AD consoles freezing for 10 seconds

David Trevor 291 Reputation points
2021-09-30T15:28:02.74+00:00

We have two Domain Controllers. On (only one) of them, everything regarding AD sometimes freezes for over 10 seconds before being responsive again. This includes for example

  • Active Directy Users and Computers Snapin
  • Group Policy Management Snapin
  • PowerShell Commands such as "New-GPLink"
  • CMD Commands such as "netdom query fsmo"

The problematic domain controller is Windows Server 2016. If you work in the console actively, everything will be smooth. But leave it in the background for 10 minutes and try to click something, we get the freeze for 10 seconds.

I have cleaned up errors from the eventlog and ran repair commands like "sfc /scannow", also made sure that AD is healthy via dcdiag and the likes. However I cannot seem to find the reason for why this is happening. Any ideas?

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,364 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,813 questions
0 comments
Accepted answer
  1. David Trevor 291 Reputation points
    2021-10-18T09:06:53.593+00:00

    Hello Gary,

    the problem really seems to have gone away with the latest Windows Updates (I think it was cumulative Update 2021-09). The console now does not freeze anymore if left idle.

    The problematic DC is indeed a physical one.

    0 comments

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jai Verma 461 Reputation points
    2021-09-30T18:24:25.127+00:00

    Check power options. Check the CPU/memory usages during the time of issue, keep the task manager running and keep it idle for 10-15 minutes and try clicking on anything see if the CPU/Mem/Disk usages are higher?

    0 comments
  2. Gary Reynolds 9,391 Reputation points
    2021-10-01T00:56:38.31+00:00

    Hi @David Trevor

    A couple of questions and possible suggestion.

    Which DC is the PDC? Is the domain controllers that is having the issue at a remote site on a WAN link? It might be the case that WAN link has been dropped by the routers and the 10 sec delay is the time taken to bring the link back up and delay waiting for the PDC to respond. One way to test this scenario, is leave the console for 10mins and then rather than trying to use the console, try ping the other DC which will activate the link and be used to also check if there is a delay getting the ping responses.

    Gary.

    0 comments
  3. David Trevor 291 Reputation points
    2021-10-01T12:24:02.537+00:00

    All FSMO roles are taken by the problematic DC. They reside in the same LAN both, also this AD does not have any remote sites. I would have loved to also try the task manager monitoring, however I could not reproduce the problem today, which is weird. Maybe it went away, we applied Windows Updates yesterday?

    0 comments
  4. Gary Reynolds 9,391 Reputation points
    2021-10-01T12:51:11.34+00:00

    Hi David,

    Yep sounds a little wierd, but if you are able to reproduce the problem, it might be worth trying to understand if the delay is only impacting the foreground processes or both the foreground and background processes, i.e. does the DC still respond LDAP\AD request from network clients?

    One other question while I think about, are the DCs physical or virtual, if virtual, are the resources over committed on the host?

    Gary.