The Case of the Delayed Windows Vista File Open Dialogs

Last fall, I spoke at the Microsoft Tech Ed: IT Forum conference in Barcelona, Spain. The conference was a huge success, and Windows Vista, which I had taken on the road for the first time, performed great. However, as I was running through some demos, I noticed that the File Open dialog box, which is common to all Windows applications, would often take as long as 15 seconds to appear. The behavior seemed similar to the behavior I wrote about in "The Case of the Process Startup Delays" (http://blogs.technet.com/markrussinovich/archive/2006/08/31/453100.aspx). In that case, Windows Defender's remote procedure call (RPC) communications tried to contact a domain controller (DC), which resulted in hangs when the system was disconnected from its domain.

To investigate the problem, I launched Notepad from within Windbg (part of the free Debugging Tools for Windows available at http://www.microsoft.com/whdc/devtools/debugging/default.mspx), typed Ctrl+O to open the File Open dialog, and when I got the hang, broke in and looked at the stack of Notepad's main thread.

A look at the function names on the stack immediately told me what was happening: When youaccess the File Open dialog box the first time within an application, it navigates to your Documentsfolder. On Vista, my folder is C:UsersMarkrussDocuments, but the shell wants to make the path in thedialog box's new bread crumb bar (which shows the trail of accessed folders—i.e., breadcrumbs) prettyby displaying it as "Mark RussinovichDocuments." So it calls GetUserNameEx to look up my account'sdisplay name as it's stored in my User object in Active Directory (AD).

I set a breakpoint on the call's return and hit it after the delay completed. GetUserNameEx returned theERROR_NO_SUCH_DOMAIN error code, and stepping through SHGetUserDisplayName revealed that itfalls back to calling GetUserName. Instead of looking up the user's display name, that function just obtainsthe Security Identifier (SID) of the user from the process token (the kernel data structure that defines theowner of a process) and calls LookupAccountName to translate the SID to its account name, which in mycase is simply "markruss." Thus, the Open File dialog box's breadcrumb bar referenced "markruss." However, when I reconnected to the corporate network, the breadcrumb bar referenced "Mark Russinovich."

You can read the detailed description of the steps I took to solve the Open File dialog box hangs at https://blogs.technet.com/markrussinovich/archive/2006/11.aspx, but to summarize, I discovered that Vista's File Open dialog box tries to look up a user's display name for the breadcrumb bar when showing the Documents folder, and in the process, tries to locate a DC by sending a LAN Manager datagram via the Bowser.sys device driver. There's no workaround and anyone that has a domain-joined system that's not connected to the domain for more than 30 minutes will experience the same delays—at least until Vista Service Pack 1 (SP1).
—Mark Russinovich

This is a summary of a popular posting to Mark Russinovich's technical blog (https://blogs.technet.com/markrussinovich/about.aspx), which covers topics such as Windows troubleshooting, technologies, and security. You can read the entire post at https://blogs.technet.com/markrussinovich/ archive/2006/11.aspx