gwendes Posted March 28, 2018 Posted March 28, 2018 (edited) Absolutely at a loss where to go next with this. Over the last two months computers on our network have been booting to a black screen and cursor. Unable to do anything from there. The one key combination that does do something is Windows - P, but all the options give the same screen. Black screen, white cursor. We've tried adding a second monitor, nothing. Safe Mode is the same, as is taking out of AD The computers can have been recently reimaged, or in service for years without issue. It's affected every type of hardware that we have, from the new i5/SSD desktops, to older laptops. There's no logical pattern. We've not worked out a way to bring a machine back online once it's died. We do have access to admin C$ share, as well as connecting remotely to eventvwr/registry... so Windows seems to boot, but gets stuck somewhere! Shell - Explorer is present in the registry. Latest graphics drivers deployed for the newer machines (but like I said, it's not hardware specific) Virus scans are done daily on all, nothing detected. Definitions are up to date. Anyone seen this before? So far it's affected around 50/850. Some immediately after reimaging, some after years without issue. Edited March 28, 2018 by gwendes
Andycat Posted March 28, 2018 Posted March 28, 2018 A restart fixes ours. There was talk of it being related to Impero at one point, if you have that, but not sure now.
FishCustard Posted March 28, 2018 Posted March 28, 2018 Anything interesting in the event log? If not - Process Monitor and a boot trace should tell you what's going on: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool
gwendes Posted March 28, 2018 Author Posted March 28, 2018 A restart fixes ours. There was talk of it being related to Impero at one point, if you have that, but not sure now. Nope. Restart doesn't fix and we don't have Impero.
gwendes Posted March 28, 2018 Author Posted March 28, 2018 Anything interesting in the event log? If not - Process Monitor and a boot trace should tell you what's going on: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool Nothing interesting at all. The system seems to be completely booted. I can VNC to it, access shares, see eventvwr/registry... but nobody can log on, and we haven't found a way to get any back to a logon screen. Everything points to malware, but it's not event spreading in a logical way. All last week we had one computer go down on Thursday, that was it. Today we've already had about five or six.
FishCustard Posted March 28, 2018 Posted March 28, 2018 Nothing interesting at all. The system seems to be completely booted. I can VNC to it, access shares, see eventvwr/registry... but nobody can log on, and we haven't found a way to get any back to a logon screen. Everything points to malware, but it's not event spreading in a logical way. All last week we had one computer go down on Thursday, that was it. Today we've already had about five or six. Yeah, try the procmon route - it'll create a file that you can retrieve via the admin share (\\unc\c$). 1
gwendes Posted March 28, 2018 Author Posted March 28, 2018 Yeah, try the procmon route - it'll create a file that you can retrieve via the admin share (\\unc\c$). Do you know if it's possible to install with SCCM/Group Policy? As we don't know where the problem is going to strike next! Or, is there a way to run on a system that's already gone down? #longshot
chazzy2501 Posted March 28, 2018 Posted March 28, 2018 We had a spate of this and it was an issue with our intel graphics driver and PowerPoint 2013. The issue was the laptops going into sleep mode whilst a PowerPoint was open (NOT Running, just open) 1
sted Posted March 28, 2018 Posted March 28, 2018 it sounds a bit like the pc is in duplicate screen mode and the main screen is being detected as screen 2 windows p and set to duplicate should fix it baring that there is a command you can run to do that maybe try rdping into one and running that command 1
gwendes Posted March 28, 2018 Author Posted March 28, 2018 it sounds a bit like the pc is in duplicate screen mode and the main screen is being detected as screen 2 windows p and set to duplicate should fix it baring that there is a command you can run to do that maybe try rdping into one and running that command Yeah, I thought that, but it's been tried. See above.
gwendes Posted March 28, 2018 Author Posted March 28, 2018 We had a spate of this and it was an issue with our intel graphics driver and PowerPoint 2013. The issue was the laptops going into sleep mode whilst a PowerPoint was open (NOT Running, just open) Happening even with computers on Nvidia dedicated graphics. The latest Intel HD drivers are installed (by SCCM) and you can see from the registry that it's correctly installed. We pushed out the latest drivers in the hope that was the problem. Since then plenty of non-Intel computers have developed the same fault! :/
clareq Posted March 28, 2018 Posted March 28, 2018 If you RDC to it, can you then see the screen? Could it be a resolution issue?
FishCustard Posted March 28, 2018 Posted March 28, 2018 Do you know if it's possible to install with SCCM/Group Policy? As we don't know where the problem is going to strike next! Or, is there a way to run on a system that's already gone down? #longshot Could try using psexec to run procmon.exe, see what comes up? 1
ReadTheNetwork Posted March 28, 2018 Posted March 28, 2018 I would guess it's a graphics driver - but you said it's the same with safe mode. So it's probably not a graphics driver but I would try disabling the graphics driver so it uses the basic VGA driver. Sometimes using the latest driver could have a fault. Check your SCCM deployments to see if there's a certain deployment which may look like a driver or update being installed? It might be the day previous to the computer not working (due to the reboot).
gwendes Posted March 28, 2018 Author Posted March 28, 2018 I would guess it's a graphics driver - but you said it's the same with safe mode. So it's probably not a graphics driver but I would try disabling the graphics driver so it uses the basic VGA driver. Sometimes using the latest driver could have a fault. Check your SCCM deployments to see if there's a certain deployment which may look like a driver or update being installed? It might be the day previous to the computer not working (due to the reboot). No luck with that. Even took the card from a machine with a Quadro 600 in it and used the on board with no drivers.
gwendes Posted March 28, 2018 Author Posted March 28, 2018 Could try using psexec to run procmon.exe, see what comes up? I used psexec to run sfc /scannow and that's fixed it! Thanks for putting my brain into that way of thinking This works! psexec \\COMPUTERNAME -u administrator -p -accepteula sfc /scannow I've now got the logs from two machines so hopefully can identify what is getting corrupted and fixed. But after I get back from holiday *passes job to colleagues* Cheers all.
LeMarchand Posted March 28, 2018 Posted March 28, 2018 I used psexec to run sfc /scannow and that's fixed it! Thanks for putting my brain into that way of thinking This works! psexec \\COMPUTERNAME -u administrator -p -accepteula sfc /scannow I've now got the logs from two machines so hopefully can identify what is getting corrupted and fixed. But after I get back from holiday *passes job to colleagues* Cheers all. I'm now praying that the unit I just sent back under warranty didn't have this problem! (Similar symptoms...) Can you post if you find out the cause, just in case?
ReadTheNetwork Posted March 29, 2018 Posted March 29, 2018 If you have one working machine and one faulty of the same make and model. Are you able to do a comparison of updates, drivers and software installed? Unfortunately, it might take some time. This link might help: https://social.technet.microsoft.com/wiki/contents/articles/4197.how-to-list-all-of-the-windows-and-software-updates-applied-to-a-computer.aspx I'm thinking if the faulty PC has an update the working one doesn't it might prompt something? --- I see you fixed it ignore that
PaulPierce8 Posted April 23, 2018 Posted April 23, 2018 Are you up to date on the Windows updates? We had this issue last year and it was a rogue update that caused it on 50% of machines which we had to roll back.
gwendes Posted July 6, 2018 Author Posted July 6, 2018 I'm now praying that the unit I just sent back under warranty didn't have this problem! (Similar symptoms...) Can you post if you find out the cause, just in case? Sorry, I missed this. We still have the same issue, it's much rarer now, but still happens. No idea of the cause. Hoping that the move of all machines to Windows 10 will resolve!
gwendes Posted July 6, 2018 Author Posted July 6, 2018 If you have one working machine and one faulty of the same make and model. Are you able to do a comparison of updates, drivers and software installed? Unfortunately, it might take some time. This link might help: https://social.technet.microsoft.com/wiki/contents/articles/4197.how-to-list-all-of-the-windows-and-software-updates-applied-to-a-computer.aspx I'm thinking if the faulty PC has an update the working one doesn't it might prompt something? --- I see you fixed it ignore that 'Fixed' = only found *a* fix. The problem still randomly (albeit much more rarely) happens!
LeMarchand Posted July 6, 2018 Posted July 6, 2018 Sorry, I missed this. We still have the same issue, it's much rarer now, but still happens. No idea of the cause. Hoping that the move of all machines to Windows 10 will resolve! Well the unit came back with a new parts so hopefully it was a genuine warranty case!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now