Discussion on:

Use Windows 7 Event Viewer to track down issues that cause slower boot times

Has the boot time of your PC grown inexplicably lately? Have you used Windows 7's Event Viewer to investigate boot problems? Have you encountered other Event IDs in the 101 to 110 range that I didn't describe? If so, what were they?

Regularly cleaning the registry with a registry cleaner ( Glary, for one ) will substantially help. Stopping all programs (that windows doesn't need to boot)in the auto run folder ( if you have a registry cleaner other than Glary like RFA 32 bit) will also help.

Hello,

My system takes somewhere close to 5 min before it is usable. I see no errors or events in my logs after 2/22/10. I do have several things disabled one being the Diagnosis scheduled task. Anyone know if that task creates these log entries? It was disabled to fix the issue with network shortcut icons being deleted when it ran.

...not sure why the logs wouldn't have recorded activity, but pretty sure that Diagnosis scheduled task doesn't have anything to do with it.

Since you provide no detail, I have to ask the obvoious: Are you sure that you are looking at the correct logs?

There are entries until 2/10 so I assume I'm in the right place. I've compared to another recently setup system and haven't found a difference in startup programs/services but it has the entries. Any idea what service/app is collecting the data for this log? Just the Windows event log service?

... make sure that the Diagnostic Policy Service is set to Automatic and reboot your system.

The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function.

My Win 7 x64 machine will not go to sleep automatically and sometimes will not wake up again - I have to do a hard reset to bring it back. Are there particular event logs I can check to look for the source of these issues?

An excellent article Greg,
I have encountered 107 - giving typical degredations of 1 second and associated with the MachinePolicyApplication and also 108 with delays of between 1 and 3 seconds associated with the PreShellInit
GT (RACD)
Retired from Active Computer Diagnostics

This and the prevous article are excellent. Thanks for the information and clarity of explanation.

I found this article very interesting as I was having longer than usual boot times. When I opened the Custom View Boot Time I was alarmed to see most of my event levels were "Critical" as opposed to the "Error" level discussed. All of these "Critical" level indicated IsDegradation: "false". I would have been interested if this issue had been covered in the article.

Excellent article, I learned a lot. Thank you.

I have a question about event ID 101. I have a svchost that had 25995ms degradation. How can I identify which svchost this is?

Even if you ultimiately deinstall it, you will learn a lot about your boot sequences and potential culprits.

Based on the Boot Time view, it looks like my average boot time for 64-bit Win7 Ultimate is about 2 minutes, and has been so from the get-go. Based on Boot Degradation view, there are occasional 101 or 102 events, but they don't occur daily, the associated application or driver varies, and the associated delays are fairly insignificant. That being the case, what other events might reveal sources of boot delay? Also, for Boot Time view, many of the 100 events have Critical level -- where are the details that explain that categorization.

Is all the information above true in case of Server too? I mean, can I use the same EventIDs to depict the Events on Server also? May be on Server 2008 or Server 2008 R2 ? Please post back..!

Hi This is what I encountered:
Event Id-107
Application of machine policy caused a slow down in the system start up process:
Name : MachinePolicyApplication
Total Time : 1581ms
Degradation Time : 1036ms

Event Id-108

Application of user policy caused a slow down in the system start up process:
Name : PreShellInit
Total Time : 8535ms
Degradation Time : 4535ms

Event Id-110

Session manager initialization caused a slow down in the startup process:
Name : SMSSInit
Total Time : 17341ms
Degradation Time : 9192ms

Very good article and very insightful for conducting troubleshooting on slow booting systems. Too bad you didn't have the space to cover all of the Event ID's (I personally have some "110"s and Google hasn't been much help so far in tracking down the information similar to what you provide in this article on the Event IDs you do address (I'm finding all kinds of sites that cover "110", but most of them address specific apps rather than "boot degradation").
Thank you for sharing you knowledge through your articles.

OK - done that - see the values -- so what do I do now?
I cant see any hint of what program is actually slowing things down.

Super great article Greg but after running my degradation stats I end up with 222. Does this mean I should reload the system or just start weeding through them one at a time?

Hey Greg?thanks for sharing these tips on Windows Event Viewer. This is a great way to investigate what is causing slow boot up time. I?m curious, once you found out why your friend?s boot process slowed down, what did you do to solve the problem?

This is helpful, thanks for taking the time, Im adding it to my knowledge base

Decided this weekend to find out what (occasionally) causes my system to take 5-7 minutes to boot up. Thanks to your article, I found a driver taking 304K ms to initialize - for a program I no longer use.

now how to solve the issues ... ?
i got
event id 100 items 240
event id 101 items 61
event id 102 items 25
event id 103 items 40
event id 106 items 1
event id 107 items 2
event id 108 items 5
event id 110 items 4