Computers randomly booting to a black screen and cursor (before logon)

[gwendes]

Absolutely at a loss where to go next with this. Over the last two months computers on our network have been booting to a black screen and cursor. Unable to do anything from there.

 

The one key combination that does do something is Windows - P, but all the options give the same screen. Black screen, white cursor. We've tried adding a second monitor, nothing.

 

Safe Mode is the same, as is taking out of AD

 

The computers can have been recently reimaged, or in service for years without issue. It's affected every type of hardware that we have, from the new i5/SSD desktops, to older laptops. There's no logical pattern. We've not worked out a way to bring a machine back online once it's died. We do have access to admin C$ share, as well as connecting remotely to eventvwr/registry... so Windows seems to boot, but gets stuck somewhere! Shell - Explorer is present in the registry.

 

Latest graphics drivers deployed for the newer machines (but like I said, it's not hardware specific)

 

Virus scans are done daily on all, nothing detected. Definitions are up to date.

 

Anyone seen this before? So far it's affected around 50/850. Some immediately after reimaging, some after years without issue.

Edited March 28, 2018 by gwendes

[Andycat]

A restart fixes ours. There was talk of it being related to Impero at one point, if you have that, but not sure now.

[FishCustard]

Anything interesting in the event log? If not - Process Monitor and a boot trace should tell you what's going on: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool

[gwendes]

A restart fixes ours. There was talk of it being related to Impero at one point, if you have that, but not sure now.

 

Nope. Restart doesn't fix and we don't have Impero.

[gwendes]

Anything interesting in the event log? If not - Process Monitor and a boot trace should tell you what's going on: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool

 

Nothing interesting at all. The system seems to be completely booted. I can VNC to it, access shares, see eventvwr/registry... but nobody can log on, and we haven't found a way to get any back to a logon screen. Everything points to malware, but it's not event spreading in a logical way. All last week we had one computer go down on Thursday, that was it. Today we've already had about five or six.

[FishCustard]

Nothing interesting at all. The system seems to be completely booted. I can VNC to it, access shares, see eventvwr/registry... but nobody can log on, and we haven't found a way to get any back to a logon screen. Everything points to malware, but it's not event spreading in a logical way. All last week we had one computer go down on Thursday, that was it. Today we've already had about five or six.

 

Yeah, try the procmon route - it'll create a file that you can retrieve via the admin share (\\unc\c$).

[gwendes]

Yeah, try the procmon route - it'll create a file that you can retrieve via the admin share (\\unc\c$).

 

Do you know if it's possible to install with SCCM/Group Policy? As we don't know where the problem is going to strike next! Or, is there a way to run on a system that's already gone down? #longshot

[chazzy2501]

We had a spate of this and it was an issue with our intel graphics driver and PowerPoint 2013. The issue was the laptops going into sleep mode whilst a PowerPoint was open (NOT Running, just open)

[sted]

it sounds a bit like the pc is in duplicate screen mode and the main screen is being detected as screen 2 windows p and set to duplicate should fix it baring that there is a command you can run to do that maybe try rdping into one and running that command

[gwendes]

it sounds a bit like the pc is in duplicate screen mode and the main screen is being detected as screen 2 windows p and set to duplicate should fix it baring that there is a command you can run to do that maybe try rdping into one and running that command

 

Yeah, I thought that, but it's been tried. See above.

[gwendes]

We had a spate of this and it was an issue with our intel graphics driver and PowerPoint 2013. The issue was the laptops going into sleep mode whilst a PowerPoint was open (NOT Running, just open)

 

Happening even with computers on Nvidia dedicated graphics. The latest Intel HD drivers are installed (by SCCM) and you can see from the registry that it's correctly installed. We pushed out the latest drivers in the hope that was the problem. Since then plenty of non-Intel computers have developed the same fault! :/

[clareq]

If you RDC to it, can you then see the screen? Could it be a resolution issue?

[FishCustard]

Do you know if it's possible to install with SCCM/Group Policy? As we don't know where the problem is going to strike next! Or, is there a way to run on a system that's already gone down? #longshot

 

Could try using psexec to run procmon.exe, see what comes up?

[ReadTheNetwork]

I would guess it's a graphics driver - but you said it's the same with safe mode. So it's probably not a graphics driver but I would try disabling the graphics driver so it uses the basic VGA driver. Sometimes using the latest driver could have a fault.

 

Check your SCCM deployments to see if there's a certain deployment which may look like a driver or update being installed? It might be the day previous to the computer not working (due to the reboot).

[gwendes]

I would guess it's a graphics driver - but you said it's the same with safe mode. So it's probably not a graphics driver but I would try disabling the graphics driver so it uses the basic VGA driver. Sometimes using the latest driver could have a fault.

 

Check your SCCM deployments to see if there's a certain deployment which may look like a driver or update being installed? It might be the day previous to the computer not working (due to the reboot).

 

No luck with that. Even took the card from a machine with a Quadro 600 in it and used the on board with no drivers.

[gwendes]

 

Could try using psexec to run procmon.exe, see what comes up?

 

I used psexec to run sfc /scannow and that's fixed it! Thanks for putting my brain into that way of thinking This works!

 

psexec \\COMPUTERNAME -u administrator -p -accepteula sfc /scannow

 

I've now got the logs from two machines so hopefully can identify what is getting corrupted and fixed. But after I get back from holiday *passes job to colleagues*

 

Cheers all.

[LeMarchand]

I used psexec to run sfc /scannow and that's fixed it! Thanks for putting my brain into that way of thinking This works!

 

psexec \\COMPUTERNAME -u administrator -p -accepteula sfc /scannow

 

I've now got the logs from two machines so hopefully can identify what is getting corrupted and fixed. But after I get back from holiday *passes job to colleagues*

 

Cheers all.

 

I'm now praying that the unit I just sent back under warranty didn't have this problem! (Similar symptoms...)

 

Can you post if you find out the cause, just in case?

[ReadTheNetwork]

If you have one working machine and one faulty of the same make and model. Are you able to do a comparison of updates, drivers and software installed?

Unfortunately, it might take some time.

This link might help:

https://social.technet.microsoft.com/wiki/contents/articles/4197.how-to-list-all-of-the-windows-and-software-updates-applied-to-a-computer.aspx

 

I'm thinking if the faulty PC has an update the working one doesn't it might prompt something?

 

---

I see you fixed it ignore that

[PaulPierce8]

Are you up to date on the Windows updates? We had this issue last year and it was a rogue update that caused it on 50% of machines which we had to roll back.

[gwendes]

I'm now praying that the unit I just sent back under warranty didn't have this problem! (Similar symptoms...)

 

Can you post if you find out the cause, just in case?

 

Sorry, I missed this. We still have the same issue, it's much rarer now, but still happens. No idea of the cause. Hoping that the move of all machines to Windows 10 will resolve!

[gwendes]

If you have one working machine and one faulty of the same make and model. Are you able to do a comparison of updates, drivers and software installed?

Unfortunately, it might take some time.

This link might help:

https://social.technet.microsoft.com/wiki/contents/articles/4197.how-to-list-all-of-the-windows-and-software-updates-applied-to-a-computer.aspx

 

I'm thinking if the faulty PC has an update the working one doesn't it might prompt something?

 

---

I see you fixed it ignore that

 

'Fixed' = only found *a* fix. The problem still randomly (albeit much more rarely) happens!

[LeMarchand]

Sorry, I missed this. We still have the same issue, it's much rarer now, but still happens. No idea of the cause. Hoping that the move of all machines to Windows 10 will resolve!

 

Well the unit came back with a new parts so hopefully it was a genuine warranty case!