Boot and logon duration


Boot and logon duration


The startup time of a device has a direct impact on the productivity and the experience of end-users. Since the first activities that a user performs on a device are to power it on and to log on, users typically have a very negative perception of devices that take too long to start. Indeed, a long boot or logon process are often a symptom of other underlying problems in a device, such as disk failures, network issues, low memory, or general obsolescence. Nexthink provides the following measurements of the boot and logon duration of a device:

Boot duration
After powering on the device, the boot duration is the time between the start of the OS kernel and the launch of the logon screen.
Logon duration
The time between user authentication and the desktop being shown.
Extended logon duration
The time between user authentication and the device being ready.

Because of the techniques employed in the measurement of boot and logon duration, these values apply to Windows devices only.

Applies to platforms: PlatformWindows.png

Measurement of the boot duration

The measurement of the boot duration begins when the kernel of the operating system loads the Collector driver during its initialization. Once up and running, the Collector notifies the boot of the device and then continuously reports the time elapsed since the kernel started (the system boot, as recorded by the operating system) to the Engine. Any steps in the boot sequence previous to the start of the kernel, such as the BIOS hardware checks and the loading of the kernel itself, are therefore not included in the boot duration. The Engine establishes the absolute boot time of the device according to this information.

In addition to the boot time, the Engine needs to know when the operating system launches the logon screen to compute the boot duration. The launch of the logon screen corresponds to the execution of the system process logonUI.exe. Since the Collector successively informs the Engine of the processes being executed in the device, the Engine just needs to wait for the Collector to detect the launch of logonUI.exe. The Engine records the interval between the boot time and the start of logonUI.exe as the boot duration.

Note that Nexthink records boot events only for full boot sequences. Waking up the device after being in a standby (sleep) or a hibernation state is not considered a device boot. Moreover, the boot technique known as Fast Startup in Windows 8 (and higher) is not a full boot sequence either; therefore, it is not recorded as such.

Boot duration
Start Stop
  • System boot
    (as recorded by the OS)
  • Start of logon screen
    (launch of logonUI.exe)

Measurement of the logon and extended logon durations

The moment when the user finishes authenticating, either by typing in their credentials or by any other identification means, marks the start of the logon process. The Collector has two ways to detect the start of the logon process:

  • Look in the Security log for an audit logon event.
  • Wait for a session creation event.

The preferred method for the Collector to detect a user logon is to look for audit logon events in the Security log of Windows. For the Security log to include logon information, it is necessary that the system administrator activates the corresponding audit policy option. The logon time detected by the Collector in this case matches thus the time recorded by Windows.

Nevertheless, if the audit policy on the device does not include the audit of logon events, the Collector defaults to detecting user logons by listening to session creation events. Capturing the moment of creation of a session is usually a precise method to determine the time of a user logon. However, in setups with roaming user profiles, using this method could yield logon durations that are much shorter than the actual logon duration experienced by users. To avoid sending inaccurate information, if the audit of logon events is not enabled, the Collector does not report the logon duration of users with roaming profiles. For more information on roaming user profiles, see the next section.

Both the logon and the extended logon durations take the start of the logon process as the beginning of their measurement, but they differ from each other in their ending point:

  • The appearance of the desktop marks the end of the logon duration.
  • After the desktop is shown, the readiness of the device to being used marks the end of the extended logon duration. The device is considered to be ready to use when the operating system frees enough resources so that the device becomes responsive again to the commands of the user. Depending on the type of device, the resource consumption for considering the device to be ready is as follows:
    • Desktops and laptops: the CPU usage drops below 15% and the disk usage below 80%.
    • Servers: the CPU usage of all the processes that belong to the logged on user drops below 15%.

If the consumption of resources in the device is still higher than required 25 minutes after user authentication, the Collector stops waiting and reports the logon duration as 25 minutes.

Logon duration
Start Stop
  • User authentication
  • Desktop is shown
  • Device is ready to use
Start Continue Stop
Extended logon duration

Logon duration in devices with roaming user profiles

A roaming user profile is a concept in Windows that allows users to have a consistent desktop experience across different computers within the same network. Independently of the computer that they choose to work with, the users have access to their personal documents, the applications remember their preferences and the desktop appearance remains the same. In this section, learn how roaming user profiles may impact the measurement of the logon duration.

When roaming users log on a device, the loading of their profile can take a substantial part of the logon time. However, the new session starts only after the profile is completely loaded. If the Collector just waited for the session creation event to compute the logon duration, it would ignore the time spent to load the user profile as part of the logon duration. Because of this omission, the Collector would report much smaller logon durations than the actual values for the logon duration of roaming users. Therefore, the Collector never uses this method for computing the logon duration of roaming users.

The alternative is to get logon information from the Security log of Windows. Logon events in the Security log always report the correct logon time. For this reason, auditing logon events is the preferred method for the Collector to compute the logon duration of all kinds of users and it is mandatory for roaming users. For devices with roaming user profiles, remember to always activate the audit of logon events. Failing to do so results in the Collector not reporting the logon duration of users with roaming profiles.

Related tasks