the image. As a result, WinSAT did not detect the presence of the SSD and treated the drive as a normal hard disk (one with platters). This turned out being a big find because our future Windows 7 also had WinSAT disabled. Read about it here: Windows 7, Solid State Drives and Why A WinSAT Score Matters.

Posted in Inside Windows | Tagged: , | Leave a Comment »

What Does File Contention Look Like?

Posted by William Diaz on December 20, 2011

Every now and then someone calls in and complains about terrible performance. Often times, the tech handling the call will try to recover performance by killing CPU intensive processes or closing unused applications1, especially those with large memory footprints2. More often than not, though, the issue can be described as file contention, a condition where performance is “penalized” because the disk cannot keep up with file IO demand.

In the example here, an unexpected virus scan kicks off in the background (these are usually scheduled to run after hours), and examining the two most common aspects of system activity, processor and memory, the workstation is well within the envelop of what is considered acceptable and the technician is left scratching his head as he tries to gauge why the system is so slow even though memory usage is minimal and CPU usage averages about 15%. I advise him to start Performance Monitor (perfmon) and connect some remote performance counters, mainly disk counters like read and write time, but most importantly average and current disk queue length:
Read the rest of this entry »

Posted in Uncategorized | Tagged: , | Leave a Comment »

Exploring Video-Graphics Performance – Event IDs 500 and 501

Posted by William Diaz on December 8, 2011

If you had a chance to review the Diagnostics-Performance logs, you may have encountered warning events coming from event ID 500 “The Desktop Window Manager is experiencing heavy resource contention. Video memory resources are over-utilized and there is thrashing happening as a result…” or 501 “…Graphics subsystem resources are over-utilized.”
Read the rest of this entry »

Posted in Inside Windows, Troubleshooting Tools | Tagged: , | 2 Comments »

Isolating Disk Activity To A Process

Posted by William Diaz on September 21, 2011

The other night I noticed the hard drive light on my laptop was solid for several minutes, indicating some fairly aggressive disk file IO. There were no open applications and I didn’t have any scheduled services running, not even the Windows 7 defrag (yeah, I still like to do everything manually). I also had a virtual Windows XP machine running inside Windows 7 but there were no open applications there, either. A knee-jerk reaction of mine when I see this is to open the Task Manager and look for any processes that are using an excessive amount of CPU time, but there were none, and the system remained mostly idle with respect to the CPU counter in both Windows 7 and the virtual machine it was hosting.

To see what was causing the unknown disk IO, I started by adding a few more columns to the Windows 7 Task manager: I/O Read, I/O Writes, I/O Read Bytes, and I/O Write Bytes. I sorted the columns by both read bytes and write bytes and the process using the most disk IO was the vpc.exe process, the Virtual PC:
Read the rest of this entry »

Posted in Inside Windows | Tagged: , | 1 Comment »

Examining Windows 7 Boot Performance

Posted by William Diaz on September 7, 2011

Boot performance in Windows Vista and 7 has become such a focus that a whole area of the Event Viewer is dedicated to it. Here, you can investigate boot metrics and troubleshoot causes of slow boot up times. You can find these events under Diagnostics-Performance by going to Event Viewer > Applications and Service Logs (this part of the tree will take a few seconds to expand) > Microsoft > Windows. Read the rest of this entry »

Posted in Inside Windows, Troubleshooting, Troubleshooting Tools | Tagged: | 1 Comment »