Diagnose user logon issues
Use Logon Duration data to troubleshoot user logon issues.
Logon duration is measured only for initial connections to a desktop or app using HDX. This data does not include users trying to connect with Remote Desktop Protocol or reconnect from disconnected sessions. Specifically, logon duration is not measured when a user initially connects using a non-HDX protocol and reconnects using HDX.
In the User Details view, the duration is displayed as a number value below which the time the logon occurred is displayed and a graph of the phases of the logon process.
As users logon to Citrix Virtual Apps and Desktops, the Monitor Service tracks the phases of the logon process from the time the user connects from Citrix Receiver to the time when the desktop is ready to use.
Logon duration is measured for HDX sessions only. This data does not include users trying to reconnect from disconnected sessions. Specifically, logon duration is not measured when a user initially connected via a non-HDX protocol reconnects via HDX.
The large number on the left is the total logon time and is calculated by combining the time spent establishing the connection and obtaining a desktop from the Delivery Controller with the time spent to authenticate and logon to a virtual desktop. The duration information is presented in seconds (or fractions of seconds) in the local time of the Administrator’s web browser.
Note: To see the logon duration data in Director in XenApp and XenDesktop Sites 7.15 and earlier, disable the GPO setting, Do not process the legacy run list.
Use these general steps to troubleshoot user logon issues:
- From the User Details view, troubleshoot the logon state using the Logon Duration panel.
- If the user is logging on, the view reflects the process of logging on.
- If the user is currently logged on, the Logon Duration panel displays the time it took for the user to log on to the current session.
- Examine the phases of the logon process.
Logon process phases
- Brokering: Time taken to decide which desktop to assign to the user.
- VM start: If the session required a machine start, this is the time taken to start the virtual machine.
- HDX connection: Time taken to complete the steps required in setting up the HDX connection from the client to the virtual machine.
- Authentication: Time taken to complete authentication to the remote session.
- GPOs: If Group Policy settings are enabled on the virtual machines, this is the time taken to apply group policy objects during logon. The drill-down of the time taken to apply each policy as per the CSEs (Clients-Side Extension) is available as a tooltip when you hover on the GPO bar. Click Detailed Drilldown to see a table with the policy status, and the corresponding GPO name. The time durations in the drilldown represent the CSE processing time only and do not add up to the total GPO time. You can copy the drill-down table for further troubleshooting or use in reports. The GPO time for the policies is retrieved from Event Viewer logs. The logs can get overwritten depending on the memory allocated for the operational logs (default size is 4 MB). For more information about increasing the log size for the operational logs, see Configuring the Event Logs.
- Login scripts: If logon scripts are configured for the session, this is the time taken for the logon scripts to be executed.
- Profile load: If profile settings are configured for the user or the virtual machine, this is the time taken for the profile to load.
Interactive Session: This is the time taken to “hand off” keyboard and mouse control to the user after the user profile has been loaded. It is normally the longest duration out of all the phases of the logon process and is calculated as Interactive Session duration = Desktop Ready Event Timestamp (EventId 1000 on VDA) - User Profile Loaded Event Timestamp (EventId 2 on VDA). Interactive Session has three subphases: Pre-userinit, Userinit, and Shell. Hovering over Interactive Session displays a tooltip showing the subphases, the time taken for each subphase, the total cumulative time delay between these subphases, and a link to the documentation. To view the time duration of each subphase, enable Audit process tracking on the VM (VDA). When the Audit process tracking is disabled (default), the time duration of Pre-userinit and the combined time duration of Userinit and Shell are displayed. You can enable Audit process tracking through a Group Policy Object (GPO) as follows:
- Create a new GPO and edit it using the GPO editor.
- Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.
- On the right pane, double-click Audit process tracking.
- Select Success and click Ok.
- Apply this GPO to the required VDAs or Group.
For more information about Audit process tracking and enabling or disabling it, see Audit process tracking in the Microsoft documentation. Logon Duration panel in the User Details view.
- Interactive Session – Pre-userinit: This is the segment of Interactive Session which overlaps with Group Policy Objects and scripts. This subphase can be reduced by optimizing the GPOs and scripts.
- Interactive Session – Userinit: When a user logs on to a Windows machine, Winlogon runs userinit.exe. Userinit.exe runs logon scripts, re-establishes network connections, and then starts Explorer.exe, the Windows user interface. This subphase of Interactive Session represents the duration between the start of Userinit.exe to the start of the user interface for the virtual desktop or application.
- Interactive Session – Shell: In the previous phase, Userinit starts the initialization of Windows user interface. The Shell subphase captures the duration between the initialization of the user interface to the time user receives keyboard and mouse control.
- Delay: This is the cumulative time delay between the Pre-userinit and Userinit subphases and the Userinit and Shell subphases.
The total logon time is not an exact sum of these phases. For example, some phases occur in parallel, and in some phases, additional processing occurs that can result in a longer logon duration than the sum. The total logon time does not include the ICA idle time that is the time between the ICA file download and the ICA file launch for an application. To enable the automatic opening of ICA file upon application launch, configure your browser for automatic ICA file launch upon download of an ICA file. For more information, see CTX804493.
Note: The Logon Duration graph shows the logon phases in seconds. Any duration values below one second are displayed as sub-second values. The values above one second are rounded to the nearest 0.5 second. The graph has been designed to show the highest y-axis value as 200 seconds. Any value greater than 200 seconds is shown with the actual value displayed above the bar.
To identify unusual or unexpected values in the graph, compare the amount of time taken in each phase of the current session with the average duration for this user for the last seven days, and the average duration for all users in this Delivery Group for the last seven days.
Escalate as needed. For example, if the VM startup is slow, the issue might be in the hypervisor, so you can escalate it to the hypervisor administrator. Or, if the brokering time is slow, you can escalate the issue to the Site administrator to check the load balancing on the Delivery Controller.
Examine unusual differences, including:
- Missing (current) logon bars
- Major discrepancy between the current duration and this user’s average duration. Causes include:
- A new application was installed.
- An operating system update occurred.
- Configuration changes were made.
- Profile size of the user is high. In this case, the Profile Load will be high.
- Major discrepancy between the user’s logon numbers (current and average duration) and the Delivery Group average duration.
If needed, click Restart to observe the user’s logon process to troubleshoot issues, such as VM Start or Brokering.