explorer crashing or freezing on user login (black screen error)

Question

Hi,

In my organisation over the past 2 weeks we have seen an issue that occurs, seemingly at random, on user login. The issue will happen roughly once in every 10 logins, and I'm having a great deal of trouble identifying the cause. The client version is Windows 10 running the latest November 2024 patches.

Affected devices include a variety of form factors, including desktops and laptops, so a variety of hardware and drivers; it includes domain joined and InTune manage devices and it occurs for a wide variety of user types.

The device will boot as normal - after the user logs in, instead of display a desktop, only a black screen will be visible. The mouse cursor is visible and the device responds to CTRL + ALT + DEL.

From here, behaviour varies. We quickly identified that explorer was sometimes not running. Opening the task manager and launching explorer.exe from here sometimes works to fix the issue.

In other cases, explorer is running, but killing it and running it again fixes the issue. In yet other cases, it's necessary to kill the process tree and launch explorer again. In some cases, task manager locks up on launch, so it's not possible to get as far as launching explorer.

Logging off and back on again also works around the problem, since it's a 1 in 10 chance of occurring.

In short, all we know at this stage is that something is stopping Explorer from launching properly at user login.

I've been able to enter debug mode while the issue is happening, and while I do have some results, they are incomprehensible to me, and unfortunately don't seem to correlate with issues anyone else is having, based on Google searches of the syntax. The errors are:

Exception thrown at 0x00007FFF9ACFB699 in explorer.exe: Microsoft C++ exception: winrt:hresult_error at memory location 0x00000000033DF120.

Exception thrown at 0x00007FFF9ACFB699 in explorer.exe: Microsoft C++ exception: Platform:COMException ^ at memory location 0x000000001B39CE20.

Given the time frame, we suspect that a recent Windows Update is causing a conflict. They are KB5046714 and KB5044029. Naturally, the first thing we tried to do was remove these, but they keep reinstalling on removal - we remove them, restart the machines and they are present again when the device pops back up.

We've tried several methods to do this and all fail:

• From the GUI - remove updates and defer updates until next month
• From the command line - wusa /uninstall /kb:[number]
• From the recovery menu - hold left shift while restarting Windows > Troubleshoot > advanced options > there should be an uninstall updates menu, but there isn't, unclear why
• By disabling the Windows Update service and removing the updates

They always come back after uninstalling. I note that there was an out of band update yesterday (20/11/2024), which we are planning to install to see if this helps, but the patch notes don't make reference to the issue we're facing.

I'm wondering if there's any other way to remove the updates?

More to the point, I'm wondering if anyone else is facing this issue, and has devised a resolution?

Regards,

Robert

Answer 1

Hello

Thank you for posting in Microsoft Community forum.

For the issue of removing updates and then restarting and then reappearing, you can try the following solutions:

Block updates using Group Policy:

Open the Group Policy Editor (gpedit.msc).

Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update.

Find and enable the "Configure Automatic Updates" policy and select "2 - Notify for download and automatic installation".

This will prevent updates from being automatically installed, and you can manually select the updates to install.

Use command-line tools:

Try to use a PowerShell script to hide updates:

$HideList = "KB5046714", "KB5044029"

foreach ($Update in $HideList) {

Hide-WindowsUpdate -KBArticleID $Update -Confirm:$false

}

You need to install the Windows Update PowerShell module first, which can be installed with the following command:

Install-Module -Name PSWindowsUpdate -Force

Check the update service and task schedule:

Make sure the Windows Update service (wuauserv) and Task Scheduler are not re-enabled.

Open Services (services.msc), find the Windows Update service, stop and disable it.

Open Task Scheduler (taskschd.msc), navigate to Task Scheduler Library > Microsoft > Windows > WindowsUpdate, and disable the relevant tasks.

Use third-party tools:

There are some third-party tools that can help manage and block Windows Updates, such as Windows Update MiniTool.

The problem you describe of a black screen after logon can be tricky, especially if there are a wide variety of devices and configurations in the organization. A recent update may be the cause of the problem. Update KB5034843 has been reported to cause similar problems. Try uninstalling this update to see if it solves the problem.

after update of KB5034843 screen goes blank after login. Have to use - Microsoft Community

Best Regards,

Wesley Li