Last fall, I spoke at the Microsoft Tech Ed: IT Forum conference in Barcelona,
Spain. The conference was a huge success, and Windows Vista, which I had taken
on the road for the first time, performed great. However, as I was running through
some demos, I noticed that the File Open dialog box, which is common to all
Windows applications, would often take as long as 15 seconds to appear. The
behavior seemed similar to the behavior I wrote about in "The Case of the Process
Startup Delays" (http://blogs.technet.com/markrussinovich/archive/2006/08/31/453100.aspx).
In that case, Windows Defender's remote procedure call (RPC) communications
tried to contact a domain controller (DC), which resulted in hangs when the
system was disconnected from its domain.
To investigate the problem, I launched Notepad from within Windbg (part of
the free Debugging Tools for Windows available at http://www.microsoft.com/whdc/devtools/debugging/default.mspx),
typed Ctrl+O to open the File Open dialog, and when I got the hang, broke in
and looked at the stack of Notepad's main thread.
A look at the function names on the stack immediately told me what was happening: When you
access the File Open dialog box the first time within an application, it navigates to your Documents
folder. On Vista, my folder is C:\Users\Markruss\Documents, but the shell wants to make the path in the
dialog box's new bread crumb bar (which shows the trail of accessed folders—i.e., breadcrumbs) pretty
by displaying it as "Mark Russinovich\Documents." So it calls GetUserNameEx to look up my account's
display name as it's stored in my User object in Active Directory (AD).
I set a breakpoint on the call's return and hit it after the delay completed. GetUserNameEx returned the
ERROR_NO_SUCH_DOMAIN error code, and stepping through SHGetUserDisplayName revealed that it
falls back to calling GetUserName. Instead of looking up the user's display name, that function just obtains
the Security Identifier (SID) of the user from the process token (the kernel data structure that defines the
owner of a process) and calls LookupAccountName to translate the SID to its account name, which in my
case is simply "markruss." Thus, the Open File dialog box's breadcrumb bar referenced "markruss." However, when I reconnected to the corporate network, the breadcrumb bar referenced "Mark Russinovich."
You can read the detailed description of the steps I took to solve the Open
File dialog box hangs at https://blogs.technet.com/markrussinovich/archive/2006/11.aspx,
but to summarize, I discovered that Vista's File Open dialog box tries to look
up a user's display name for the breadcrumb bar when showing the Documents folder,
and in the process, tries to locate a DC by sending a LAN Manager datagram via
the Bowser.sys device driver. There's no workaround and anyone that has a domain-joined
system that's not connected to the domain for more than 30 minutes will experience
the same delays—at least until Vista Service Pack 1 (SP1).
—Mark Russinovich
This is a summary of a popular posting to Mark Russinovich's technical blog
(https://blogs.technet.com/markrussinovich/about.aspx),
which covers topics such as Windows troubleshooting, technologies, and security.
You can read the entire post at https://blogs.technet.com/markrussinovich/
archive/2006/11.aspx
Register
