Black screen problems with Windows 10 at login

[newpersn]

@Mic_Impero

 

Your thoughts?

[CadlaM]

Hi All,

 

I have been working closely with Impero to have this issue resolved it is Impero and only effects 1511 verision of Windows. They are testing a service pack for the new release which they believe has fixed the issue.

 

Sam, We are 99% on 1607 release, in fact hardly ran any on 1511, and we see it all the time. Think Imp have a new release but nothing in the notes mentions a fix for this problem. We are also on an oldish version of Imp.

[Mic_Impero]

Hi all,

 

Just a quick note to let people know that customers are seeing different instances of black screen at logon, and with different variables in play. Many times we've had this issue reported to us but the fix has been unrelated to Impero. We believe Impero is currently contributing to the black screens, but understand also it's not the only cause. Of course in some schools, it will be the only cause, but I'd urge anyone experiencing the problem and here on the last page of the thread to read it entirely for solutions around graphics drivers etc, as well as contacting us.

 

We currently have in testing a version of Impero with our closed Beta customers, who report that this positively impacts the black screen issue (as planned). Any customer who has a case open with us will be notified as soon as the release goes to open beta and subsequently full release.

 

Where a customer has purchased software perpetually, but has an expired support contract, and has experienced an issue with the software, there are some circumstances we may honor an upgrade to the latest version, or the 'fixed' version closest to your current version, but this is discussed on an individual basis.

I would encourage anyone ( @mattpant ) who is in this situation and wishes to discuss further to contact me directly. I'm not allowed to post my contact details ('geek rules) but please PM me and I'll get in touch as soon as I'm able to.

 

I'll also update this thread with progress on the release when appropriate.

 

Kindest regards

Mic Sanderson

Support Manager

Impero

[Mic_Impero]

Sam, We are 99% on 1607 release, in fact hardly ran any on 1511, and we see it all the time. Think Imp have a new release but nothing in the notes mentions a fix for this problem. We are also on an oldish version of Imp.

Just to clarify; we have a new release out at the moment, but it does not contain this fix. As we found the improvement for this issue, the release we have just made generally available was already nearing the end of open beta. Rather than delay that release, we have put it into the next one which is currently in closed beta stage.

 

Mic

[newpersn]

Just to clarify; we have a new release out at the moment, but it does not contain this fix. As we found the improvement for this issue, the release we have just made generally available was already nearing the end of open beta. Rather than delay that release, we have put it into the next one which is currently in closed beta stage.

 

Mic

 

What sort of ETA is on this @Mic_Impero ?

[Ephelyon]

Do you have any further details on what exactly "the improvement for this issue" boiled down to as well please?

[Mic_Impero]

Hi all,

 

I can't confidently give you timescales on this at the moment, but what I can share is that it's in closed beta, and a closed beta stage usually lasts between 2 and 4 weeks, then becomes open beta; at which point we'll notify you and those customers who'd like the build can download and install it. It's usually then expected to be in open beta for a couple of weeks before full release.

That's all as long as no major issues are discovered; if that were the case there's potential that we could need to go back to the start of testing with another new version and back into the beta processes.

 

We're doing our absolute best to get this out to you as soon as possible, and we're happy with the build so far, but all change carries risk which only the correct (type and amount) of testing can mitigate. The nature of the change is around dll injection, which I believe to be similar to the other causes / fixes unrelated to Impero.

 

Mic

[speckytecky]

I don't feel this is an Impero related issue. Just had the black screen on a W10 Edu 1607. Forced to do a hard restart nd it, thankfully came back up again okay.

[KibosJ]

We are having this issue on 1607 all over the place too, it does seem to be happening a lot less now, but still occurring.

 

Going to test 1703 and see if that fixes the issue.

[timbo343]

I realise this is a thread for the blank screen issue but i seem to think theres a connection between this and start menus that don't work - what i mean by this is a user logs in and the taskbar or start button dont work. The only work around is to restart the machine.

 

Well, this easter holiday ive been apply windows updates to our machines and the start menu issue has occured around the school with network admin.

 

Looking throught the eventviewer of the machines, im seeing DCOM errors again so i thought id do some testing as ive managed to log in 32 machines in a room and about 2 or 3 different machines would fail each time.

 

The error was a cmd.exe error which reported a termination of the application. My first thought was papercut, so i stopped papercut from starting up. This didnt have an affect on the issue.

 

Next thought was a policy, so i chose a room and blocked inhertience to this room so machines wouldnt have any policies applied to them, the problem still occurred, so it had to be something on the machine.

 

I removed sophos from the machines in this room, rebooted them and logged them all on so domain admin, all machines logged on without any issues.

 

So we looked into the error code on the cmd.exe error (0xc0000142) and it turns out theres loads of problems with this and its to do with with key LOADAPPINIT_DLLS been set to 1. Its not just to do with Sophos. The location of this key is HKLM\SOFTWARE\microsoft\windows NT\current version\windows

 

We set this value to 0 and tried around 10 logins via impero in this room each time with no errors.

 

Why is this relevant to the black screen? Could it be that this reg entry is causing issues with black screens and having an affect on broken start menus that dont show when the start button is clicked? Granted we've not seen black screens for a while (well, no one has reported them) but the start issue has caused us problems. We are running windows 10 LTSB2016 across the network with the lateat (April 2017) CU.

 

Just a thought but would be interested to see if others could test this theory out too if they've had black screens or broken start menus/buttons.

[cdwyer]

I realise this is a thread for the blank screen issue but i seem to think theres a connection between this and start menus that don't work - what i mean by this is a user logs in and the taskbar or start button dont work. The only work around is to restart the machine.

 

Well, this easter holiday ive been apply windows updates to our machines and the start menu issue has occured around the school with network admin.

 

Looking throught the eventviewer of the machines, im seeing DCOM errors again so i thought id do some testing as ive managed to log in 32 machines in a room and about 2 or 3 different machines would fail each time.

 

The error was a cmd.exe error which reported a termination of the application. My first thought was papercut, so i stopped papercut from starting up. This didnt have an affect on the issue.

 

Next thought was a policy, so i chose a room and blocked inhertience to this room so machines wouldnt have any policies applied to them, the problem still occurred, so it had to be something on the machine.

 

I removed sophos from the machines in this room, rebooted them and logged them all on so domain admin, all machines logged on without any issues.

 

So we looked into the error code on the cmd.exe error (0xc0000142) and it turns out theres loads of problems with this and its to do with with key LOADAPPINIT_DLLS been set to 1. Its not just to do with Sophos. The location of this key is HKLM\SOFTWARE\microsoft\windows NT\current version\windows

 

We set this value to 0 and tried around 10 logins via impero in this room each time with no errors.

 

Why is this relevant to the black screen? Could it be that this reg entry is causing issues with black screens and having an affect on broken start menus that dont show when the start button is clicked? Granted we've not seen black screens for a while (well, no one has reported them) but the start issue has caused us problems. We are running windows 10 LTSB2016 across the network with the lateat (April 2017) CU.

 

Just a thought but would be interested to see if others could test this theory out too if they've had black screens or broken start menus/buttons.

 

Hi, can I just ask is this a black screen on boot or after logging in?

[timbo343]

Hi, can I just ask is this a black screen on boot or after logging in?

 

It was after login. The login screen showed and users proceeded to login, the machine looked as though session was going to be logged in then suddenly you get a black screen and a the cursor. This has now moved on to the start menu and task bar not working on random machines which is why ive posted about my findings.

Edited April 19, 2017 by timbo343

[stgoodyeara]

I realise this is a thread for the blank screen issue but i seem to think theres a connection between this and start menus that don't work - what i mean by this is a user logs in and the taskbar or start button dont work. The only work around is to restart the machine.

 

Well, this easter holiday ive been apply windows updates to our machines and the start menu issue has occured around the school with network admin.

 

Looking throught the eventviewer of the machines, im seeing DCOM errors again so i thought id do some testing as ive managed to log in 32 machines in a room and about 2 or 3 different machines would fail each time.

 

The error was a cmd.exe error which reported a termination of the application. My first thought was papercut, so i stopped papercut from starting up. This didnt have an affect on the issue.

 

Next thought was a policy, so i chose a room and blocked inhertience to this room so machines wouldnt have any policies applied to them, the problem still occurred, so it had to be something on the machine.

 

I removed sophos from the machines in this room, rebooted them and logged them all on so domain admin, all machines logged on without any issues.

 

So we looked into the error code on the cmd.exe error (0xc0000142) and it turns out theres loads of problems with this and its to do with with key LOADAPPINIT_DLLS been set to 1. Its not just to do with Sophos. The location of this key is HKLM\SOFTWARE\microsoft\windows NT\current version\windows

 

We set this value to 0 and tried around 10 logins via impero in this room each time with no errors.

 

Why is this relevant to the black screen? Could it be that this reg entry is causing issues with black screens and having an affect on broken start menus that dont show when the start button is clicked? Granted we've not seen black screens for a while (well, no one has reported them) but the start issue has caused us problems. We are running windows 10 LTSB2016 across the network with the lateat (April 2017) CU.

 

Just a thought but would be interested to see if others could test this theory out too if they've had black screens or broken start menus/buttons.

 

It's all linked to the same issue. Impero and sophos both inject into dll files. Impero has the facility to exclude files from injection which meant we could improve the issues. I'm lead to believe Impero and sophos have both used the same 3rd party code set to inject the dlls which is why they are both suffering from the same issues.

[cdwyer]

It's all linked to the same issue. Impero and sophos both inject into dll files. Impero has the facility to exclude files from injection which meant we could improve the issues. I'm lead to believe Impero and sophos have both used the same 3rd party code set to inject the dlls which is why they are both suffering from the same issues.

 

I was asking the question about whether this was before or after as earlier today I managed to fix the black screen issue after login by deleting a registry key, what would happen to me is the 'preparing windows' screen would spin and spin and either take an age to reach the desktop or just produce a screen with a black background and a cursor, after deleting said registry key, every machine I've tried (about 6/7 different machines, 2 different accounts) logged in successfully within 30/40 seconds with a fresh profile, no black screen with cursor at all. This is the fastest login we have achieved from a fresh profile since we upgraded from windows 7 to 10. If this is useful to anyone I will let everyone know on this thread tomorrow when I'm at work what the key was.

[cdwyer]

I was asking the question about whether this was before or after as earlier today I managed to fix the black screen issue after login by deleting a registry key, what would happen to me is the 'preparing windows' screen would spin and spin and either take an age to reach the desktop or just produce a screen with a black background and a cursor, after deleting said registry key, every machine I've tried (about 6/7 different machines, 2 different accounts) logged in successfully within 30/40 seconds with a fresh profile, no black screen with cursor at all. This is the fastest login we have achieved from a fresh profile since we upgraded from windows 7 to 10. If this is useful to anyone I will let everyone know on this thread tomorrow when I'm at work what the key was.

 

Just to be clear. This is only to resolve the issue AFTER login, the issue where the machine boots to a black screen and cursor I am still battling with and have had confirmation from Impero that this is an issue with Impero they are working on.

[timbo343]

It's all linked to the same issue. Impero and sophos both inject into dll files. Impero has the facility to exclude files from injection which meant we could improve the issues. I'm lead to believe Impero and sophos have both used the same 3rd party code set to inject the dlls which is why they are both suffering from the same issues.

Sometimes its up to us to find the solutions though. Ive tried excluding things via imperos exclusion list but its not having any improvement. If we report on new findings, we can see if things improve as a group.

[timbo343]

Just to be clear. This is only to resolve the issue AFTER login, the issue where the machine boots to a black screen and cursor I am still battling with and have had confirmation from Impero that this is an issue with Impero they are working on.

Id be keen to see what key was deleted, then others who are also having this issue could test it too, but id advise people to test the LOADAPPID_DLLS change too. I guess you're on an anniversary build of win 10.

 

Ive been reading a lot about this key and black screens.

Edited April 19, 2017 by timbo343

[Ephelyon]

Same here!

[cdwyer]

So under User Configuration, Preferences & then registry, I set a new registry item to delete the key 'HKEY_CURRENT_USER\UserSID\Software\Microsoft\Windows\CurrentVersion\UFH\SHC'

 

This needs to be done as a user policy. I set the order as 1 (whether this is necessary I don't know)

 

Do not set this to 'once and do not reapply' keep it set indefinitely.

 

After doing this, I noticed an immediate difference in login speeds and haven't experienced the black screen issue at all since, which was midday yesterday.

 

I hope this helps.

[timbo343]

So under User Configuration, Preferences & then registry, I set a new registry item to delete the key 'HKEY_CURRENT_USER\UserSID\Software\Microsoft\Windows\CurrentVersion\UFH\SHC'

 

This needs to be done as a user policy. I set the order as 1 (whether this is necessary I don't know)

 

Do not set this to 'once and do not reapply' keep it set indefinitely.

 

After doing this, I noticed an immediate difference in login speeds and haven't experienced the black screen issue at all since, which was midday yesterday.

 

I hope this helps.

 

That's interesting as our mandatory profiles for 1511 have this key removed when the profiles were setup. Now on 1607, we don't touch the registry when creating the mandatory profile.

 

From my notes on creating a mandatory profile for 1511 profiles (v5)

Do a search for the test_AD_account username and delete all blocks of keys that this user relates to. You should have the following…

 .\Software\Microsoft\Active Setup – Delete all Active Setup Blocks

 .\Software\Microsoft\Internet Explorer – Delete the Suggested Sites key block

 .\Software\Microsoft\Media Player – Delete the Preferences key block

 .\Software\Microsoft\Windows\Current Version\Explorer – Delete all keys relating to CD Burning

 .\Software\Microsoft\Windows\Current Version\Explorer\Shell Folders – Delete all reg entries barring “!Do not use this reg key” & “Fonts”. Everything else under this key can be deleted.

 .\Software\Microsoft\Windows\Current Version\Push Notifications – Delete the wpnidm key block.

 .\Software\Microsoft\Windows\Current Version\UFH\SHC – delete all reference reg values (not keys) that have the user’s AD login name.

 .\Software\Microsoft\Windows Search\Processed Search Roots – delete the key block “Default” if the user name is found in any strings

 .\Software\WOW6432Node\Microsoft – Delete the Active Setup key Block

 

After searching the HIVE in Regedit for the test username, references found in:

 .\Software\Microsoft\OneDrive\ - delete OneDrive key

 .\Software\Microsoft\Windows NT\Current Version\AppCompatFlags\Compatibility Assistant\Store – Deleted the Store key.

[mavhc]

So under User Configuration, Preferences & then registry, I set a new registry item to delete the key 'HKEY_CURRENT_USER\UserSID\Software\Microsoft\Windows\CurrentVersion\UFH\SHC'

 

This needs to be done as a user policy. I set the order as 1 (whether this is necessary I don't know)

 

Do not set this to 'once and do not reapply' keep it set indefinitely.

 

After doing this, I noticed an immediate difference in login speeds and haven't experienced the black screen issue at all since, which was midday yesterday.

 

I hope this helps.

 

That's the start menu cache, for people who don't know. I guess something in the cache is missing and it's slowing it all down

[timbo343]

So under User Configuration, Preferences & then registry, I set a new registry item to delete the key 'HKEY_CURRENT_USER\UserSID\Software\Microsoft\Windows\CurrentVersion\UFH\SHC'

 

This needs to be done as a user policy. I set the order as 1 (whether this is necessary I don't know)

 

Do not set this to 'once and do not reapply' keep it set indefinitely.

 

After doing this, I noticed an immediate difference in login speeds and haven't experienced the black screen issue at all since, which was midday yesterday.

 

I hope this helps.

Do you keep the local profiles on the machines after the users have logged off? Im just thinking why you dont keep applying the change as you have apply once set.

[cdwyer]

Yes we do, I was under the impression that key would be recreated If I only set once, I may be wrong.

[kennysarmy]

Sorry to resurrect an old thread but we have some older PC's here where 50% of the room at logon will get a black screen, they are able to press CTRL+ALT+DEL and Sign Out and "usually" signing in again is fine, but sometimes they have to move to another PC.

 

I've checked Event Logs for Errors in SYSTEM and found the following:

 

10010

The server Windows.Internal.StateRepository.User did not register with DCOM within the required timeout.

 

 

19

The KDC certificate for the domain controller does not contain the KDC Extended Key Usage (EKU): 1.3.6.1.5.2.3.5: Error Code 0xc0000320. The domain administrator will need to obtain a certificate with the KDC EKU for the domain controller to resolve this error. When using Windows Server Certificate Services create a certificated based on the Kerberos Authentication Template.

 

 

 

5719

This computer was not able to set up a secure session with a domain controller in domain CURRICULUM due to the following:

An internal error occurred.

This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

 

 

Can anyone shed any light on which if any of these might be related to a black screen at logon?

 

I believe if the student leaves the PC long enough that it does eventually logon fine, but we're talking 10 minutes

 

Thanks.

[Koldov]

We have the same problem here, but I haven't had time to look into it in any detail. Just CTRL+ALT+DEL, sign out and sign in works, but it still takes a while...