The problem

A HyperV Virtual Machine that I had been using for over 1 year suddenly started slowing down when logging in via remote desktop.

It got to the point where it was taking 4 or 5 attempts to login and costing about 15 minutes every morning.

Edit
I have now also noticed it is taking approx 10 minutes to shut down when performing a reboot.

The Solution – Version 3 (@ Jun-2014)

Ok, this problem has been driving me crazy, and each time I apply a “fix” I find a week later that I am back to having problems.

I have left the sum total of the trouble shooting that I have done, in the previous solutions further down, but this latest solution seems to be the one.
Note: this fix is done on the guest. I have changed nothing on the hyper-v host.

The issue of slow logins was also compounded recently with really slow shutdowns. I applied some patches and needed to reboot the guest and had to wait 10 minutes. I tested this a few times, by pinging the server during a reboot and (ping server.domain.com -t), and waiting for lost packets. It would take about 8 minutes before the packets were being dropped.

After one of these reboots, I opened event viewer and looked at the “System” logs.

I noted that during the shut down there was a heap of “service x has shut down” messages, but then there was a 6 minute gap followed by a Warning message from the “Windows Remote Management” service, WinRM.

[csharp]
Log Name: System
Source: Microsoft-Windows-WinRM
Date: 19/06/2014 11:43:53 AM
Event ID: 10149
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: computer.dev.com
Description:
The WinRM service is not listening for WS-Management requests.

User Action
If you did not intentionally stop the service, use the following command to see the WinRM configuration:

winrm enumerate winrm/config/listener
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" EventSourceName="WinRM" />
<EventID Qualifiers="7">10149</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-06-19T01:43:53.000000000Z" />
<EventRecordID>86324</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>computer.dev.com</Computer>
<Security />
</System>
<EventData Name="Stopped Listening">
</EventData>
</Event>
[/csharp]

This service is detailed here, Windows Remote Management (Windows) – MSDN

I decided I could try living without this service, so I found the “Windows Remote Management” service disabled it and stopped it.

Now, my computer shuts down (to lost ping) in less than 10 seconds and I have not had a slow login since.

I would appreciate if anyone else can confirm this works for them.

The Solution – Version 2

On the server manager I notice the following:

The item to note is the “Remote Access” configuration.

Somehow I had installed Remote Access? Don’t remember doing it, but there you have it in plain sight, so I must have installed it by accident.

To fix the problem uninstall remote access by:

1. Launch Server Manager
2. On the Manage menu, click Remove Roles and Features.
3. In the wizard find Remote access and deselect it
4. Click next through the wizard and confirm removal

Since doing this my logins via mstsc / rdp are normal again.

The Solution – Version 1

Goes to show you can’t trust everything you read on the internet. Everything below was my original investigation and attempt at resolving the problem, and it seemed to fix things but ultimately it was not the solution.

I have left the details here as it may help describe other problems.

Read Hearing Investigation #1

I finally looked into the event log and found that I was getting the following error every 45 seconds.

[csharp]
Log Name: Application
Source: vmicvss
Date: 8/11/2013 9:06:37 AM
Event ID: 13
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: MYSERVER
Description:
Windows cannot perform an online backup of this system because scoped snapshots are enabled. To resolve this, disable scoped snapshots by creating the following registry value on this computer:
PATH: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\
DWORD: ScopeSnapshots
Value: 0
Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="vmicvss" />
<EventID Qualifiers="49154">13</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-11-07T22:06:37.000000000Z" />
<EventRecordID>81122</EventRecordID>
<Channel>Application</Channel>
<Computer>MYSERVER</Computer>
<Security />
</System>
<EventData>
</EventData>
</Event>
[/csharp]

A quick scout around the internet for this error found this article, Scoped Snapshots vmicvss Error 13 on Server 2012, Windows 8

Incorrect solution #1

Edit – Nov 2013
Sorry, this has not resolved my slow login problems. It has has help improve the performance of the box sligthly and I have definitely stopped the errors in my event log, but it has not resolved the slow login screen. I will keep trying and if I get a resolution I will bump the vmicvss issue to its own post and put the definitive solution here.
———– End Edit———–

The fix is in two parts:

1. Create the registry key that the error log is suggesting is a problem

   Save the following into a .reg file and then execute on your computer to stop the error occurring.

   [sourcecode language=”plain”]
   Windows Registry Editor Version 5.00

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
   "ScopeSnapshots"=dword:00000000
   [/sourcecode]

2. Turn off HyperV Backup
   
   The registry change will stop the errors but it will not stop “Information” event log entries being written every 45 seconds.
   You need to login to the HyperV host and edit the settings of you VM.
   Turn off – Backup (Volume Snapshot)

   

I also cleared my event log and things seem to be running much more smoothly .

P.S see the comments. this may be a side effect of Dell Equalogics auto-snapshot software.