Troubleshoot Boot Issues (Troubleshoot Boot)

With the Troubleshoot Boot dashboard, you can find patterns of long boot times of devices across the organization, then select a single device to view the details of its boot components. A slow startup directly contributes to lower productivity. With Aternity you can troubleshoot boot problems without visiting those devices or remotely logging in, thereby reducing business disruptions and increasing user productivity.

For example, a slow Windows startup might be caused by an outdated driver, or a slow program/service running as one of the startup tasks.

View the boot times and the reasons for delays

View specific drivers, processes and group policies that slow down the boot, and provide empirical evidence for IT teams on the components taking most time to load, allowing them to optimize PCs.

If a user complains about their boot taking too long, use this dashboard to view the attributes of that user (like location, operating system, boot components) and check if others with the same attributes suffer the same problem. You can also view the history of boot performance in the Trends section.

Aternity monitors several parallel boot times for Windows devices, some from the Windows Event Log (ID 100), while others are Aternity's proprietary calculations. Event ID 100 lists the main path boot duration, the post boot duration and their sum: the total boot time.


The Event Log does not log all boots. For example, boots from virtual consoles are not logged.

Therefore, Aternity's proprietary boot measurements are more robust, as they log the boot times regardless of speed or virtual consoles. They include the machine boot time and the user logon time.

Various boot times on Windows devices
To... Do This...

To view the evolution of the boot performance over a period of time

Use the Trends section.

To view the boot frequency and duration, and you can see at a glance if the boot time is improving or worsening. It helps you see, for example, if a device has been booted too rarely, or to correlate between a change you made and its impact on the boot times.

To find out if the poor boot performance can be linked to a specific operating system

Use the Operating Systems section.

See the boot times in this section. Check if you can link the boot time worsening to an operating system upgrade you might have implemented.

To view which devices or users have the longest boot time, to troubleshoot individual user complaints

Use the Devices section.

This section presents the boot per individual hostname or username.

To view which boot components are the most detrimental to the overall boot time and find out if they are a driver, a process, or a Windows service

Use the Top Degraded Boot Components section.

This is a list of the boot components which took longer than five seconds which contribute most to a slow boot. This information is extremely valuable because it can lead you to the root causes of the problem.

To view whether the boot times comply to your SLA commitments

Use the Boot dashboard.


You can also view and analyze this data using the WINDOWS_MACHINE_BOOTS REST API. (Learn more).


  1. Step 1 Open a browser and sign in to Aternity.
  2. Step 2 Select Main Menu > Troubleshoot > System or Hardware, then select Boot Issues.
    Accessing the Troubleshoot Boot dashboard

    Alternatively you can drill-down from any of the following dashboards:

    • Boot

    • Device Health

    • Desktop Reliability

    • Device Inventory

    • My Enterprise

    • Remote Display

    • Monitor User or Device

    • Commonalities Analysis

  3. Step 3 Set the boot time you want to display to Total Boot, Machine Boot, or User Logon in the drop-down menu in the top bar.
    Choose boot time to display by selecting it in the top bar of this dashboard
    Field Description

    Total Boot

    The total boot time on a Windows device starts from the time the Windows logo appears until the desktop appears and all components are loaded. Agent queries Windows Event Log (ID 100) for the BootTime parameter, calculated as the sum of main path boot and post boot times, located in the Diagnostics > Performance > Windows section of the log.

    Machine Boot

    Machine boot is part of a device's boot time, starting a fraction of a second after the Windows logo appears, and ending with the Windows sign in screen. Agent queries Windows Kernel-PnP (NOT the Event Log) for the BootStart > Start event to mark the start of this time, and ends when the Windows sign in screen appears (or the automatic sign in process starts).

    User Logon

    User logon measures a part of the boot time, starting when you press OK at the Windows sign in screen and ending when the Windows desktop Start button appears. The Agent queries Windows Shell-Core (NOT the Event Log) for the Explorer_StartMenu_Ready event to mark the end of this time.

  4. Step 4 Set the boot time value you want to display to Average or Maximum in the Boot Duration drop-down menu in the top bar.
    Set the boot value to display in all the sections of the dashboard

    Use the average value to see how the different locations in your enterprise perform in terms of boot time, how today's performance is compared to a previous date, if the trend is improving. Choose to display the maximum value to isolate the peaks of the boot time and see how often they occurred and on which devices.

    A normal average value and a high maximum value in the same location or for the same user, for example, indicate an isolated event which doesn't need your attention. Use this comparison, for instance, if a user complains that their last boot was extremely long. Check if only that particular boot was abnormal, or a few others before that were also long.

    A high average value indicates long boots occurred repeatedly, to the same user or to multiple users, so you need to investigate where it happened, on which devices, which boot events contributed the most to the longer boot time, and so on.

    Field Description


    The average of all the boot times (displayed in hours, minutes, and seconds) in the period of time selected.


    The maximum of all the boot times (displayed in hours, minutes, and seconds) in the period of time selected.

  5. Step 5 View the frequency of the boots and see the changes in the boot time during the timeframe of the dashboard in the Trends section, to see when the boot performance is improving and when it is worsening.

    Select your period of interest in the Timeframe drop-down menu in the top bar.

    View the boot time frequency and evolution in time

    Hover over the vertical bars to see the date, the number of monitored boots, and the View menu's boot time in the pop-up window. If no data is displayed for a certain day, it means no boots were performed on any of the monitored devices.


    The Trends section displays data going back as far as listed in the Timeframe drop-down list. Start with a longer period to spot when the boot time started to grow, then zoom the timeframe to focus on the exact moment when it happened by using the Custom option.

    Check if the number of boots increased suddenly at a certain time. It could be a sign that several users experienced a slow-down of their devices around that time and initiated boots trying to solve it. Or it could be an indication that several devices automatically booted, which is an operating system issue.

  6. Step 6 View the performance of the operating systems in terms of their boot time in the Operating Systems section.
    View the boot time per operating system

    To see the volume of users experiencing boot problems with the same operating system, hover over the boot time horizontal bar. For each operating system, view the number of boots and the number of users in the pop-up window and try to see what they have in common. Check if the faulty operating systems have been recently installed, which service pack they are using, the location of the devices using those operating systems, and so on.

  7. Step 7 To identify specific devices that experienced slower boots, view the Devices section.

    By default, the hostnames with the longest boot duration are shown first. Only the users with the 50 longest boot times are displayed.

    If you select Total Boot in the View drop-down menu at the top of the dashboard, you can also see which of the boot phases (the Main Path Boot Duration or the Post Boot Duration) were longer than expected. This information can help you see in which of the phases the factor that caused the unusual boot length appeared, and focus your investigation on that period of time.

    View the boot time per device

    The end of the User Logon and the end of the MainPathBoot do not coincide exactly.

    The Boot Time, the MainPathBootTime, and the BootPostBootTime are Microsoft measurements, derived from the Windows Event logs.

    Finding MainPathBootTime and BootPostBootTime in the Windows Event Viewer
    Field Description

    Main Path Boot Duration

    The main path boot duration is the time elapsed from the appearance of the animated Windows logo until the appearance of the desktop. Agent queries Windows Event Log in the Diagnostics > Performance > Windows section, ID 100 for the MainPathBootTime parameter.

    Post Boot Duration

    The post boot duration is the time elapsed from the appearance of the desktop until the CPU reaches 80% idle for 10 consecutive seconds. The Agent queries Windows Event ID 100, located in the Diagnostics > Performance > Windows section of the log, and reports the measurement stored as BootPostBootTime.

  8. Step 8 To troubleshoot specific device boot times, you can view more information about that device, by drilling down in the Devices section to the following dashboards:
    Troubleshoot specific device boot times in other dashboards
  9. Step 9 View the specific degraded boot components loaded during startup which took longer than five seconds, in the Top Degraded Boot Components section.

    Aternity collects this information from the Windows Event Log (event IDs 100-199) in the Application and Services Logs > Microsoft > Windows > Diagnostics-Performance > Boot Performance Monitoring section.

    For example, Event ID 100 shows if a Windows built-in application or service caused a slowdown; event 101 reveals if an application caused the slowdown; event ID 102 details any drivers causing a delay; event 106 means that background optimization took longer than usual, and so on.

    View the boot components which caused boot degradation

    Hover over the boot time horizontal bars to see the number of the users impacted by problems in each of these components.

    Field Description
    Top Degrading

    Select this from the drop-down menu to view the boot components which suffered the biggest drop in performance.


    Select to view the time taken by each component to boot, sorted by the longest first. The system lists only components whose boot time was longer than three seconds.

    The processes run in parallel, so the total boot time cannot be calculated by summing up all the boot times displayed.


    Displays the category of the item in the Windows event log (learn more).


    Displays the name of the component which Windows loads as part of the boot process which took longer than five seconds.


    Displays the number of times a boot occurred where this component took longer than five seconds to load.


    Displays the number of unique users who loaded this component as part of booting the device, where it took more than five seconds to load.


    Displays the time required to load this component. Select Boot Duration > Maximum to view the peak time, or Boot Duration > Average to view the average time (learn more).

  10. Step 10 View the users impacted by slow boot components, in the Top Degraded Boot Components section.
    View the users who experienced the degradation of a boot component

    To see the users impacted by a slow component, select it in the Category or the Component column and view the Affected Users section that appears below.

    This way you can check, for example, if the slow boot of MsMpEng.exe affected one user or multiple users. If it impacts many devices, this item needs your attention. Alternatively, if the IDS Core Driver has a longer than usual boot time and it impacts many users, you know that the symidsco.sys version might be obsolete or defective and should be updated.

  11. Step 11 To troubleshoot a single user's boot times, select the user in the Devices section and then investigate possible long boot cause in the other sections.
    View the boot time per operating system

    When you select a hostname, all the other sections of the dashboard display only the data concerning that particular device or user. Check when the boot degradation started on that device in the Trends section. Check if other users in the same location who use the same operating system experienced slow boots. View the Top Degraded Boot Components section to view the components responsible.

  12. Step 12 To view further details in any of the sections, for example the number of devices or users affected by the slow boot, hover over the boot time value bar or circle in that section, and see the values in the pop-up window.
    View the boot details in the pop-up window

    The following table displays the fields which appear in various the pop-up windows throughout the dashboard.

    Field Description


    The date when the boots occurred.

    OS Service Pack

    The version of Windows and service pack running on the monitored device.


    The hostname of the Windows device.

    User Name

    The sign in name of the user associated with the device.

    Boot Phase

    The name of the measured sequence of the Total Boot:


    Displays the number of monitored boots in the timeframe of the dashboard. A large number means either that the user booted the device many times in that time interval, or the operating system automatically restarted the device frequently due to a system failure.


    Average or maximum boot time (determined by your Boot Duration selection), displayed in hours:minutes:seconds. By default it displays the average boot times.


    Displays the number of monitored users who experienced boot problems in the selected timeframe.


    The Aternity monitor which reports the parameter Machine Boot and User Logon.

  13. Step 13 You can limit the display of this dashboard using the menus at the top of the window.
    Limit the data displayed in the dashboard




    You can change the start time of the data displayed in this dashboard in the Timeframe menu in the top right corner of the dashboard.

    You can access data in this dashboard (retention) going back up to 30 days. This dashboard's data refreshes every hour.


    Limit the display of the dashboard to view the boot performance in a single location.

    Device Type

    Select to view the boot times for just a single type of device.

    Isolate one type of device at a time to check if it is a common boot problem to all the devices in a location, for example, indicating a network issue, or it is just a laptop problem, indicating a certain driver issue.


    Only desktops, laptops, tablets and virtual desktops have a boot sequence, so only these device types are displayed in this dashboard.