I don't use my laptop much when I'm not traveling, but I occasionally use
it to read email in the living room. Like most Windows users, I'm frustrated
by occasional unexplained delays when I perform routine tasks such as starting
a program or opening a Web page. Since joining my laptop to an internal Microsoft
domain, I've begun experiencing regular delays when starting processes. With
my Sysinternals tools arsenal in hand, I set out to investigate the root cause,
suspecting that joining the laptop to the Microsoft domain played a role.
I began my research by first noticing that, after a delay of a few seconds when starting a new process, processes that I started within the following 30 seconds launched instantly. I therefore started Sysinternals Process Explorer, waited for 30 seconds, then started Notepad from Windows Explorer's Run command. Notepad didn't appear in Process Explorer's process tree during the expected delay, which implied that the Explorer thread starting Notepad was experiencing the pause, not Notepad's startup.
You can follow all the steps I performed to diagnose the process delays by
visiting my blog at https://blogs.technet.com/markrussinovich/archive/2006/08/31/453100.aspx,
but the results of my investigation showed that Windows Defender is the culprit.
Putting it all together, here's what I discovered happens to cause the process
delays: When a program launches, the shell calls to Windows Defender's real-time
protection hook, MpShHook.Dll. The hook communicates with the Windows Defender
service via remote procedure calls (RPC), and as part of the protocol, RPC attempts
to determine the computer account's SID. This causes RPC to look for a domain
controller (DC), which it can't find. The result is a process startup delay,
which is actually a network timeout.
A little more research led me to conclude that the delay happens only under
the following circumstances:
- The system is running Windows XP 64-bit Edition or Windows Server 2003 Service
Pack 1 (SP1).
- Windows Defender Beta 2 is active.
- The system is joined to a domain but hasn't connected to the domain in the
current boot session.
The Windows Defender team is looking at workarounds for the next release, but
now that I understand the delay I can work around it.