Endpoint Analytics Startup Performance Script Delays

Question

Hey,

Endpoint Analytics in Intune is reporting an average desktop sign-in delay of about 45 seconds across our Windows devices. The dashboard identifies "GPO/Script delay" as the primary contributor.

What's the best way to determine which specific Group Policy Object or legacy logon script is causing the delay?

Are there built-in Windows logs or diagnostic tools that can help identify which GPO extension or script is blocking the user shell during sign-in? Also, is there a recommended approach for distinguishing between slow Group Policy processing and long-running logon scripts?

Any troubleshooting tips or best practices would be appreciated.

Answer 1

Hi Lea Weber,

The best way to pinpoint which Group Policy Object or logon script is slowing things down is to use the built-in Group Policy Operational Log under Event Viewer (Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational). This log records the processing time for each GPO extension and can help you identify whether the delay is coming from registry, folder redirection, or script execution.

For scripts specifically, you can enable verbose logging of logon scripts via Group Policy settings, which will show execution times in the event logs. Another useful tool is GPResult /h report.html, which generates a detailed report of applied policies and their processing times. To distinguish between slow GPO processing and long-running scripts, compare the timestamps in the Group Policy Operational Log with the Script Event Logs, if the GPO extensions finish quickly but the script continues to run, you’ve found your culprit.

Best practice is to gradually phase out legacy logon scripts in favor of modern Intune or Group Policy Preferences, since scripts often introduce unpredictable delays. Also, consider breaking down large GPOs into smaller, targeted ones to reduce processing overhead.

If you find this answer helpful, kindly hit “accept answer”

Tracy.