topic Re: PC windows Slow logon in Network Access Control

PC windows Slow logon

oum-odom — Mon, 07 Jul 2025 08:07:37 GMT

Hello Cisco ISE lover,

Currently, I have an inquiry refer to posture process.
As we have Pending and Complaint status for DOT1x (Supplicant) wired connection.

Base on your experience, does Posture process will cause/delay/slow for window PC logon process?
What is the ultimate solution to proceed next?

Thank you,

Re: PC windows Slow logon

ahollifield — Mon, 07 Jul 2025 19:59:23 GMT

Use an MDM instead of ISE Posture. How exactly do you know ISE Posture is causing the slowness though? The ISE Posture module only runs in user space.

Re: PC windows Slow logon

oum-odom — Tue, 08 Jul 2025 01:51:18 GMT

@ahollifield There is not sure for root cause analysis, while we notice bypassing ise the time for windows logon until desktop home screen will spend around 10 sec to 1min averagely, even we have allowed common service related to AD service.
This behaviour is inconsistency. That's why trying to figure out from related part as AD service, Network level and ISE level.

Re: PC windows Slow logon

wajidhassan — Tue, 08 Jul 2025 12:19:48 GMT

Yes, the posture process in a dot1x wired setup can contribute to slow Windows logon, especially if network access is delayed while posture validation is still in a Pending state.

To improve this:

Enable Fast User Logon in Windows Group Policy, so logon isn’t blocked by network readiness.
Use EAP-Chaining (machine + user authentication) to separate posture from the user login process.
Review posture conditions in ISE to ensure they aren't too strict or time-consuming during initial connection.

These steps usually help reduce logon delays in posture-enabled environments.

Re: PC windows Slow logon

ahollifield — Tue, 08 Jul 2025 12:33:00 GMT

Thanks AI, useless copy/paste response.

Re: PC windows Slow logon

Aref Alsouqi — Wed, 09 Jul 2025 12:57:45 GMT

Based on my experience it shouldn't really add any noticeable delay because as @ahollifield mentioned, the posture assessment will happen after the user has logged in. Now, it's true that right after the login is complete the posture check will start, however, it shouldn't really delay the login process itself, so the user should see their desktop without any delay and then will be subject to the posture check if they will have access to the network or not.