timbo343 Posted January 17, 2017 Author Posted January 17, 2017 Ive had 2 today. But i just added some of your fixes that you tired. I get a black screen when i reimange a computer, join it to the domain and login as me. Everything looks alright. Have you got anything in the login scripts? We have some bits in the logon scripts like the papercut client but i wouldnt have thought this would've caused any issues. I did just find "remove ie without addons link" in our student login vbs login script. This *might* have had something to do with it, but i doubt it very much.
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 Firstly, thank you everyone for the information that is being shared on here – we have been following along and using this information to guide our own testing. Our summary is that there is an inherent issue in Windows that causes the black screen, and we continue to investigate whether our software is somehow exasperating that issue. In order to help us investigate, we would welcome the opportunity to examine a machine in this black screen state – our own internal testing has shown a few examples of black screens, but not in the manner described in this thread. If anyone is able to recreate the issue, or is able to leave a machine in this state whilst we establish a remote session and investigate then we would be very grateful. Please ring our support number and we’ll jump straight onto your system – we have developers on standby to investigate! Darren. (Impero Tech Team.) We had 2 black screens yesterday but couldnt ring support as i turned on "System Cryptography: Use FIPS compliant algorthms for encryption, hashing and signing" as i saw some SChannel errors on some machines (A fatal error occurred while creating a TLS client credential. The internal error state is 10013.) Looking further into this, it could be Sophos
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 We are also getting the black screen of death issue on Windows 10 machines. The client logs in but then gets a black screen with just a mouse. When you go to the impero console you can see that clients computer duplicated a number of times. The only way to fix this for us is to select all duplicates[ATTACH=CONFIG]40652[/ATTACH] of that client and restart them. Once it comes back online the duplicates have gone from the impero console and the user can log in. Checking the event viewer the faulting application name is ImperoWinlogonApplication.exe and the faulting module name is KERNELBASE.dll. This information has been sent on to impero but still no fix. We are considering moving away from impero due to the last few updates causing more issues than solutions. I use to love impero and recommend it all the time but as this continues i can no longer do that. See the attached image of the event viewer error. We got the following 2 errors: Faulting application name: ImperoWinlogonApplication.exe, version: 5.4.38.0, time stamp: 0x5836cabc Faulting module name: KERNELBASE.dll, version: 10.0.14393.321, time stamp: 0x57f4c291 Exception code: 0xc06d007e Fault offset: 0x000da6f2 Faulting process id: 0x10d8 Faulting application start time: 0x01d26d96581d8c94 Faulting application path: C:\Program Files (x86)\Impero Solutions Ltd\Impero Client\ImperoWinlogonApplication.exe Faulting module path: C:\windows\System32\KERNELBASE.dll Report Id: 8061db18-daf0-4d84-8d4d-3406e86b5df1 Faulting package full name: Faulting package-relative application ID: Faulting application name: imperoclient.exe, version: 5.4.38.0, time stamp: 0x5836cab5 Faulting module name: KERNELBASE.dll, version: 10.0.14393.321, time stamp: 0x57f4c291 Exception code: 0xc06d007e Fault offset: 0x000da6f2 Faulting process id: 0xfe4 Faulting application start time: 0x01d26d96581cf999 Faulting application path: C:\Program Files (x86)\Impero Solutions Ltd\Impero Client\imperoclient.exe Faulting module path: C:\windows\System32\KERNELBASE.dll Report Id: 3f3ec6e6-eade-476e-b502-11fef72b4028 Faulting package full name: Faulting package-relative application ID: I spoke to Impero Support and they told me to add KERNELBASE.DLL to the list of exclusions.
newpersn Posted January 17, 2017 Posted January 17, 2017 Here is the errors i get when i first logon to a computer after a reimage: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} and APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 10:00:28 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.10:00:29 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 10:00:29 After about 5mins (max) it will go to desktop.
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 Look the APPIDs up in registry... HKEY_CLASSES_ROOT>AppID>{ID_NUMBER} This will tell you what is trying to run on your machine. More than likely it will be some windows trash that you should be able to turn off via services. 1
newpersn Posted January 17, 2017 Posted January 17, 2017 Look the APPIDs up in registry... HKEY_CLASSES_ROOT>AppID>{ID_NUMBER} This will tell you what is trying to run on your machine. More than likely it will be some windows trash that you should be able to turn off via services. Well i had a look: F72671A9-012C-4725-9D2F-2A4D32D65169} is (Value not set) 4839DDB7-58C2-48F5-8283-E1D1807D0D7D is ShellService Host
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 These might help: https://www.sysnative.com/forums/windows-update/20876-window-10-ver-1607-anniversary-update-various-issues-findings.html or https://www.tenforums.com/general-support/58449-local-activation-permission-3.html Have a look at the CLSIDs too.
newpersn Posted January 17, 2017 Posted January 17, 2017 These might help: https://www.sysnative.com/forums/windows-update/20876-window-10-ver-1607-anniversary-update-various-issues-findings.html or https://www.tenforums.com/general-support/58449-local-activation-permission-3.html Have a look at the CLSIDs too. Is there a way to do this via GPO?
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 After further looking... The {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} i think is part for the OneDrive Sync. This can be turned off via services. The {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} can be found here... https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/distributedcom-errors-flooding-event-log/22701266-e81e-40a5-9fb4-780519363f59 Im not sure if a GPO can sort this. 1
newpersn Posted January 17, 2017 Posted January 17, 2017 After further looking... The {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} i think is part for the OneDrive Sync. This can be turned off via services. The {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} can be found here... https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/distributedcom-errors-flooding-event-log/22701266-e81e-40a5-9fb4-780519363f59 Im not sure if a GPO can sort this. Just added OneSyncSvc_7e15b to Stop and Disable within services of GPO.
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 Also add the CDPSvc which is the ConnectedDevicesPlatform. This is syncs mail, calendars etc. 1
newpersn Posted January 17, 2017 Posted January 17, 2017 Also add the CDPSvc which is the ConnectedDevicesPlatform. This is syncs mail, calendars etc. Already did that one. The only thing i done is added any of the impero bypass. 1
newpersn Posted January 17, 2017 Posted January 17, 2017 This is what's also happening on mine when I log in to the computer after a reimage.
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 What version of win 10 are you using?
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 Thats possibly why you are seeing these processes as its EDU. We dont see them as we are running LTSB - its much cleaner. The tile data stuff is to do with the start menu. Windows defender will stop working once you put on an AV. You could stop the service via services. 1
newpersn Posted January 17, 2017 Posted January 17, 2017 Thats possibly why you are seeing these processes as its EDU. We dont see them as we are running LTSB - its much cleaner. The tile data stuff is to do with the start menu. Windows defender will stop working once you put on an AV. You could stop the service via services. How do i get around the start menu? Does seem to hang around on that.
timbo343 Posted January 17, 2017 Author Posted January 17, 2017 You possibly need to remove all the bloatware that is installed on windows 10 after youve deployed the image. This is one of the reasons why we went LTSB.
newpersn Posted January 17, 2017 Posted January 17, 2017 Pretty sure I got a powershell script at the end of mdt that should run....
newpersn Posted January 17, 2017 Posted January 17, 2017 Pretty sure I got a powershell script at the end of mdt that should run....
timbo343 Posted January 18, 2017 Author Posted January 18, 2017 You could stop the Tile Data Model Server in services. That might help. We had an issue with the TileDataLayer in the user's local folder when testing Education which caused no end of problems with our logins - another reason why we went to LTSB.
newpersn Posted January 18, 2017 Posted January 18, 2017 You could stop the Tile Data Model Server in services. That might help. We had an issue with the TileDataLayer in the user's local folder when testing Education which caused no end of problems with our logins - another reason why we went to LTSB. I will try and i will look in to LTSB when i next rebuild my image.
timbo343 Posted January 18, 2017 Author Posted January 18, 2017 I will try and i will look in to LTSB when i next rebuild my image. Compare the 2 and see what works or you. There are features of EDU that we don't miss and we don't run edge. We still use IE11 here and if push came to shove, we'd move to chrome.
timbo343 Posted January 19, 2017 Author Posted January 19, 2017 I'm going to look at this black screen problem from another angle. I've been looking at a few event viewer system logs of machines and i'm seeing: This computer was not able to set up a secure session with a domain controller in domain xxxxxx due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain. MS say ignore the error.. (https://social.technet.microsoft.com/Forums/office/en-US/2fe6bb7f-3b93-4d8b-ab50-ad4b132b3d8e/computer-was-not-able-to-setup-a-secure-session-with-a-domain-controller?forum=w7itpronetworking) If you can correctly log on to the domain, you can safely ignore event ID 5719. Because the Netlogon service may start before the network is ready, the computer may be unable to locate the logon domain controller. Therefore, event ID 5719 is logged. However, after the network is ready, the computer will try again to locate the logon domain controller. In this situation, the operation should be successful. but this got me thinking. What if the NETLOGON service is having an issue or the network drivers are causing an issue. We never had anything like this with Windows 7 even though the guy on the MS forum is running windows 7.. It's just a thought.
timbo343 Posted February 1, 2017 Author Posted February 1, 2017 We had 2 black screens yesterday within the space of 10 mins. Looking into the eventvwr of these machines we saw the following: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout. and The server {3EB3C877-1F16-487C-9050-104DBCD66683} did not register with DCOM within the required timeout. The first error has reference to the Thumbnail Cache Classs Factory For Out of Proc Server. Under CLSID{keyname}\ImprocServer32 this translates to thumbcache.dll. Im unsure why this would not be working but its interesting that this could have caused the black screen. The second error has reference to WinInetCacheServer. Im not sure why this would be causing and errors but i've found out that there is a schedule task on all win10 machines under Task Scheduler Library > Microsoft > Windows > Wininet. This schedule task runs at log on of any user and the action is "Custom Handler" what ever that means. A lot of sites say running SFC /scannow on machines affected will stop the issue. I tried this yesterday and lets say it reverted all the changes we made to the default apps, etc that we made when the image was created.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now