Applocker Issue During Reboot

Question

Windows 11 IOT Enterprise LTSC

Please give the reasons for black screen appearing during logon When AppLocker is applied.

Below Rules were Configure before Windows Update and Reboot occurred.

From AppLocker Even logs 8004 ID is blocked withdwm.exe, fonthostdrive.exe etch is being blocked.

Can Anyone help me what is the reason for this?

Answer 1

Hello @Sajin C S

The Event ID 8004 entries are the key clue here. Event 8004 means AppLocker actively prevented the listed executable or DLL from running while the rule collection was in Enforce mode.

From your screenshot, Windows components such as fontdrvhost.exe and other executables under %SYSTEM32% appear to be denied. Blocking components required by the Windows logon/session environment can explain why you're getting a black screen after reboot.

I'd start by reviewing your Executable Rules. Microsoft recommends creating the AppLocker default rules as a starting point specifically so required Windows components aren't accidentally blocked. The standard executable defaults include:

• Allow Everyone to run executables under %WINDIR%*
• Allow Everyone to run executables under %PROGRAMFILES%*
• Allow Administrators to run all executables

If you have explicit Deny rules for %SYSTEM32% executables, investigate those first. AppLocker evaluates explicit deny rules before allow rules, so simply adding an allow rule might not override an existing matching deny rule.

I'd temporarily change the affected rule collection from Enforce rules to Audit only, reboot, and check:

Event Viewer → Applications and Services Logs → Microsoft → Windows → AppLocker → EXE and DLL

Event 8003 will show what would have been blocked without actually preventing it from running. That gives you a much safer way to build the correct allow policy before enforcing it again.

Also check whether you've enabled the DLL rule collection. If so, Microsoft notes that every DLL required by an allowed application, including Windows system DLLs, must also be allowed.

Since this started after Windows Update, the update may have introduced or changed signed Windows binaries that no longer match overly restrictive hash- or publisher-based rules. If you're using file-hash rules for Windows components, review those carefully rather than simply creating additional deny/allow exceptions.

I wouldn't whitelist every executable shown in Event 8004. Fix the underlying AppLocker policy so it covers legitimate Windows components appropriately, validate it in Audit mode, and only then return it to Enforce mode.

Sharing these references with you:

Microsoft - Understanding AppLocker default rules

Microsoft - AppLocker processes and interactions

Please "Accept the Answer" if this information helped you. This will help us and others in the community.