Troubleshoot Boot Issues (Troubleshoot Boot)

With the Troubleshoot Boot dashboard, you can perform an analysis of device boot issues, by looking for common features of the devices across the organization. Long boot times or slow startups directly contribute to a loss of productivity. Aternity uniquely offers the comprehensive boot status in your enterprise, so you can troubleshoot any boot problems without having to visit the devices or to remotely log in. This dramatically reduces business disruptions and increases user productivity.

For example, a slow Windows startup might be caused by an outdated driver, or a slow program/service running startup tasks. In worst cases, this can delay boot times by up to 30 minutes.

View the boot times and the reasons for delays

Darker colors represent longer boot times.

The Aternity Agent is installed on all monitored devices and it collects boot information every time the machine powers up or a user logs in. Aternity accumulates the boot data from all monitored devices throughout your organization to build a comprehensive insight into boot metrics. Extensive reporting and data mining capabilities help you find users who suffer from slow boot and login times and troubleshoot their boot and login processes. Boot data also reveals factors such as specific drivers and group policies that slow down the process, and provide empirical evidence for IT teams to optimize these aspects, reducing the boot times across the enterprise, by identifying and fixing the contributing factors.

If a user complains about their boot being unusually long, use this dashboard to view detailed information about that user (like location, operating system, boot times, boot components which worsen the boot time, the history of their boot performance), and see if other devices using the same operating system or sharing the same location experience the same problem.

Aternity monitors several parallel boot times for Windows devices, some from the Windows Event Log (ID 100), while others are Aternity's proprietary calculations. Event ID 100 lists the main path boot duration, the post boot duration and their sum: the total boot time.


The Event Log does not log all boots. For example, boots from virtual consoles are not logged, nor are boots where the Event Log considers them as too fast (under 30 seconds or under 1 minute on some devices).

Therefore, Aternity's proprietary boot measurements are more robust, as they log the boot times regardless of speed or virtual consoles. They include the machine boot time and the user logon time.

Various boot times on Windows devices
To... Do This...

To view the evolution of the boot performance over a period of time

Use the Trends section.

To view the boot frequency and duration, and you can see at a glance if the boot time is improving or worsening. It helps you see, for example, if a device has been booted too rarely, or to correlate between a change you made and its impact on the boot times.

To find out if the poor boot performance can be linked to a specific operating system

Use the Operating Systems section.

See the boot times in this section. Check if you can link the boot time worsening to an operating system upgrade you might have implemented.

To view the location of the worst performing boots, to determine if a feature common to one location is causing slow boot times

Use the Location section.

Select the circles with the longest boot time (the darkest color) and see what they have in common. For example, the same network infrastructure, the same hardware drivers, the same operating systems.

To view which devices or users have the longest boot time, to troubleshoot individual user complaints

Use the Devices section.

This section presents the boot per individual hostname or username.

To view which boot components are the most detrimental to the overall boot time and find out if they are a driver, a process, or a Windows service

Use the Top Degraded Boot Components section.

This is a list of the boot components contributing most to a slow boot. This information is extremely valuable because it can lead you to the root causes of the problem.

To view whether the boot times comply to your SLA commitments

Use the Boot dashboard.


  1. Step 1 Open a browser and log in to Aternity.
  2. Step 2 Select Main Menu > Troubleshoot > System or Hardware, then select Boot Issues.
    Accessing the Troubleshoot Boot dashboard

    Alternatively you can drill-down from any of the following dashboards:

    • Boot

    • Desktop Health

    • Desktop Reliability

    • Device Inventory

    • My Enterprise

    • Remote Display

    • Monitor User or Device

    • Commonalities Analysis

  3. Step 3 Set the boot time you want to display to Total Boot, Machine Boot, or User Logon in the drop-down menu in the top bar.
    Choose boot time to display by selecting it in the top bar of this dashboard
    Field Description

    Total Boot

    The total boot time on Windows device starts from the time the Windows logo appears until the desktop appears and all components are loaded. The Agent queries Windows Event Log (ID 100) for the BootTime parameter, calculated as the sum of main path boot and post boot times, located in the Diagnostics > Performance > Windows section of the log.

    Machine Boot

    Machine boot is part of a device's boot time, starting a fraction of a second after the Windows logo appears, and ends with the Windows login screen. The Agent queries Windows Kernel-PnP (NOT the Event Log) for the BootStart > Start event to mark the start of this time, and ends when the Windows login screen appears (or the login process starts in case of auto-login).

    User Logon

    User logon measures a part of the boot time, starting when you press OK at the Windows login screen and ending when the Windows desktop Start button appears. The Agent queries Windows Shell-Core (NOT the Event Log) for the Explorer_StartMenu_Ready event to mark the end of this time.

  4. Step 4 Set the boot time value you want to display to Average or Maximum in the Boot Durationdrop-down menu in the top bar.
    Set the boot value to display in all the sections of the dashboard

    Use the average value to see how the different locations in your enterprise perform in terms of boot time, how today's performance is compared to a previous date, if the trend is improving. Choose to display the maximum value to isolate the peaks of the boot time and see how often they occurred and on which devices.

    A normal average value and a high maximum value in the same location or for the same user, for example, indicate an isolated event which doesn't need your attention. Use this comparison, for instance, if a user complains that their last boot was extremely long. Check if only that particular boot was abnormal, or a few others before that were also long.

    A high average value indicates long boots occurred repeatedly, to the same user or to multiple users, so you need to investigate where it happened, on which devices, which boot events contributed the most to the longer boot time, and so on.

    Field Description


    The average of all the boot times (displayed in hours, minutes, and seconds) in the period of time selected.


    The maximum of all the boot times (displayed in hours, minutes, and seconds) in the period of time selected.

  5. Step 5 View the frequency of the boots and see the changes in the boot time during the timeframe of the dashboard in the Trends section, to see when the boot performance is improving ans when it is worsening.

    Select your period of interest in the Timeframe drop-down menu in the top bar.

    View the boot time frequency and evolution in time

    Hover over the vertical bars to see the date, the number of monitored boots, and the View menu's boot time in the pop-up window. If no data is displayed for a certain day, it means no boots were performed on any of the monitored devices.


    The Trends section displays data going back as far as listed in the Timeframe drop-down list. Start with a longer period to spot when the boot time started to grow, then zoom the timeframe to focus on the exact moment when it happened by using the Custom option.

    Check if the number of boots increased suddenly at a certain time. It could be a sign that several users experienced a slow-down of their devices around that time and initiated boots trying to solve it. Or it could be an indication that several devices automatically booted, which is an operating system issue.

  6. Step 6 View the performance of the operating systems in terms of their boot time in the Operating Systems section.
    View the boot time per operating system

    To see the volume of users experiencing boot problems with the same operating system, hover over the boot time horizontal bar. For each operating system, view the number of boots and the number of users in the pop-up window and try to see what they have in common. Check if the faulty operating systems have been recently installed, which service pack they are using, the location of the devices using those operating systems, and so on.

  7. Step 7 To identify specific devices that experienced slower boots, view the Devices section.

    By default, the hostnames with the longest boot duration are shown first. Only the users with the 50 longest boot times are displayed.

    If you select Total Boot in the View drop-down menu at the top of the dashboard, you can also see which of the boot phases (the Main Path Boot Duration or the Post Boot Duration) were longer than expected. This information can help you see in which of the phases the factor that caused the unusual boot length appeared, and focus your investigation on that period of time.

    View the boot time per device

    The end of the User Logon and the end of the MainPathBoot do not coincide exactly.

    The Boot Time, the MainPathBootTime, and the BootPostBootTime are Microsoft measurements, derived from the Windows Event logs.

    Finding MainPathBootTime and BootPostBootTime in the Windows Event Viewer
    Field Description

    Main Path Boot Duration

    The main path boot duration is the time elapsed from the appearance of the animated Windows logo until the appearance of the desktop. The Agent queries Windows Event Log in the Diagnostics > Performance > Windows section, ID 100 for the MainPathBootTime parameter.

    Post Boot Duration

    The post boot duration is the time elapsed from the appearance of the desktop until the CPU reaches 80% idle for 10 consecutive seconds. The Agent queries Windows Event ID 100, located in the Diagnostics > Performance > Windows section of the log for the measurement stored as BootPostBootTime.

  8. Step 8 To troubleshoot specific device boot times, you can view more information about that device, by drilling down in the Devices section to the following dashboards:
    Troubleshoot specific device boot times in other dashboards
  9. Step 9 View the specific components loaded during startup which took longer than expected, in the Top Degraded Boot Components section.

    The list of degraded boot components is a collection of processes launched during boot (drivers, applications, optimizations) which took longer to load and were more than five seconds.

    View the boot components which caused boot degradation

    Aternity collects this information from the Windows Event Log (event IDs 100-199) in Diagnostics-Performance > Boot Performance Monitoring section.

    For example, Event ID 100 shows if a Windows built-in application or service caused a slowdown; event 101 reveals if an application caused the slowdown; event ID 102 details any drivers causing a delay; event 106 means that background optimization took longer than usual, and so on.

    Hover over the boot time horizontal bars to see the number of the users impacted by problems in each of these components.

    Field Description
    Top Degrading

    Select this from the drop-down menu to view the boot components which suffered the biggest drop in performance.


    Select to view the time taken by each component to boot, sorted by the longest first. The system lists only components whose boot time was longer than three seconds.

    The processes run in parallel, so the total boot time cannot be calculated by summing up all the boot times displayed.

  10. Step 10 View the users impacted by slow boot components, in the Top Degraded Boot Components section.
    View the users who experienced the degradation of a boot component

    To see the users impacted by a slow component, select it in the Category or the Component column and view the Affected Users section that appears below.

    This way you can check, for example, if the slow boot of MsMpEng.exe affected one user or multiple users. If it impacts many devices, this item needs your attention. Alternatively, if the IDS Core Driver has a longer than usual boot time and it impacts many users, you know that the symidsco.sys version might be obsolete or defective and should be updated.

  11. Step 11 Check if a poor boot performance is confined to a specific location in the Location section.
    View the boot information per location

    For example, you can select the location with the worst boot performers (the circle with the darkest color) to view all other sections of the dashboard with the data concerning that particular location. It shows the list of devices in that location and you can examine the components which are common to those users. Perhaps they have the same operating system, or a particular driver which slows them down, it could be a network issue, and so on.

  12. Step 12 See the daily boot performance and whether the performance has been improving or deteriorating over a period of time, in the Trends section.
    Troubleshoot the boot on a certain date

    If you want to see what caused, for example, the boot time peak on a particular day, select the date in the Trends section. The dashboard automatically displays only the boot information for that date in all the other sections. Find the cause for the boot issues by checking which devices booted and what they have in common. It can be the location, or the operating system, or a certain boot component which experienced a long boot, and so on.

  13. Step 13 To troubleshoot a single user's boot times, select the user in the Devices section and then investigate possible long boot cause in the other sections.
    View the boot time per operating system

    When you select a hostname, all the other sections of the dashboard display only the data concerning that particular device or user. Check when the boot degradation started on that device in the Trends section. Check if other users in the same location who use the same operating system experienced slow boots. View the Top Degraded Boot Components section to view the components responsible.

  14. Step 14 To view further details in any of the sections, for example the number of devices or users affected by the slow boot, hover over the boot time value bar or circle in that section, and see the values in the pop-up window.
    View the boot details in the pop-up window

    The following table displays the fields which appear in various the pop-up windows throughout the dashboard.

    Field Description


    The date when the boots occurred.

    OS Service Pack

    The version of Windows and service pack running on the monitored device.


    The hostname of the Windows device.

    User Name

    The login name of the user associated with the device.

    Boot Phase

    The name of the measured sequence of the Total Boot:


    Displays the number of monitored boots in the timeframe of the dashboard. A large number means either that the user booted the device many times in that time interval, or the operating system automatically restarted the device frequently due to a system failure.


    Average or maximum boot time (determined by your Boot Duration selection), displayed in hours:minutes:seconds. By default it displays the average boot times.


    Displays the number of monitored users who experienced boot problems in the selected timeframe.


    The Aternity monitor which reports the parameter Machine Boot and User Logon.

  15. Step 15 To limit the display to one device type, to show the data over specific periods of time, use the drop-down lists on the dashboard's top menu.
    Limit the data displayed in the dashboard




    Choose the start time of the data displayed in this dashboard.

    You can access data in this dashboard (retention) going back up to 30 days. This dashboard's data refreshes every hour.


    Limit the display of the dashboard to view the boot performance in a single location.

    Device Type

    Select to view the boot times for just a single type of device.

    Isolate one type of device at a time to check if it is a common boot problem to all the devices in a location, for example, indicating a network issue, or it is just a laptop problem, indicating a certain driver issue.


    Only desktops, laptops, tablets and virtual desktops have a boot sequence, so only these device types are displayed in this dashboard.