Why Domain Sign-In Hangs on Welcome After 24H2 in Windows 11

After upgrading to Windows 11 version 24H2, some domain-joined PCs hang on the Welcome screen for 30 seconds or more before the desktop appears. The spinning circle freezes, or the profile load stalls without an error message. This delay is caused by a change in how Windows 11 handles network connectivity checks during user sign-in. This article explains the root cause, provides a step-by-step fix using Group Policy, and covers related failure patterns such as offline domain logon failures.

Why the Welcome Screen Hangs After Upgrading to 24H2

Windows 11 24H2 introduced a more aggressive network connectivity check during the logon phase. When a domain-joined user signs in, the operating system attempts to verify network connectivity before loading the user profile and applying Group Policy. If the network connectivity check fails or times out — which can happen due to DNS resolution delays, proxy misconfiguration, or a slow link detection — the Welcome screen hangs while waiting for the check to complete.

The technical root cause lies in the Network Connectivity Status Indicator (NCSI). In 24H2, NCSI probes are performed earlier in the logon sequence. If the probe does not receive a response within the default timeout (approximately 30 seconds), Windows treats the connection as limited or unavailable and delays the user session initialization. This behavior differs from Windows 11 22H2 and 23H2, where the probe ran later or was skipped during interactive logon.

Another contributing factor is the Group Policy slow link detection. When Windows cannot confirm a fast network connection, it may classify the link as slow and skip policy processing, causing the logon to wait for a retry. In 24H2, the threshold for slow link detection was lowered, making this misclassification more common on networks with moderate latency or transient packet loss.

Steps to Fix the Domain Sign-In Hang on Welcome Screen

The fix requires editing Group Policy settings on the domain controller or locally on affected machines. Use Method 1 for domain-wide fixes and Method 2 for testing on a single PC.

Method 1: Enable Network Wait Policy via Group Policy Editor

1. Open Group Policy Management Console
   On a domain controller, press Win + R, type gpmc.msc, and press Enter. Navigate to the organizational unit (OU) containing the affected computers, or create a new GPO linked to the OU.
2. Edit the policy to enable network wait
   Right-click the GPO and select Edit. Go to Computer Configuration > Administrative Templates > System > Logon. Double-click the policy named Always wait for the network at computer startup and logon. Set it to Enabled and click OK.
3. Disable slow link detection for logon
   In the same GPO, navigate to Computer Configuration > Administrative Templates > System > Group Policy. Double-click Configure Group Policy Slow Link Detection. Set it to Disabled and click OK. This prevents Windows from misclassifying the domain network as slow.
4. Run gpupdate on affected clients
   On each affected Windows 11 24H2 PC, open Command Prompt as Administrator and run gpupdate /force. Restart the computer and test the sign-in. The Welcome screen should no longer hang.

Method 2: Change NCSI Probe Source (Alternative Fix)

1. Open Local Group Policy Editor
   Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to NCSI settings
   Go to Computer Configuration > Administrative Templates > Network > Network Connectivity Status Indicator. Double-click Specify source of NCSI active probe.
3. Set a reliable probe source
   Set the policy to Enabled. In the Options pane, enter a URL that is always reachable inside your domain network, such as http://your-domain-controller/connecttest.txt. This bypasses the default Microsoft probe that may time out. Click OK.
4. Apply the change
   Run gpupdate /force in an elevated Command Prompt. Reboot and verify that the Welcome screen loads without delay.

Common Issues After Applying the Fix

Logon Still Hangs Even After Enabling Network Wait Policy

If the Welcome screen still hangs, the issue may be caused by a third-party security software that intercepts network requests during logon. Temporarily disable the antivirus or endpoint protection and test again. If the hang stops, add an exception for the NCSI probe URL in the security software. Another cause is a stale DNS cache on the client. Run ipconfig /flushdns in an elevated Command Prompt and restart.

Domain User Cannot Log On When Disconnected from Network

Enabling the Always wait for the network at computer startup and logon policy forces Windows to wait for the network before completing the logon. If a user attempts to log on while offline, the process will time out after approximately 30 seconds and then fall back to cached credentials. To allow offline logon without delay, do not enable this policy. Instead, use Method 2 (NCSI probe source change) or ensure the user has previously logged on while connected to the domain.

Group Policy Does Not Apply After Fix

If the GPO changes do not take effect, verify that the client has network connectivity to the domain controller. Run gpresult /h gpresult.html in an elevated Command Prompt and open the generated HTML file to check which policies are applied. Look for any filtered or denied policies. Ensure the client computer account is in the correct OU and that the GPO is linked and not blocked by security filtering.

Network Wait Policy vs NCSI Probe Change: Behavior Comparison

Item	Network Wait Policy (Enabled)	NCSI Probe Source Change
Effect on sign-in	Forces Windows to wait for network before logon completes	Changes which URL Windows pings to check connectivity
Offline logon behavior	Times out after ~30 seconds, then uses cached credentials	No delay if the custom probe responds quickly
Best for	Always-on domain networks with reliable connectivity	Networks with intermittent connectivity or proxy issues
Configuration effort	One Group Policy setting	One Group Policy setting plus a reachable URL

The Welcome screen hang after upgrading to Windows 11 24H2 is caused by a change in NCSI probe timing and slow link detection. Enabling the network wait policy or redirecting the NCSI probe to a local URL resolves the delay. Test the chosen fix on a small group of computers before rolling it out domain-wide. As an advanced step, consider using PowerShell to deploy the registry equivalent of these policies: set HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator\NoActiveProbe to 1 to disable active probes entirely if your environment does not require internet connectivity checks during logon.