Skip to main content
Start a Conversation

Unsolved

2

212some212

2 Posts

10198

February 25th, 2019 07:00

Latitude 7490 - Extremely long bootup to Windows 10

Hi All.

I have a Latitude 7490 that appears to have a strange boot issue, that I am fully out of ideas on.

When the laptop is restarted from Windows, the system will take up to an hour to boot (stuck at the 2nd Dell logo). When eventually Windows does get to the login screen, multiple services have not started.

If I then Shutdown, wait a moment or two and then power back on, the system will boot very quickly and all services start like nothing is wrong.

From the event logs it looks like Shutdown is actually sleeping, which makes this even more perplexing.

Changing the power option to shutdown and not sleep, slows the boot process down again.

I have noticed when it does go wrong the first service error is always 7023 - 'The NCBservice service terminated with the following error: A device attached to the system is not functioning'. What this device is, I have no idea.

The BIOS is up to date (1.8.0 factory settings) along with all updated drivers to Feb 2019.

Does anyone have any more ideas?

Many thanks

JOcean

9 Legend

 • 

12.2K Posts

February 25th, 2019 08:00

212some212

2 Posts

March 1st, 2019 06:00

Thank you replying JOcean.

Disabling the NCBservice, just moved the first service error to the NSI service.

 

mehgriff

1 Message

April 30th, 2019 06:00

Hi, Did you ever get a resolution to this issue? I am seeing identical symptoms on a few Latitude E5440s. Tried boot safe mode minimal services and this made no difference - still takes 40 minutes boot up with various auto start services not started.

RJ1983

2 Posts

May 7th, 2019 05:00

I have also seen this happening recently on a number of machines (7490/7480/E7470)

The symptoms i have seen and some background:

  • Black screen after the Dell logo (bios/diag screen), usually the mouse cursor starts working but not keyboard input
  • It sits on this screen for 5-30+ mins
  • Multiple automatic services stopped (including netlogon, workstation, etc)
  • Multiple devices showing issues in device manager (different across models but usually wifi, smartcard and usb related)
  • Seems to effect users who use VPN (Pulse Secure) who work onsite and at home
  • typing to search within the start menu doesn't work without loading up "C:\Windows\System32\ctfmon.exe"
  • Our machines are built via SCCM on a W10 64bit image (1809)
  • Happened across multiple users and multiple machines
  • Full virus scan and malware scan done with no issues
  • I have seen a fresh built laptop develop the issue within 5 days of imaging, others had been in use for months before the issue occured.

I have a feeling it is a windows update that is causing the issue, roll back will fix some of the issue and speed up the boot but i haven't seen the same updates each time.

I am actively looking into this issue as we speak if i find anything i will post it here.

dcecs

1 Message

May 8th, 2019 09:00

Am experiencing the same issue on a Vostro 5370 - be grateful if anyone finds a solution if they could share here!

jwkuipers

3 Posts

May 8th, 2019 18:00

Hi all, 

I have been experiencing this at my work environment, we have around 20 machines total, with new ones every day. Any help would be appreciated. 

sbriss

6 Posts

May 9th, 2019 05:00

We have about 40 latitude desktops experiencing this. 

So far it looks like laptops with DirectAccess on them and Windows 10 1809 are affected.

During bootup the Dell logo appears then goes to a totally black screen until it brings up the login screen which varies from 5-20 minutes.  I found that uninstalling the Intel graphics display from Device Manager and rebooting, instead of the screen going totally black it continues to show the white spinning circle until login.

Re-imaging the machines fixes it but I suspect the problem will resurface again.  

It may be coincidence but I have not seen any laptops affected that were upgraded from earlier version of windows 10.

 

I also think its related to an updated but I think it is an update in combination with something else.

bongo-1976

1 Message

May 10th, 2019 01:00

Check the filesize of c:\windows\ServiceProfiles\LocalService\ntuser.dat

 

If the file is bigger than 20MB... then you can:

1. rename while booting through a boot usb or similar -> reboot

2. check in regedit under path: HKey_Users\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings delete and recreate the mappings key (which can contain a lot of bad entries)

 

If this is the issue… we still have to find out why….

sbriss

6 Posts

May 10th, 2019 05:00

Just deleting the Mapping key which was huge and rebooting fixed it.  The NTUSER.DAT under C:\Windows\ServiceProfiles\LocalService\ on this one laptop I looked at is over 300mb, I haven't removed it yet but after removing the Mapping key fixed it.

 

Do we know what creates those entries?

jwkuipers

3 Posts

May 10th, 2019 12:00

Well one of the machines I just checked has a ntuser.dat of almost 400mb.  Going to try this soon, need to decrypt the drive first. 

Bongo, what led you to look here?

jwkuipers

3 Posts

May 10th, 2019 13:00

So, being impatient I tried just removing the and recreating mappings key in the registry as it had worked for sbriss. It "fixed" the 3 machines I have tried it on. Going to also remove the ntuser.dat file next.

What would cause the bloat in ntuser.dat? Looking to understand how this happened so we can prevent it in the future.

 

sbriss

6 Posts

May 14th, 2019 06:00

We opened a MS Premier case to hopefully get some answers, I will update if they come back with anything.

 

I also came across https://www.reddit.com/r/sysadmin/comments/bmh6do/dell_1809_black_screen_after_startup/

AWH1975

1 Message

May 20th, 2019 06:00

Are there any updates on this please? 

We have a 350 user site having this issue on about 3% of users laptops.  Give them a new imaged Dell 7490 or HP Elitebook 840 G5 and only works for 2 weeks at max 3 weeks and then they are broke again. C:\Windows\Serviceprofiles\localservice\NTUSER.DAT will be 400mb or larger and the laptop will take over 10 minutes to start.  Get the branding logo on boot and then just a black screen for over 10 minutes.  Looking in event logs you can see nsi and then multiple other services failing to start.  Once it finally boots Network, Video, Sound all broken.

Have followed other articles and booted from win 10 media and renamed the localservice folder to localservice.old.  The Laptops will then boot again quickly but wireless still doesn't work.  It states it connects but does not get internet access.

Trying to find a tool that would show what part of the ntuser.dat file is being filled so quickly to help diagnose what is the root cause.

sbriss

6 Posts

May 29th, 2019 13:00

Atleast with our case, Microsoft has acknowledged its a known issue and is expecting to release a patch on the 3rd week of July. 

The issue is related to the Autodiscovery of a web proxy. Per the MS rep: "We suspected that the bloat in registry is possibly caused by multiple execution of the PAC files which are creating bloat in registry." 

They recommend deleting HKey_Users\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings as a workaround for now.

Koobah84

2 Posts

June 26th, 2019 08:00

I'm a little late to the party. I've been following this thread along with a few others related to this Windows Bug. After several weeks of troubleshooting & trial\error, we have done the following to get around this issue....
As mentioned above, you can delete the mappings in the registry, but if you do that it can "lock up" the machine, so this isn't a good alternative.You can also rename ntuser.dat, but this is a system file that's in use so I had a difficult time getting around this, but finally came across a solution and thought I'd share.
 
  1. Create a new group policy.
  2. Edit the policy and navigate to "Computer Configuration --> Preferences --> Windows Settings --> Registry"
  3. Create a new registry to this path: "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Session Manager"
  4. The key name is "PendingFileRenameOperations" REG_MULTI_SZ
  5. The value is "\??\C:\windows\ServiceProfiles\LocalService\NTUSER.DAT" (No quotes)Then you have to enter a 2nd line value that's blank. However, by default it removes empty lines so after you create this group policy, I'll tell you how to get around this.
  6. Next go into the Option and select Item-level targeting:The target is the ntuser.dat file and to check to see if it is larger than the default size of 256 KB. Unfortunately, there is no way to do this, so I had to create a custom WMI query for this.
  7. Select the WMI Query target option
  8. This is the Query:select filesize from cim_datafile where (name='C:\\windows\\ServiceProfiles\\LocalService\\NTUSER.DAT') AND (FileSize > '262143')Namespace is Root\cimv2
  9. Now click ok to create this new registry and you can close out of GP manager.
  10. Navigate to your domain policies this is usually in the sysvol\policies folder\\domain.com\sysvol\domain\policiesOR "C:\windows\SYSVOL\domain\Policies"
  11. Categorize the policies in descending order by Date modified. The one on the very top SHOULD be the new policy we just created. Navigate into it then go into Machine --> Preferences --> Registry
  12. Right click the XML file and edit it in a text editor
  13. Look for a line that looks like this: \??\C:\windows\ServiceProfiles\LocalService\NTUSER.DAT
  14. Below that, add:
  15. The "meat" of the syntax will look similar to this.
  
    
	
     \??\C:\windows\ServiceProfiles\LocalService\NTUSER.DAT
The way that this works is it checks the size and the group policy writes a registry value to basically delete the "corrupt" ntuser.dat file. After running a gpupdate /force on the client machine, you will need to reboot for the changes to occur,
You can test this by going into the "C:\windows\ServiceProfiles\LocalService" path on the client machine and see if the ntuser.dat file has been fixed.
I hope you all find this helpful! This issue was causing us a HUGE headache because it was also screwing up with several drivers on our laptops. After this small fix, the drivers all corrected themselves and everything seems to be functioning properly.


Another option is that I wrote a simple powershell script that checks the size of the ntuser.dat file and if it exceeds 256KB it writes a special registry value that will delete and recreate the ntuser.dat file on next restart.

Here is the powershell script
#Clear Screen
cls

$file = "C:\windows\ServiceProfiles\LocalService\NTUSER.DAT"

#If the file is bigger than 256KB (256KB)
If(((Get-Item $file).length/1KB) -gt 256)
{
    #Delete the corrupt file (we run a special reg fix for this.)
    reg import ".\del-File.reg"
}
else
{
    #Don't do anything
}
And here is the reg file:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"=hex(7):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\
  77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,53,00,65,00,72,00,76,00,69,\
  00,63,00,65,00,50,00,72,00,6f,00,66,00,69,00,6c,00,65,00,73,00,5c,00,4c,00,\
  6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,5c,00,4e,\
  00,54,00,55,00,53,00,45,00,52,00,2e,00,44,00,41,00,54,00,00,00,00,00,00,00

I hope some find this helpful!

View More

View All

No Events found!

Top