Black screen problems with Windows 10 at login

[timbo343]

Hi All, We are also having the black screen problems. We have added the exclusions and now received the CMD error. Has anyone anymore ideas?

 

I've added cmd.exe to the list of exclusions now.

[stgoodyeara]

I've added cmd.exe to the list of exclusions now.

 

Why don't you just add *.* you must have almost excluded everything by now

[Mic_Impero]

@Ephelyon

 

Thank you for that, I will pass this onto the QA and Dev team.

 

Mic

[samb56]

Do we have any updates on this, we are now seeing logins fail because of the exclusions being added.

[FragglePete]

I've had five machines today do this. I believe all the machines in this case had just done a windows update. Not sure if related but not had time to investigate further today.

 

Pete

[timbo343]

Do we have any updates on this, we are now seeing logins fail because of the exclusions being added.

What have you got in your exclusions, just out of interest?

[samb56]

 

Please see the information below

[mshakespeare]

We are also getting the black screen of death issue on Windows 10 machines. The client logs in but then gets a black screen with just a mouse. When you go to the impero console you can see that clients computer duplicated a number of times. The only way to fix this for us is to select all duplicates of that client and restart them. Once it comes back online the duplicates have gone from the impero console and the user can log in. Checking the event viewer the faulting application name is ImperoWinlogonApplication.exe and the faulting module name is KERNELBASE.dll. This information has been sent on to impero but still no fix. We are considering moving away from impero due to the last few updates causing more issues than solutions. I use to love impero and recommend it all the time but as this continues i can no longer do that. See the attached image of the event viewer error.

[timbo343]

We are also getting the black screen of death issue on Windows 10 machines. The client logs in but then gets a black screen with just a mouse. When you go to the impero console you can see that clients computer duplicated a number of times. The only way to fix this for us is to select all duplicates[ATTACH=CONFIG]40652[/ATTACH] of that client and restart them. Once it comes back online the duplicates have gone from the impero console and the user can log in. Checking the event viewer the faulting application name is ImperoWinlogonApplication.exe and the faulting module name is KERNELBASE.dll. This information has been sent on to impero but still no fix. We are considering moving away from impero due to the last few updates causing more issues than solutions. I use to love impero and recommend it all the time but as this continues i can no longer do that. See the attached image of the event viewer error.

 

We get that on a few machines at log off but doesnt cause the black screen. We havent had a black screen issue for a while now. I've turned loads of services off and added a few exceptions to the impero expections list.

 

We occasionally get a critical error warning on random machines at random times. That's to do with Cortana (we are running a mix of LTSB 2015 & 2016). Students at the moment have LTSB 2016 as it's easier to update their machines than staff machines. Staff machines will get upgraded when we feel the need to.

[alfatec]

We redid our local profile and that has practically stopped the black screen problem. We use Impero but do not put any exceptions in.

[samb56]

Hi Tim,

 

What other exclusions have you got added?

 

Kind Regards

 

 

 

Sam Berry

[timbo343]

Hi Tim,

 

What other exclusions have you got added?

 

Kind Regards

 

 

 

Sam Berry

 

We have a fair few in there at the moment:

 

userinit.exe

explorer.exe

wscript.exe

unregmp2.exe

ie4uinit.exe

fsquirt.exe

RAVCpl64.exe

cmd.exe

 

And in GPO, ive changed the following services:

WinDefend | Stop Service | Disabled

wisvc | Stop Service | Disabled

ffsvc | Stop Service | Disabled

wuauserv | No Change | Manual

DiagTrack | Stop Service | Disabled

CDPSvc | Stop Service | Disabled

[timbo343]

We have a fair few in there at the moment:

 

userinit.exe

explorer.exe

wscript.exe

unregmp2.exe

ie4uinit.exe

fsquirt.exe

RAVCpl64.exe

cmd.exe

 

And in GPO, ive changed the following services:

WinDefend | Stop Service | Disabled

wisvc | Stop Service | Disabled

ffsvc | Stop Service | Disabled

wuauserv | No Change | Manual

DiagTrack | Stop Service | Disabled

CDPSvc | Stop Service | Disabled

 

To add to this, i've also setup app locker on the following EXEs...

 

%SYSTEM32%\OneDriveSetup.exe | Deny | EVERYONE

%SYSTEM32%\MusNotification.exe | Deny | EVERYONE - Windows update notification popup

%SYSTEM32%\MusNotificationUx.exe | Deny | EVERYONE - Windows update notification popup

 

When troubleshooting the black screens, i had a incline that OneDrive was trying to update its self.

[ITGURU]

So glad I don't use any of these products. Unless they work with Microsoft for testing, you cannot let 3rd party software inject into Microsoft products without there being issues.

 

We ran Ranger Remote in the very early days and that was enough to put me off.

[DarrenF]

Firstly, thank you everyone for the information that is being shared on here – we have been following along and using this information to guide our own testing. Our summary is that there is an inherent issue in Windows that causes the black screen, and we continue to investigate whether our software is somehow exasperating that issue.

 

In order to help us investigate, we would welcome the opportunity to examine a machine in this black screen state – our own internal testing has shown a few examples of black screens, but not in the manner described in this thread. If anyone is able to recreate the issue, or is able to leave a machine in this state whilst we establish a remote session and investigate then we would be very grateful. Please ring our support number and we’ll jump straight onto your system – we have developers on standby to investigate!

 

Darren.

(Impero Tech Team.)

[timbo343]

Ill be more than happy to do this however we've not seen a black screen for a while now. As soon as we do, ill be on the blower

[Katy]

Not using Impero but also have had the black screen issue. In the logs it looked like explorer.exe was repeadedly crashing. In the end I had to just re-image the PCs - I think it was roughly the same time I pushed out some software that adds itself to the explorer context menu (can't remember what it was, probably something like Acrobat reader) but only happened on random machines, and the head of computing said they did eventually launch explorer after about 10-15 minutes.

 

However not had it reported since the end of November where we re-images the random selection of PCs that had the problem.

[newpersn]

To add to this, i've also setup app locker on the following EXEs...

 

%SYSTEM32%\OneDriveSetup.exe | Deny | EVERYONE

%SYSTEM32%\MusNotification.exe | Deny | EVERYONE - Windows update notification popup

%SYSTEM32%\MusNotificationUx.exe | Deny | EVERYONE - Windows update notification popup

When troubleshooting the black screens, i had a incline that OneDrive was trying to update its self.

 

Thanks for this. Whats the MusNotification.exe? Hows that related to Windows update?

[timbo343]

Thanks for this. Whats the MusNotification.exe? Hows that related to Windows update?

 

Its part of the notification that's shown when there's updates to be installed. Our users got annoyed with seeing it and the only way to get rid of it was to click Get Updates (or whatever the button is) and load up the updates screen. Even though we've set all the options in group policy, the notification still came back so the only way to stop it was to stop the EXE.

[newpersn]

Its part of the notification that's shown when there's updates to be installed. Our users got annoyed with seeing it and the only way to get rid of it was to click Get Updates (or whatever the button is) and load up the updates screen. Even though we've set all the options in group policy, the notification still came back so the only way to stop it was to stop the EXE.

 

Think i may love you..... Been looking at blocking it as its annoying staff here.

[Ephelyon]

Me too... we've gone for a more heavy-handed approach here since we passed the point of having more machines on Windows 10 than Windows 7.

 

Essentially I keep the Windows Update service stopped and disabled through Group Policy for all Windows 10 workstations, then I download the .cab files for latest Cumulative Update (plus any random others like Servicing Stack updates) every month and deploy them via a startup script at some point when everyone's gone home. The script checks the UBR value in the Registry for the workstation's build number and exits if it's current, so whenever there are new updates I just drop them in the deployment folder (replacing the old ones) and update the minimum build value to check for in the script - five-minute job, then reboot all workstations via Impero. Makes things so much easier now we have Cumulative Updates and saves on bandwidth of individual workstations checking for them (even if not actually downloading them) and means I have total control over what build number we have around the school. I also slipstream them into the image every month for new deployments.

 

That said, perhaps @timbo343's solution is more elegant...

[newpersn]

I just wish Windows 10 would listen to the GPO and do what its ment to do. (i'll start a topic for that.)

[timbo343]

I just wish Windows 10 would listen to the GPO and do what its ment to do. (i'll start a topic for that.)

It does doesnt it? Its just that there are a few major things missing from group policy.

[timbo343]

Back on topic, we are still getting black screens. No one has reported any, thats why we didnt know.

[newpersn]

Back on topic, we are still getting black screens. No one has reported any, thats why we didnt know.

 

Ive had 2 today. But i just added some of your fixes that you tired. I get a black screen when i reimange a computer, join it to the domain and login as me. Everything looks alright. Have you got anything in the login scripts?