With command line auditing enabled it should be able to report the duration of any script assigned to the user object in AD. However, the script will only get specific phases of the logon, not every little detail so for that I wrote this script https://github.com/guyrleech/Microsoft/blob/master/Get%20Process%20Durations.ps1 which when you specify a time range via -start and -end will show you all processes launched in that period, their duration and their parent which I've had a great deal of success in using to find slow logon processes

Also, don't forget the power of the event log in giving clues as to what is going on. I've pushed some 1 liners out in the past but now there's a script you can use to show all event log entries in a given period which again I find very useful for logon analysis - https://github.com/guyrleech/Microsoft/blob/master/event%20aggregator.ps1

Will need to run script as an admin though as it accesses the Security event log

got it! awesome, thank you!

between guy's script and ControlUP problem is shell.exe any ideas on this one?

@Markus Zehnle so i have guy's procmon script, i'm guessing i can run that against shell.exe after logon to see the delays with it?

wait that wont work, shell.exe is already gone by the time the user hits the desktop

i got it all worked out, i used controlup to execute procmon on a vm before i logged in and captured all the data, thanks all

so ms support came back and told me the logon delays are not fslogix related according to the logs (which i told them that in the beginning) and that procmon shows gpo,, a/v and citrix stuff chewing up some seconds here and there processing logons, no surprise there either. owell just something i gotta live with i guess