Slow Boot Times

Hello david,

haven't seen this and can't say what could be the cause. If you wait, say, 5 minutes before pressing Ctrl-Alt-Del - do you encounter the same delays afterwards?

Christian

We're experiencing something pretty similar since we reimaged most of our PCs with Windows 7. This happens very intermittently, but after a successful login, users have expereinced drives not mapping for 2-5 minutes, IE, browsing their computer, oropening documents not responding, and explorer crashing. If the leave their PCs along for a few minutes after login, everything works fine. 

I've opened a case with Microsoft, and the first thing they did was disable all non-Microsoft startup programs and services in MSCONFIG. I've slowly re-enabled services and programs, and it seems like it's either the auto-update program/service or the Antivirus service that are causing this. With these disabled from startup, everything works very smoothly.

Microsoft also told me that they just worked with another customer that had this same issue. That's not really what I wanted to hear... I can't say I want to disable autoupdate and the antivirus services at startup.

HI,

Are you running 10.2?  If not can you try that, does it help?

Also of note, have you tried setting for example setting:

32-bit machines

[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate]

"StartupDelay"=dword:00000258

64bit machines

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Sophos\AutoUpdate]

"StartupDelay"=dword:00000258

With this set, the alupdate.exe Process would kick off 10 minutes (600 seconds) after the Sophos AutoUpdate service starts?

You can imagine that the computer starts up, SAV has the previous virus data it had before, so starts building up a cache of clean files as the computer starts.  5 minutes later, by default, SAV updates, this refreshes the cache (as it can't assume anything is clean based on new data) and it has to scan again all the files it previously scanned as they are touched.  If you couple this with the actual update taking place, startup is a busy time.  Does delaying the initial update slighly make any improvement, also with 10.2?

Regards,

Jak

Good morning,

I have around 70 computers running sophos Endpoint protection base on Cloud and after the last updates all computers stayed very slow.

The process SavService.exe take more than 300MB of RAM of our computers.

I have tested disabled real-time scanning and the situation stayed betther, but we need this featur to protect our devices.

Hello,

your question is about the Endpoint software so this forum is "correct".
The Central managed Endpoint versions (and components) differ slightly from the (on-premise managed) ESC ones and your particular issue, as you've said after the last updates, might be version-specific. You should perhaps post in the Central forum.

300MB is a little bit too high, is this only more or less shortly after boot or does it stay at this level? But anyway the slightly exaggerated memory usage shouldn't cause significant delays (unless your machines - which Windows version, BTW?) are memory-constrained. Did you try to delay AutoUpdate?

Christian

Thank you for your reply Christian.

All most of machines are HP Elite Desk 800 g1 with 8GB of RAM with Corei5 running Windows 10 with the last updates.

It is really strange because after the last updates of Windows (Windows Creatores) the computers staied very slow.

Thank you

Ricardo

One thing you could do that is quick is to capture a Process Monitor - docs.microsoft.com/.../procmon log of boot.

Once captured, filter down to: "Duration" more than "0.1"and just file operations.

Do any files stand out that you could try excluding from on-access scanning?

Otherwise, it might be worth disabling (one by one) the features under the Runtime Protection section of the Threat Protection policy.

Regards,

Jak