OASOpen
Architecture
Systems
Back to insights
Citrix & Virtualisation

Slow Citrix Logons: How to Find the Cause with uberAgent

A slow logon is a chain of stages, not one fault. This guide shows how uberAgent breaks a Citrix or Windows logon into measurable phases, which metrics to read first, and what changed in uberAgent 8.

OAS Editorial Team

· 6 min read

"Logons are slow" is one of the most common complaints a Citrix helpdesk hears, and one of the hardest to close. The administrator sees a healthy Delivery Controller, a VDA with spare CPU and a network that passes every ping test. Without stage-by-stage data, the ticket is closed as "could not reproduce" and reopens the following Monday.

uberAgent replaces that guesswork with measurements. This guide explains what the agent records during a logon, how to read those numbers in order, and what uberAgent 8 changes for teams running it today.

What uberAgent measures during a logon

uberAgent's User Logon metrics record a Windows logon from the moment the user authenticates until the shell is fully initialised. That whole span is reported as TotalLogonTimeMs. Within it, the Logon Detail data breaks the logon into the phases that usually account for the delay:

  • Domain controller discovery: DcDiscoveryTimeMs, the time taken to find a domain controller, together with the AD site and the logon server used.
  • Group Policy: GroupPolicyTotalProcessingTimeMs, plus the loopback mode in effect (replace, merge or none).
  • Logon scripts: ADLogonScriptTimeMs for Active Directory logon scripts and GroupPolicyLogonScriptTimeMs for scripts applied through Group Policy.
  • Profile load: ProfileLoadTimeMs for the Microsoft user profile service and CitrixPMLoadTimeMs for Citrix Profile Management.
  • Shell start: ShellStartupTimeMs, typically Windows Explorer, with separate start and end times for AppX file association and package loading.

A second data set, Group Policy CSE Detail, records every client-side extension by name, the GPO that configured it, how long it ran and its return code. A third, Logon Processes, lists every process started during the logon with its type (Userinit, Shell, logon script, Group Policy and so on), its lifetime, CPU time, working set and network use.

That is the raw material. The method is in the order you read it.

Step 1: confirm the problem and where it sits

Start with the total. Compare TotalLogonTimeMs across users, machines and days rather than looking at one complaint. uberAgent's Experience Score dashboards in Splunk score sessions, machines and applications so the outliers surface on their own.

Then ask whether the slow logon follows a user group, a machine catalogue or a time of day. One user slow on every machine points at the profile or a policy scoped to that user. Every user slow on one catalogue points at the image or the host. Everyone slow at 08:00 points at a shared dependency such as a domain controller, a file server or a profile store under load.

Step 2: find the dominant phase

Open the Logon Duration Analysis dashboard for the affected sessions and look for the phase that carries most of the total. In practice the cause tends to be one of four things:

  1. Group Policy that runs too many client-side extensions or applies a slow one. The CSE Detail data names the extension and the GPO. A return code other than zero means the extension reported a problem.
  2. Profile load that has grown with the profile. If ProfileLoadTimeMs or CitrixPMLoadTimeMs is the largest number, the fix is in the profile solution, folder redirection or exclusions, not in the VDA.
  3. Logon scripts that map drives and printers or query systems that respond slowly. The Logon Processes data shows each script's lifetime and what it spawned.
  4. Shell start delayed by applications that launch at logon, including AppX provisioning. The AppX phases are typically evaluated only on a user's first logon, so non-persistent desktops may show them repeatedly.

One caution from the Citrix documentation: uberAgent waits for all child processes of a phase to finish before it closes that phase, so a process started by a logon script that runs for the whole session can make the script phase look far longer than it was. Since uberAgent 7.5 you can list such processes under [IgnoreLogonMonitoringProcesses] in the configuration, or through the Group Policy setting "Ignore processes during logon monitoring".

Step 3: fix, then prove it

Change one thing at a time and measure the same metric afterwards. Remove or re-scope the slow GPO, trim the profile, move the script dependency, or stage the application launch. The before-and-after values of the specific phase, not the total alone, are the evidence that the change worked.

What uberAgent 8 changes

Teams on uberAgent 7.x should read the 8.0 and 8.1 release notes before upgrading. These points affect a logon-monitoring deployment.

  • Azure Monitor is no longer a supported backend. Microsoft's HTTP Data Collector API stops working after 14 September 2026, and Citrix states that its successor does not meet uberAgent's requirements. If you forward logon data to Log Analytics today, you need another destination. Splunk remains the backend with the full dashboard set; Elasticsearch, Kafka, Azure Data Explorer and Cribl Stream are documented alternatives. OAS runs Splunk as a managed service through Splunk SIEM.
  • Linux is now supported. uberAgent 8.0 made the Linux agent generally available on Ubuntu 22.04, Red Hat Enterprise Linux 8.10 and eLux 7, and 8.1 adds an IGEL OS 12 app deployable through the IGEL Universal Management Suite. The thin-client side of a Citrix session can now be measured too.
  • Platform alignment. uberAgent 8.1 is released alongside Citrix Virtual Apps and Desktops 2607 LTSR, with improved VDA detection in the Windows agent. Site monitoring requires a Delivery Controller on 2203 LTSR or newer.
  • Licensing. Citrix's licensing update confirms that uberAgent is included in the Citrix Platform License and may be deployed on any physical or virtual endpoint. Check your entitlement before planning a rollout; the Splunk ingestion licence is a separate cost.

Where this fits in a Citrix estate

Logon time is one of the metrics we recommend measuring during any pilot, whether the target is Citrix DaaS, DaaS Flex or an on-premises site. Our Citrix DaaS Flex assessment lists the user-experience tests worth running before choosing a platform, and the VDI buyer's guide covers the delivery models to compare. uberAgent gives those tests a number, and keeps giving it in production.

Sources

Measure logons instead of guessing at them with uberAgent deployed and managed by OAS.

Keep exploring

All insights