Okay, maybe I'm waaaay of here but I'll try to chime in my idea. To be honest we are not seeing this right now, we did have a some users that had slow logon times and a black screen after login. Looking at the firewall thing and seeing that everyone is using Appvolumes it might be an issue with that.
What appvolumes does during logon is that it restarts the firewall service and makes an export of the firewall in a config file, adds specific rules from appstacks and injects that new policy within the virtual machine. In a healthy enviornment this takes up to 20 seconds to execute (the 20 second gap you guys see), in a very unhealthy enviornment it can take up to 3 minutes leaving the user with a black screen at logon.
Could you please try and check the following file C:\Program Files (x86)\CloudVolumes\Agent\Logs\svservice.log? (You will also see the cvfirewall.cfg file that hgas been exported during login)
And then search for the following lines?
As you can see there is a 28 second gap here in my environment. Could you check and see if timestamps are the same??
[2019-01-24 07:08:42.063 UTC] [svservice:P1700:T4400] RunCommandLineFromService: Launching CommandLine C:\Windows\system32\cmd.exe /c del /q /f "C:\Program Files (x86)\CloudVolumes\Agent\Logs\cvfirewall.cfg" 2>NUL && netsh advfirewall export "C:\Program Files (x86)\CloudVolumes\Agent\Logs\cvfirewall.cfg" && netsh advfirewall import "C:\Program Files (x86)\CloudVolumes\Agent\Logs\cvfirewall.cfg" (CreationFlag 134217760, wait -1 ms)
[2019-01-24 07:08:42.064 UTC] [svservice:P1700:T3768] User has not configured for checking of Windows Update Service status
[2019-01-24 07:08:42.068 UTC] [svservice:P1700:T4400] Successfully launched: C:\Windows\system32\cmd.exe /c del /q /f "C:\Program Files (x86)\CloudVolumes\Agent\Logs\cvfirewall.cfg" 2>NUL && netsh advfirewall export "C:\Program Files (x86)\CloudVolumes\Agent\Logs\cvfirewall.cfg" && netsh advfirewall import "C:\Program Files (x86)\CloudVolumes\Agent\Logs\cvfirewall.cfg" (wait -1 ms)
[2019-01-24 07:09:10.125 UTC] [svservice:P1700:T5232] OnStartShell called (Session ID 1, Handle 000001D7887C4F90, Params 0000005BD92FECC8, Context 0000000000000000)
