When going through the event logs for group policy on Windows 7 we were able to identify the CSE causing this issue. For us it was the "File processing extension".
When we looked at the group policy we saw that the item-level filtering was filtering on a group with 11,000+ objects in it. We had two tasks in the GPO that were filtering on that group. When I attempted to open the group utilizing ActiveRoles Server (ARS) it was taking 40-50 seconds to populate each object in the group. I theorized that it appeared Windows 7 was iterating through each object like ARS was. To test this I installed Wireshark on the Windows 7 and XP machines and ran "GPUPDATE /FORCE". This triggered the CSE to execute. The following are the traces:
|XP Capture. It queries (highlighted) the group then continues on.|
|Windows 7 Capture. It queries the group then all objects within the group.|
Obviously, with 11,000+ objects in the AD group Windows 7 will have a significantly slower logon if it's querying every object within the group. Fortunately, Microsoft has put out a fix for this: