Blank/Black Screen for 5+ minutes and then no network

[DJ-1701]

Issue: A computer boots past the BIOS, the spinning circle screen may appear and then it stays on a completely black screen for 5+ minutes until it quickly loads the login screen, and then refuses to connect to any network.

 

You discover the following services do not appear to start:

 

- Workstation

- WLAN AutoConfig (If you have a WiFi card)

- Netlogon

- Netman

 

They can be started manually as an administrator, but do not improve boot time nor do the services run at reboot, causing the same issue.

 

Event log details just state that there were difficulties starting services and not very helpful.

 

Researching into this issue you find the Local Service profile’s NTUSER.DAT file (found here: C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT) has rocketed in size to 300+MB (usually 256KB, but certainly less than 3MB).

 

Solution:

The offending branch of the registry that is over populated is HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings which can either be pruned, or delete/renamed the C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT (which will require you to boot into a command prompt only mode).

 

Microsoft appeared to mitigate the issue in KB4501375, but you need to add a registry key (which they originally got wrong). The correct info is below:

 

Path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp

Setting: CleanupLeakedContainerRegistrations

Type: DWORD

Value: 1

 

This addresses an issue with WinHTTP registrations that increase the registry size and delay the operating system’s startup. It occurs on devices that use proxy auto-config (PAC) files to define how web browsers and agents select an appropriate proxy server, certain internet connections seem to affect it more than others, especially if the device is a laptop and taken and used at home.

[DJ-1701]

Well... Microsoft's 'fix' didn't work, issue came back again. What worked (tested for 3 weeks) was changing the permissions on the key.

 

HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings

 

First I deleted all the entries.

 

Then I turned off permission inheritance, removed all items. Added in Allow Administrators, which I gave full control. And I added in Deny SYSTEM and Deny Authenticated Users with the permissions below.

 

 

I also set a Group Policy Preference to Replace the Mappings registry key, so it would be reset regularly, just in case.