kennysarmy

I had £5 E/W on the winner at 25/1 - will be buying some new summer golf shoes with my winnings - this race is the only horse race I bet an E/W stake on, the only other horse races I gamble on are a couple of daily accumulators when the Gold Cup is on in Cheltenham

See my comments in another thread:

Sophos have requested the following: Logs Required: To further investigate the issue, please collect and provide the following logs from the affected machine BOOT PML Logs Get process monitor logs and system events using Process Monitor Latest SDU Logs Sophos Diagnostic Utility: Locate and download SFS & SSP Debug Logs (captured while replicating the issue): Sophos Endpoint Self Help: Product Logging When enabling and disabling the debug logs, kindly note down the exact timestamps along with the date. If possible, please also capture a screenshot showing the time. This will help us effectively correlate the logs with the boot timings. Next Steps: Reboot the machine and observe the current boot time. Please share how much time it is taking now. Open Command Prompt with Administrator privileges, type the command FLTMC, and share a screenshot. This will help us identify if any third-party drivers are present. I'm struggling with: SFS & SSP Debug Logs (captured while replicating the issue): Sophos Endpoint Self Help: Product Logging When enabling and disabling the debug logs, kindly note down the exact timestamps along with the date. If possible, please also capture a screenshot showing the time. This will help us effectively correlate the logs with the boot timings. I can see how to turn on Debug logs for SFS and SSP, but once turned on I don't see how to gather the logs?

Currently doing this: Boot process monitor log Do steps one to three of the Normal process monitor log section. Click Options > Enable Boot Logging. Turn on Generate thread profiling events. Select Every second and click OK. Click Filter > Enable Advanced Output. Restart your device and reproduce the issue. Run Procmon64.exe. Click Yes once prompted. Zip the PML file and attach it to your reply to Sophos Support for your existing case, or see Sophos Support: Submit files .

Realtime scanning of files on it's own is fine. But add in Malicious Behaviour Detection logon times increase by a factor of 3 for the first logon after a reboot.

Slow Logons and Normal Logons Narrowing down the Sophos elements which are causing the issue for us.

For those with SOPHOS and Slow Win11 bootup and logon performance issues can you please trying disabling the Sophos System Protection Service and testing. We are finding with this STOPPED and DISABLED our Logon times return to normal.

https://community.sophos.com/intercept-x-endpoint/f/discussions/147857/sophos-endpoint-performance-issues-with-24h2

With no Sophos on the two control devices logons and boot times are as normal. With Sophos reinstalled we get slow logons again - only after first boot. Subsequent logons to a PC which is ON are as normal. We're going to raise a case with Sophos Support.

It would be worth you taking a PC and removing Sophos to see if things improve, we're doing this test at the moment and early indications are it might improve times. For us, if a student goes to a PC already turned on from a previous logon, they logon perfectly. If the PC is turned off or restarted they get slow logons, as if the PC is doing something in the background that takes a set amount of time and once it's finished the PC is fine. I'll report back if we get good results from removing SOPHOS from a few more control computers.

Used ABTutor to monitor processes during a black screen event at logon. But nothing untoward here?

We are seeing the "Black Screen" when logging on issue most prevalent after a shutdown, it's hard to recreate if the previous user has just logged off. If we reimage a PC it seems fine, so something seems to get screwed in our in-place upgrade which we're doing via the ISO.

Is your AV Sophos?

Is chat such a big deal? Are students not allowed to email each other either?

These are some of the errors we are seeing in event viewer. Are you able to see if any of your affecting devices are seeing anything similar to narrow down the cause of this annoyance? NETLOGON - 5719 This computer was not able to set up a secure session with a domain controller in domain CURRICULUM due to the following: An internal error occurred. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. DeviceSetupManager - 202 The Network List Manager reports no connectivity to the internet. DeviceSetupManager - 164 Software install GraphicsControlPanel for device 'SWD\DRIVERENUM\CUI&4&1ce551d&0' encountered transient error 0x4D5, will retry later. DeviceSetupManager - 122 Driver search for device 'PCI\VEN_8086&DEV_A2F0&SUBSYS_86C71043&REV_00\3&11583659&0&FB' on Windows Update was blocked by policy. DistributedCOM - 10010 The server Windows.Internal.StateRepository.ApplicationExtension did not register with DCOM within the required timeout. ServiceControlManager - 7022 The State Repository Service service did not respond on starting. ServiceControlManager - 7001 The AppX Deployment Service (AppXSVC) service depends on the State Repository Service service which failed to start because of the following error: After starting, the service hung in a start-pending state. Service Control Manager - 7023 The Security Center service terminated with the following error: %%16389 AppReadiness - 10 The Appx operation 'RegisterPackageAsync' on 'Microsoft.WindowsStore_22502.1401.7.0_neutral_~_8wekyb3d8bbwe' failed for user 'S-1-5-21-1969104753-442904412-1990678075-37855' - error 0x800704EC: Deployment of package Microsoft.WindowsStore_22502.1401.7.0_x64__8wekyb3d8bbwe was blocked by AppLocker.. (Error: The package deployment operation is blocked by policy. Please contact your system administrator.) AppReadiness - 214 'Microsoft.WindowsStore_8wekyb3d8bbwe' install failed for S-1-5-21-1969104753-442904412-1990678075-37855. Error: 'The package deployment operation is blocked by policy. Please contact your system administrator.' (15.2957646 seconds)

Given that we are seeing about 5% of logons get a black screen with PC's upgraded to 24H2 I think you might be better off fresh installing.

We are getting this on older PC's which have been upgraded to Windows 11 24H2. (from 23H2) We're unable to recreate the issue. Users are unable to get to task manager when it happens, all they can do is log out and back in again which seems to usually fix the issue. Some affected devices have been reimaged (again to 24H2) and it looks like the issue does not reappear, we're slowly imaging a whole suite one by one and monitoring which devices exhibit the issue. So far none of the reimaged PC's have had a black screen appear at logon. As above if the PC is left long enough then the desktop does appear.

Can you post up the spec of the devices you're getting the issue of black screen during logon and driver versions so we can see if there is any commonality with our devices?

Damn, so it's happening on re-imaged too, was hoping it was just on those that were "upgraded" Do you know if anyone with this issue has raised it with Microsoft?

We have also started re-imaging our DT devices which is where this issue seems to be the worst, we're monitoring to see if we get any issues on the ones we've freshly imaged.

Not entirely similar but we're seeing around 1 in 20 to 1 in 50 users get just a black screen when they logon. The fix is to CTRL+ALT+DEL - Sign Out and then attempt to sign in again.

No Physical DC's here, two virtual.

We are seeing this on Win11 24H2 - how about yourself?

Having a few issues with logons at the site. I've run Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log on one of the Domain Controllers. Results are below if anyone can interpret better than I can :/ Below are some of the errors from the log. Starting test: DFSREvent The DFS Replication Event Log. There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. A warning event occurred. EventID: 0x80001396 Time Generated: 03/17/2025 20:06:19 Event String: The DFS Replication service is stopping communication with partner DC01 for replication group Domain System Volume due to an error. The service will retry the connection periodically. Additional Information: Error: 9036 (Paused for backup or restore) Connection ID: D438841E-432D-404F-9D88-15ED4F06E9A8 Replication Group ID: 11659248-A169-4195-AF60-8202DF806713 ......................... DC02 passed test DFSREvent

Sorry to resurrect an old thread but we have some older PC's here where 50% of the room at logon will get a black screen, they are able to press CTRL+ALT+DEL and Sign Out and "usually" signing in again is fine, but sometimes they have to move to another PC. I've checked Event Logs for Errors in SYSTEM and found the following: 10010 The server Windows.Internal.StateRepository.User did not register with DCOM within the required timeout. 19 The KDC certificate for the domain controller does not contain the KDC Extended Key Usage (EKU): 1.3.6.1.5.2.3.5: Error Code 0xc0000320. The domain administrator will need to obtain a certificate with the KDC EKU for the domain controller to resolve this error. When using Windows Server Certificate Services create a certificated based on the Kerberos Authentication Template. 5719 This computer was not able to set up a secure session with a domain controller in domain CURRICULUM due to the following: An internal error occurred. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. Can anyone shed any light on which if any of these might be related to a black screen at logon? I believe if the student leaves the PC long enough that it does eventually logon fine, but we're talking 10 minutes Thanks.