zare

open the ETL with the xperfviewer, select the WinLogon-interval and click "Clone Selection". No go to the "Generic events" graph and make a rightclick and select "summary table". In this table expand "Microsoft-Windows-Winlogon" and you can see the 2 entries. One more question: what does the password request (Request Credentials) time includes? Does it include the time needed to enter the password?

That it ! .. My office shares .. man I was so blind .. from where did you get those snapshots? the xml ?

Here it is. Just noticed the file is 47M .. ..here is smaller version with 7z ..

Here it is.

Sorry to high jack this thread: have boot problems after changing some option(disable system restore, indexing ...) .. The boot time when from 20sec to 80 sec. In the event log, the biggest difference is BootUserProfileProcessingTime. In the etl file I cannot see any service taking more time, but there is gap(60s) between two group of services. Any advice where I should look for the problem.