Action Centre wont open

[Arcath]

Deploying a fresh image of Windows 10 Education 21H2 to all our machines along with a complete refresh of Group Policy and I'm getting a weird issue where Action Centre wont open. It only applies to users that get the UX GPOs applied to them. Local admin and the intune enroll user are fine. It's also doing it for our admin level accounts.

 

Event Viewer shows:

 

Faulting application name: ShellExperienceHost.exe, version: 10.0.19041.1620, time stamp: 0x4c043d8f
Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf
Exception code: 0xc0000409
Fault offset: 0x000000000007286e
Faulting process id: 0x2cf8
Faulting application start time: 0x01d8b236e3e8d48f
Faulting application path: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Faulting module path: C:\Windows\System32\ucrtbase.dll
Report Id: 00f0f326-799c-41ed-946e-53377130718f
Faulting package full name: Microsoft.Windows.ShellExperienceHost_10.0.19041.1320_neutral_neutral_cw5n1h2txyewy
Faulting package-relative application ID: App

 

I've not got anything setup in the group policies that I haven't used before.

[georgeescott]

What do you mean by UX GPO’s? What settings are you applying there?

 

So if you keep all GPO’s enabled but unscope these UX GPO’s, the problem goes away?

Edited August 17, 2022 by georgeescott

[Arcath]

I've now got a user in a blocked inheritance OU that isn't getting anything other than the computer policies when it logs on and its doing the same thing. This user now has less policy applied to it than the Intune enrollment user for example.

[Guest Guest]

I’ve been having this issue with action centre as we block this so when on windows 11 you can’t turn up the volume!

[Arcath]

Looking at the app crash log its saying "The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application."

 

A lot of the stuff I can find is saying:

 

1. sfc /scannow, no problems (moot as it works for other users)

2. dism scan, no problems (moot as it works for other users)

3. Re-install windows, moot, fresh install from disk image

4. System restore, nothin to restore to.

 

Really odd. Happens straight away on a fresh profile.

[bald_pig]

Haven't applockered it have you?

[Arcath]

Haven't applockered it have you?

 

No, Nothing in the app locker logs.

 

I've just fresh imaged my test machine and logged in straight away as this test user and the same problem. Rules out a bad update for me there.

Edited August 18, 2022 by Arcath

[georgeescott]

Anything special going on in your image? Removing any appx apps or anything?

[Arcath]

Nope we are deploying the clean image from the ISO and getting GPOs and Intune to tidy everything up. It's very vanilla just after deploy before all the software comes down.

[Steve21]

Might be worth trying to clear

%AppData%\Microsoft\Windows\Recent\AutomaticDestinations

from a broken user and seeing if it stops crashing.

 

We've seen those errors with ShellExperienceHost.exe (aka Explorer) crashing because it's trying to view some bad quick view/links, which I'm guessing you could be setting changes via GPO from your comments

 

Would be an easy enough test to delete those destinations and see if it still still crashes before GPO updates again

 

Steve

[Arcath]

The problem in the end was the permissions on HKCU:\Control Panel\Quick Actions. I've been able to fix it was a bit of PowerShell

 

$acl = Get-ACL 'HKCU:\Control Panel\Quick Actions'
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("ALL APPLICATION PACKAGES","FullControl", "ContainerInherit, ObjectInherit", "None","Allow")
$acl.SetAccessRule($rule)
$acl | Set-Acl -Path 'HKCU:\Control Panel\Quick Actions'