I don't use my laptop much when I'm not traveling, but I occasionally use it to read email in the living room. Like most Windows users, I'm frustrated by occasional unexplained delays when I perform routine tasks such as starting a program or opening a Web page. Since joining my laptop to an internal Microsoft domain, I've begun experiencing regular delays when starting processes. With my Sysinternals tools arsenal in hand, I set out to investigate the root cause, suspecting that joining the laptop to the Microsoft domain played a role.
I began my research by first noticing that, after a delay of a few seconds when starting a new process, processes that I started within the following 30 seconds launched instantly. I therefore started Sysinternals Process Explorer, waited for 30 seconds, then started Notepad from Windows Explorer's Run command. Notepad didn't appear in Process Explorer's process tree during the expected delay, which implied that the Explorer thread starting Notepad was experiencing the pause, not Notepad's startup.
You can follow all the steps I performed to diagnose the process delays by visiting my blog at https://blogs.technet.com/markrussinovich/archive/2006/08/31/453100.aspx, but the results of my investigation showed that Windows Defender is the culprit. Putting it all together, here's what I discovered happens to cause the process delays: When a program launches, the shell calls to Windows Defender's real-time protection hook, MpShHook.Dll. The hook communicates with the Windows Defender service via remote procedure calls (RPC), and as part of the protocol, RPC attempts to determine the computer account's SID. This causes RPC to look for a domain controller (DC), which it can't find. The result is a process startup delay, which is actually a network timeout.
A little more research led me to conclude that the delay happens only under the following circumstances:
- The system is running Windows XP 64-bit Edition or Windows Server 2003 Service Pack 1 (SP1).
- Windows Defender Beta 2 is active.
- The system is joined to a domain but hasn't connected to the domain in the current boot session.
The Windows Defender team is looking at workarounds for the next release, but now that I understand the delay I can work around it.
