Disable RSoP logging
the source of the logon delays was the large size of the WMI repository located on the servers at c:\windows\system32\wbem\repository\objects.DATA. When policies are applied by the user during logon, the system must read and write to the repository. When it is very large (we observed some servers with an objects.DATA file at 1.6GB in size), the Windows Management Instrumentation (WMI) service may block transactions for a period of time. By disabling the dependency on the Group Policy engine on this repository, the users no longer experienced delays during user log on.