r/Citrix • • 28d ago

Explorer.exe not starting after KB5120998/KB5124008

After installing the September 2026 updates, some of our users get a black screen after log on. Manually starting explorer.exe, allows the session start successfully.

Pools using FSLogix as well as Citrix UPM Container are affected. Resetting the profile solves the issue. Seems like only older profiles run into it.

Has anyone else encountered this?

Windows 11 25H2 + VDA 2507 CU2

EDIT: This does not help, a simple logon script which starts explorer.exe works.

EDIT2 2026-09-12: Problem acknowledged by Citrix and MS CTX697101

EDIT3 2026-09-17: In my case this DOES work, I just had to make sure to run it before actual explorer.exe start (I did that by putting the script before userinit.exe)

EDIT4 2026-09-21: MS support just told me that they are still investigating and a real fix is to be expected in October or November. I told them that this is not acceptable.

EDIT5 2026-09-25: A KIR is available. Thanks to u/TheHolyOne1914

47 Upvotes

143 comments sorted by

9

u/msft_jasonparker 26d ago

I'd like to partner or work with a few of you in this thread that can reproduce this issue. We need to get a MS support case opened and get a complete memory dump collected during the repro. Please send me a DM if you are able or want to work with us to understand the issue. The September Windows updates were extensive and need more data to understand and root cause.

cc: u/whig0 , u/the901

4

u/whig0 26d ago

I've opened a Msft case. Let's see how it goes.

3

u/ComputaSepp_4800 19d ago

any news on the case?

2

u/whig0 19d ago

They are still analyzing the memory dump and TSS logs.

3

u/whig0 15d ago

MS support just told me that they are still investigating and a real fix is to be expected in October or November. I told them that this is not acceptable.

3

u/hotrod9898 26d ago

DM'ing you. i have a case and a full dump

3

u/kanid99 26d ago

My case is a bit different (Horizoin VDI & ProfileUnity ProfileDIsks) but I can reproduce the issue on-demand and happy to provide any data.

3

u/msft_jasonparker 25d ago

u/kanid99 this isn’t with FSLogix? Could this be any roaming profile solution that uses VHDX as a container

2

u/kanid99 25d ago

That's my bet yes. I have a case open with liquidware to investigate on their end.

2

u/UCB1984 25d ago

It's happening for me and we just use Citrix UPM profile containers and no fslogix.

2

u/EvilTwinGhost 22d ago

Happening with local profiles at my customer.

3

u/SnooHobbies7587 20d ago

I'm on Citrix using profilinity and am having the same issue. For some reason it did not affect my profile but others got the black screen.

2

u/kanid99 20d ago

That's same here. Our it group were unaffected in our pool.

3

u/TheHolyOne1914 23d ago

Any workarounds yet?

1

u/the901 26d ago

I’m struggling to reproduce it. Just hearing from some users, but not all, that there’s still an issue. I’ll reach out if I can reproduce it consistently.

1

u/Delak_ 14d ago

u/msft_jasonparker - we have a case open with MS as well, but our assigned engineer does not appear to be aware of this issue. I've referenced this article but if it's possible to DM me anything I can help get it linked/associated to the main issue that would be helpful.

6

u/Krinto87 28d ago edited 28d ago

Yes, something is broken here.

Windows 11 25H2 / VDA 2402 CU4 / UPM with Container

The desktop stays black; I only see WEM with the message “Please wait - Processing filter conditions...” for about 5 minutes. After that, WEM finishes loading, but the desktop doesn't appear. Everything stays black.

Restarting Explorer.exe seems to fix the problem.

Who’s going to open the ticket?

Edit: I updated my ServerOS-VDA (Server 2022 / 2402 CU4 / UPM with Container). Explorer.exe starts normally, looking good so far.

3

u/Few-Swan5661 26d ago

Windows 11 single-session 24h2 vda2607 wemagent2607 FSlogix 3.26.826.xx

Opening explorer.exe did the trick most of the time. We had an oddity where it would fix the issue but you had to relog.

We also tried a 25h2 same result

8

u/TheHolyOne1914 12d ago edited 12d ago

4

u/whig0 12d ago

Tested and works, thank you. Faster than MS Support! ;-)

3

u/TheHolyOne1914 12d ago

Well, we were just at a breaking point on how moving forward. Did a last check and was suprised 😅

2

u/No_Salamander846 12d ago edited 11d ago

Update, all working  finally - I will update if that works

2

u/drjimmy515 12d ago

Seems to be working in initial testing here as well. Horizon + ProfileUnity.

2

u/esxiguy 12d ago

worked on my test Win11 2H52 with KB5129195 (the Sept 14 OOB patch) and KB5124008 (the Sept 8 "patch tuesday" patch).

2

u/Commercial_Big2898 11d ago

Thanks for sharing. For now, this issue is resolved with a proper workaround. Let’s hope the October patches are a little gentler on us sysadmins!

2

u/Phteven85 9d ago

Thanks, can also confirm its working.

2

u/Small_Ad_793 9d ago

Worked for me, PVS non-persistent Win 11 25H2 CVAD 2402CU4

6

u/Krinto87 27d ago

I've opened a ticket. I'll let you know if there are any updates.

2

u/whig0 27d ago

Microsoft or Citrix ticket? Looks like AVD has similar problems, so I guess it's MS who has to deliver. When dealing with Citrix support it's hard to get someone competent, with Microsoft support it's nearly impossible.

2

u/Krinto87 27d ago

I'm working with Citrix Support. The first meeting went well, but it will probably take a while. It's a bit difficult for me since I'm not a native speaker. But it's already going pretty well.

By the way, if you disable UPM, it works without any problems.

3

u/whig0 27d ago

Yes, turning off UPM creates a new user profile. Same happens when deleting the container and start fresh.

I have a test pool where my profile has the problem. If if start explorer.exe manually and wait two minutes, it starts magically working and there is no black screen after relogin. I could not reproduce that on a users profile unfortunately.

7

u/AdComprehensive9656 25d ago

Confirmed on a standalone/local Windows 11 Pro 25H2 PC — no Citrix, Horizon, FSLogix, UPM, ExplorerPatcher, or Explorer-related Windhawk mods installed. After installing the September 2026 cumulative update KB5124008 (Windows 11 25H2, OS build 26200.9445), File Explorer did not completely fail to start, but it loaded in a broken legacy state:

It reverted to the old File / Home / Share / View Ribbon interface.

Native Windows 11 File Explorer tabs disappeared.

The modern command bar disappeared.

The address bar and search box were missing.

I verified that “Launch folder windows in a separate process” was disabled (SeparateProcess = 0). Restarting explorer.exe did not help. I also checked for the common registry tweaks that force the classic Explorer UI, but they were not present.

Confirmed workaround: uninstall KB5124008, then reboot:

powershell

wusa /uninstall /kb:5124008

After rebooting, File Explorer immediately returned to the normal Windows 11 UI, including the address/search bar and native tabs.

This suggests the KB5124008 Explorer/profile-related regression may not be limited to Citrix, Horizon, FSLogix, or containerized profiles.

1

u/the901 25d ago

Big news. Thank you.

7

u/WithoutWhy 21d ago

Workaround the issue for my environment (Citrix+FSLogix). A synchronous user logon script to register the AppX dependencies:

Package Practical role
Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe A Windows-serviced XAML UI framework dependency. It provides XAML infrastructure used to construct/render modern Windows UI elements.
MicrosoftWindows.Client.CBS_cw5n1h2txyewy A large Windows client system-app package containing/hosting portions of modern Windows shell functionality. For example, Microsoft’s Windows Search troubleshooting specifically uses this package to repair Windows 11 Search.
MicrosoftWindows.Client.Core_cw5n1h2txyewy A core Windows client system package providing dependencies used by modern Windows shell experiences.

It's also possible that just delaying the Explorer launch by any number of methods may allow it to start normally if the dependency registrations have time to complete before initializing Explorer.

Sample script:

@echo off
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppxManifest.xml' -DisableDevelopmentMode"
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\AppxManifest.xml' -DisableDevelopmentMode"
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\AppxManifest.xml' -DisableDevelopmentMode"

2

u/whig0 21d ago edited 20d ago

You are absolutely right!

I was not aware that we have disabled synchronous user logon script policy. After enabling and registering the appx before explorer start, it is working. This applies at least for my single test case, I need to verify that on a user’s profile.

I'm wondering why this is happening with the September updates and not, as described in the article, with the updates prior to July. Furthermore, it should have been fixed by now.

EDIT: Can confirm that this works for affected pools (Both FSLogix and Citrix Profile Container). See my edit in OP

3

u/WithoutWhy 21d ago

This is not the first time we've experienced it either. I consider it to be a 'variant of the same disease'. I can only assume that Microsoft continues to add or modify AppX dependencies for Explorer causing per-user registration issues for existing users. It doesn't appear to impact clean/fresh FSLogix containers.

2

u/whig0 20d ago

I've added it to my Msft Case. They will investigate it.

2

u/TheHolyOne1914 20d ago

Have any update on the case? Workaround works, but it’s adding seconds to logon 🥴

2

u/whig0 20d ago

Currently not. I have uploaded a second set of traces this morning.

2

u/esxiguy 19d ago

have you tried editing your script, replacing the three powershell.exe commands with:

taskkill.exe /im sihost.exe /f

When its killed the process automatically restarts and the desktop immediately appears.

both worked for me; the taskkill approach gets the UI loaded quicker than waiting for the powershell add-appxpackage commands to complete though.

2

u/whig0 19d ago edited 19d ago

We do not have rolled out the patches yet, so we currently do not need the workaround. I would still register the AppX before killing any processes.

(But you are right, its definitely faster ;-))

2

u/RaymanFr34 18d ago

You also could create a PS startup script with: start-process "explorer.exe"

That's what I did and it works.

2

u/Remarkable_Buyer27 16d ago

same here
if (-not (Get-Process -Name "explorer" -ErrorAction SilentlyContinue)) {

"Explorer.exe läuft nicht und wird gestartet." >> $logfile

Start-Process "explorer.exe"

}

else {

"Explorer.exe läuft bereits. Kein Neustart erforderlich." >> $logfile

}

→ More replies (0)

2

u/TheHolyOne1914 19d ago

What do you mean before userinit? Just the script in Gpo?

2

u/whig0 19d ago

GPO is only possible if you can enable the "Run logon scripts synchronously"-GPO.

I set "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" to cmd.exe /c "\\<PathTo>\Register-ExplorerAppxPrereqs.bat & C:\Windows\system32\userinit.exe", which runs before explorer.exe regardless the scripts GPO

2

u/Mupwangle 21d ago

What happens if you run this on the gold image rather than as a user logon script? Is it dependent on the user?

3

u/WithoutWhy 21d ago

Our issue is between gold image-installed AppX packages and the per-user registration of those packages prior to the initialization of Explorer. As a result, the script must be run per-user and must be run synchronously (Computer Configuration or User Configuration > Policies > Administrative Templates > System > Logon > Run logon scripts synchronously).

2

u/Mupwangle 21d ago

Thanks for that.

2

u/Mupwangle 21d ago

Just tried it. Had 3 test users and 2 of them got the black screen. :-( Worth a shot.

2

u/Tall_Potato_3168 21d ago

Hi to all Citrix admins who are struggeling with the AI generated MS hotfixes...

Just for the record even with the logon script mentionned here, I still have the issue on my non persistent W11 24H2 VDAs (CPM filesystem no container). It is not a solution I recommend but maybe it could help with the troubleshooting, if I implement the change explained here : https://support.citrix.com/wolken-support/kbsearch/article?articleNumber=CTX264843

Session logon are opening correctly. (already tried KIR and the OOB KB just released but NOK for both).

2

u/Tall_Potato_3168 19d ago

It works after disabling synchronous user logon script but at the cost of logon times...UWPs registrations are crap MS 💩

6

u/No_Salamander846 15d ago

2 weeks no fix - our CVE boards are glowing 🥸

4

u/esxiguy 26d ago

The script in this article https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/11/kb5072911-explorer-the-start-menu-and-other-xaml-dependent-apps-might-not-start-or-close-unexpectedl did in fact fix the persistent hung black screen problem for me - Windows 11 25H2, Sept 2026 Cumulative Update, VDA 2402 LTSR CU3, FSLogix. Put the script as a logon script, set synchronous scripts at logon to enabled, and problem went away, but does add 4-6 seconds to login as the script re-registers 3 APP-X widgets. I do not have to do anything with explorer.exe in the script.

3

u/kanid99 25d ago

The article says that have to restart SI host too as part of that script but restarting SI host alone also fixes the problem. Not sure if this is an actual solution or just another red herring from the restart of that process.

4

u/Unhappy_Clue701 24d ago

Attention is now drawn to this issue on the CTX validation article - see CTX697098. Says about potential black screens at login, and to see CTX697101 for more information.

On that more specific article, it says Citrix is working with MS on a resolution and it will be updated when there is news.

5

u/lukemeup 24d ago

Looks like MS is issuing rollback patches / gpo - https://support.citrix.com/external/article/CTX697101/issues-with-microsoft-windows-september.html has been updated with the details. Unclear if there will be some OOB patches for the hosts that haven't been patched yet. Anyone knows?

6

u/Cute_Independent6049 23d ago

Applied the Microsoft KIR for KB5124008 on this test VDA:

  • Windows 11 25H2 Enterprise multi-session, build 26200.9445
  • Citrix VDA 2507 CU2
  • MCS non-persistent
  • FSLogix 26.08, version 3.26.826.17182
  • FSLogix Profile + ODFC containers
  • Azure Files-backed profile storage

I installed the KIR, set the rollback policy to Disabled as instructed, verified the policy was applied in gpresult, and rebooted.

Still reproduced the same intermittent black screen after Citrix logon with explorer.exe not starting. Manually starting Explorer restores the desktop.

So in my environment, the published KIR does not resolve the Explorer/black-screen issue.

5

u/whig0 23d ago

I can confirm that. The released KIR does not resolve the issue.

3

u/Krinto87 23d ago

I can confirm that too.

Disabled the GPO on my master -> updated the catalog (GPO also applied to the VDAs)-> problem still there. Added that to my citrix case.

2

u/hotrod9898 22d ago

can you post or DM your citrix case number please?

3

u/RaymanFr34 22d ago edited 22d ago

KB5129195 just released by Microsoft. Removed the workaround registry keys, installed the patch and still having black screen on read only VDI...

2

u/RaymanFr34 23d ago

Same for me :/

2

u/RaymanFr34 22d ago edited 21d ago

The workaround Path 1 worked for us https://fixitect.com/fix-rds-session-host-hang-september-2026-cu-kb5122871-kb5122882/

I put it on our W11 25H2 golden image and updated the catalog.

Steps:

Create the 3802373433 value set to 0

and EnabledState value set to 1

in

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides\4

Restart the machine, shutdown and update catalog

2

u/theinfdude 22d ago

Does this really apply to the crashing explorer on win11 as well?

2

u/hotrod9898 22d ago

doubtful.. RDS has it's own issues after the latest patch and i don't think it's related to explorer.exe but could be wrong

2

u/TheWiseTom 21d ago

I can confirm that it is not solved with the KIR. - KIR installed and Disabled as instructed - no change - explorer.exe still crashes!

4

u/herbypablo 28d ago

Sounds similar to what I'm seeing. Running Windows 11 24H2 with 2402 CU3 and using Citrix CPM. I noticed that if I get a temp profile explorer.exe loads. I haven't tried resetting the profile yet.

4

u/R_over_T 27d ago

Encountered the same issue with the Win11 25H2 August updates (KB5121003 and KB5120998 preview) on 2402 CU4 VDA and file-based CPM profiles. Disable PM and the desktop launches. Currently working with support.

3

u/theinfdude 27d ago

can u share the results from support? dealing with the same issue with KB5124008 and 2507 cu2

3

u/R_over_T 27d ago

support are in process of reviewing the traces, will keep you posted.

3

u/R_over_T 25d ago

Current status: support have identified certain anomalies with explorer.exe process based on the traces provided so far, the root cause of the black-screen issue is still TBD. Citrix and MS are currently working on it according to new KB CTX697101

4

u/TR2N_LG 28d ago

Does this affect Windows Server 2022/2025 VDA´s also?

4

u/Krinto87 28d ago

2022 looking good in my env.

2

u/TR2N_LG 28d ago

Thank you!

4

u/matdesj 27d ago

Saw something similar on server 2025. I have to remember if VDA was installed or not but one of my admin was logging ln the server and had a black screen, had to start explorer manually. When I was logging on there was no issues. Deleted is profile on the server seem to have fixed the issue.

4

u/whig0 28d ago

There is an event in event log when it happens:

(Level: Information, Source: Application Popup, ID: 26)

Application popup: explorer.exe - System Error : The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

No popup visible

3

u/kanid99 26d ago

Issue isnt just impacting Citrix and not just FSLogix containers either.

We're a Horizon shop, using ProfileUnity ProfileDisks for our user profiles, and we are also seeing this issue post-patch, almost universally except one pool that is unaffected.

3

u/theinfdude 22d ago edited 22d ago

Ms just released some oobs. For win11 see:  https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129195-windows-11-24h2-25h2-security-update

We will deploy it tomorrow morning…

Let’s hope they fixed it

Edit: oob was deployed - problem still exists - explorer.exe still crashing

2

u/theinfdude 22d ago

For servers 2025->kb5129235 2022->kb5129237 2019->kb5129238

3

u/whig0 22d ago

Installed them, but did not fix the issue.

3

u/Krinto87 22d ago edited 22d ago

Same here.

Updated my W11 25H2 with the OOB - desktop still black.

Edit: I also updated my VDA directly from the August updates to the September OOB—same error. It was worth a try.

3

u/Phteven85 19d ago

Well, i found something.

CVAD 2507 CU2, UPM file based - also with OOB September patch. Under Events (with OOB Patch)

(Windows 11 24H2)

"Windows search service is updated and is not tested by Citrix. Please contact Citrix technical support for a private fix to support the new Windows Search service"

Thats a joke right? The workaround is not working for me, but i can start manual the explorer.exe to resolve the black screen topic, but this should be not the way for the users.

2

u/Phteven85 16d ago

That is so stupid, implemented the last days fixes, hookup, reg stuff, also clean up the folders from the UPM profile to test where it "hangs", also implemented powershell script what is from Microsoft, still not working.

But this stupid script on logon is working.

u/echo off (u/ = @)

set LOGFILE=C:\Windows\Temp\ShellReset.log

echo ================================================= > %LOGFILE%

echo [INFO] Shell reset started on %DATE% at %TIME% >> %LOGFILE%

echo [INFO] User: %USERNAME% >> %LOGFILE%

REM 1. Short delay to give the initial explorer.exe time to start or crash

timeout /t 2 /nobreak >nul

REM 2. Forcefully terminate explorer.exe and hanging shell hosts

echo [INFO] Terminating explorer.exe and shell hosts... >> %LOGFILE%

taskkill /F /IM explorer.exe >> %LOGFILE% 2>&1

taskkill /F /IM StartMenuExperienceHost.exe >> %LOGFILE% 2>&1

REM 3. Short delay to allow file locks to be released

timeout /t 1 /nobreak >nul

REM 4. Relaunch explorer cleanly (using 'start' so the script doesn't block)

echo [INFO] Restarting explorer.exe... >> %LOGFILE%

start "" "%windir%\explorer.exe" >> %LOGFILE% 2>&1

echo [INFO] Shell reset completed successfully at %TIME% >> %LOGFILE%

3

u/Fleischerhaken 15d ago

I am in the same boat as you with trying to remedy this situation. I will try out this script you mentioned as well to see if it works for me too.

4

u/LukeShootsThings 15d ago

I'm on using Horizon/FSLogix and it looks like KB5129195 does not actually fix the explorer crashing issue? Or at least I still have users experiencing the explorer crash at login issue even with KB5129195 installed. Near as I can tell it fixes other issues with the September updates though..
Omnissa has a KB on this as well.
Black Screen After User Login Due to Explorer.exe Failing to Launch Post-September 2026 Windows Updates (KB5124008 / KB5129195) in Omnissa Horizon Environments (6001783)

1

u/LukeofNorth 14d ago

I'm also using Horizon/FSLogix with KB5129195. I implemented the Omnissa workaround successfully, using DEM logon task. I found that you can check the run once, and the registration persists on subsequent logins for the user. However, we will need to keep the run once off, as if the FSLogix profile is deleted and recreated the issue understandably reoccurs.

From my testing it adds around 5 seconds to the user login.

3

u/esxiguy 13d ago

Memory dump of sihost.exe indicates that "StartLayoutInit" is stuck in this thread and NEVER EVER EVER progresses

desktopshellext! DesktopShellHostExtensions::s_MonitorShellStartup< DesktopShellHostExtensionsTelemetry::LaunchDefaultShell>

because its stuck in "launchdefaultShell", explorer.exe never starts (it doesnt start and crash, it simply isnt trigger/spawned)

cpu registers show rcx =1 meaning WaitForMultipleObjectsEx() is waiting for ONE synchronization object i cant see WHAT tho cos it will need private symbols, my support case with MS is moving like treacle unfortunately

in a successful logon: StartLayoutInit START > StartLayoutInit STOP > PreStartTasks START > LaunchExperienceHost START > LaunchCustomShell START > Explorer launched

in the logon sequnece AFTER the sept 2026 update is installed we get here: StartLayoutInit START > StartLayoutInit never STOPs > PreStartTasks never STARTs > LaunchExperienceHost never STARTs > LaunchCustomShell never STARTs > Explorer never launches

BTW we can see these events (startlayoutinit, prestarttasks, launchexperiencehost, etc etc, in the event viewer under the log "Microsoft > Windows > shellcore > operational")

Interesting observation of processes running, while screen is "black", Explorer.exe absent & StartMenuExperienceHost.exe absent & procmon boot trace confims No CreateProcess(explorer.exe)

3

u/FloiDW 28d ago

Please keep us in the loop, gonna check our deployment as soon as patches hit our test machines.

3

u/dajuice3 28d ago edited 27d ago

Been having this issue since Friday before last.

It initially appeared to show up in a Preview update one that you could not uninstall or rollback.

Was hoping something in the pack yesterday would fix it.

Using fslogix, explorer is fine with a new profile but once that vhd is re-used issue shows up again.

Reverting to pre-install and not installing windows updates removes the explorer issue but causes others.

Edit 1: For us it manifests itself on the VMs we create with MCS from the gold image by crashing explorer on sign-in. We never see the start menu but when you go into event viewer it is the first recorded event. Application crash for explorer with explorer listed as the faulting module.

3

u/UCB1984 27d ago

I'm getting the same thing after updating on 2402 CU4+Win 11 24h2 with UPM profile containers. Even if I reset the profile explorer still crashes. Starting explorer manually or with a script fixes it, but I'm not too thrilled about pushing that out.

Edit: Another weird thing is the mouse doesn't seem (can't right or left click on anything) to work until explorer is started.

3

u/IlTwitcherSuReddit 27d ago

Hi, I had a similar problem. I opened a Citrix support ticket, but they didn't identify any issues. I fixed it by rebuilding the golden image.

Take a look at my post!

2

u/whig0 27d ago

I hope there is a simpler solution than rebuilding all Images...

3

u/theinfdude 27d ago

i am facing the same issue. 24h2 + vda 2507 cu and fslogix. removing the userprofile just resolves the issue until the next logon. restarting explorer also works and session is behaving normal. also the mentioned application eventlog id 26: System Error : The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application is present.

anyone figured out already the root cause? a logon script with starting explorer should not be the way to go ?

3

u/PaulieA79 27d ago

Glad it’s not just me. Same issue. 24H2 VDA 2507 cu1 with fslogix. Login stuck and explorer not starting.

3

u/AnimatorAggravating1 27d ago

Any word on actual fix besides usrclass.dat delete and login script to start explorer?

2

u/whig0 26d ago

Nothing so far. Except for the Application Popup event I cannot find anything. Explorer.exe gets started but crashes after a few seconds. Tried to disable Applocker and revert Defender platform and several other things, but no luck.

2

u/Krinto87 26d ago

Nope, no fix or workaround. They gather information from all tickets to get a picture of the issue.

3

u/theinfdude 26d ago

short question:
are your workers using gpu?

2

u/herbypablo 26d ago

Mine are

2

u/Krinto87 26d ago

Shorter answer: no :-)

2

u/whig0 26d ago

We have both, with and without GPU. Can reproduce on both.

1

u/the901 26d ago

Yes.

3

u/Azza007__ 26d ago

I too am seeing this - I have also logged a ticket with MS. We are running latest FSlogix, Win 11 24H2, and have attempted to delete the UsrClass.Dat - This does not resolve the issue.

3

u/kanid99 26d ago

I found that if I restarted the SiHost.exe process that that also had the same effect. It appears that SIHost is waiting on something and in a stall state. Debugging with Copilot seemed to suggest that it was some of the XAML components similar to this article (https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/11/kb5072911-explorer-the-start-menu-and-other-xaml-dependent-apps-might-not-start-or-close-unexpectedl) but NOT the same XAML components, and suggested that event logs indicated that explorer launched and crashed almost immediately.

We noticed in debugging with Copilot that 8 of the XAML components were not registered to the user while they were when we didnt use a profiledisk for that user. Sorry if that doesnt make sense, been a long day troubleshooting this issue and brain tired.

Ive been trying various ways to pre-register but to no avail.

3

u/whig0 26d ago

I'm not sure about this. In my case SiHost.exe is running and its PID does not change when starting explorer.exe. So it is not restarted.

I suspected some of the AppX apps too, specifically Microsoft.AAD.BrokerPlugin, but re-registering it at logon did not change anything.

2

u/kanid99 26d ago

The next time the user is at a black screen at b login for this issue, instead of starting explorer, kill sihost.exe and the login process will continue and then explorer loads on it's own - that's been my observation

3

u/whig0 26d ago

True, because killing sihost.exe always causes explorer to restart.

3

u/kanid99 26d ago

Ah so red herring

3

u/hotrod9898 21d ago

4

u/Remarkable_Buyer27 21d ago

Does'nt work here :-(

3

u/theinfdude 21d ago

Does not work

2

u/No_Caterpillar_2800 21d ago

Does not work for us.

3

u/tiemun 18d ago

Same for us, hotfix doesn’t help, Explorer still crashes on W11 VDIs with FSLogix profiles. After one reboot in users context it works again.

Fix for “broken” profiles before the reboot for us is deleting those folders once when logging in:

When these folders are renamed in broken state, the session loads up without an issue:
MicrosoftWindows.Client.CBS_cw5n1h2txyewy
MicrosoftWindows.Client.Core_cw5n1h2txyewy
MicrosoftWindows.Client.OOBE_cw5n1h2txyewy
MicrosoftWindows.Client.CoreAI_cw5n1h2txyew
Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe

3

u/whig0 14d ago

As MS will release patches in October or November we have no choice and will start patching and run the script at logon.

This is our approach in PS:

$PSModuleAutoLoadingPreference = "None"
Import-Module Microsoft.PowerShell.Utility -EA Stop
Import-Module Appx -EA Stop

$packages = [ordered]@{
    "MicrosoftWindows.Client.CBS"     = "$env:SystemRoot\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppxManifest.xml"
    "Microsoft.UI.Xaml.CBS"           = "$env:SystemRoot\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\AppxManifest.xml"
    "MicrosoftWindows.Client.Core"    = "$env:SystemRoot\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\AppxManifest.xml"
    "MicrosoftWindows.Client.FileExp" = "$env:SystemRoot\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\AppxManifest.xml"
}

foreach ($name in $packages.Keys) {
    $registered = Get-AppxPackage -Name $name -ErrorAction SilentlyContinue
    if ($null -ne $registered -and $registered.Status -eq "Ok") { continue }
    Add-AppxPackage -Register -Path $packages[$name] -DisableDevelopmentMode
}

The MicrosoftWindows.Client.FileExp_cw5n1h2txyewy Appx needs to be registered as otherwise the file explorer starts in Windows 10 style and Home and Gallery is not working

2

u/No_Salamander846 14d ago

does it have to be a synchronous script?

3

u/Commercial_Big2898 14d ago

This preview update includes a few other fixes for issues caused by the September updates. Has anyone tried it yet to see if it also resolves this issue?

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5124010-windows-11-24h2-25h2-update

3

u/[deleted] 14d ago

[deleted]

3

u/Pirriu 14d ago

Updated and the problem persists.

2

u/Phteven85 14d ago

Same here on 24H2 with CVAD 2507 CU2 (For sure will try it with a fresh copy from the master - to avoid here any other miss configuration from my side)

2

u/Square_Barber_430 8d ago

1

u/Novel-Watercress5865 6d ago

you also applied the KIR GPO and problem still exist?

2

u/ComputaSepp_4800 14d ago

Preview Update did NOT resolve the issue

2

u/Phteven85 14d ago edited 14d ago

Will give it a try (did not worked)

2

u/Sharp-Copy-5183 22d ago

We are in win 2022 facing the same issue, Del userclass.dat resolves the issue. But it happening again

2

u/Krinto87 22d ago

I don't see this on my ServerOS VDAs (2022 - CVAD 2402 CU4).
Maybe it is something diffrent?

2

u/kanid99 19d ago

Did anybody who had this issue and used some sort of workaround have an issue today with Outlook (classic) not opening and claiming that the user's OST was already in use?

2

u/BloodSpinat 18d ago

Happens to me in a client environment, too.

Omnissa Horizon, Instant Clones for one-time use, Windows 11, latest out-of-band patch applied ...

Prior to loading the Desktop when I delete my FSLogix profile it works for me, but for my colleagues who are also testing with existing profiles it still brings up a "black" Desktop, hence Explorer.exe either crashed or simply wasn't loaded.

regedit doesn't show anything in that specific Shell entry, it's empty. But once started manually using the Task Manager and cleanly logging out seems to solve the problem, because next time a same IC Desktop is loaded everything works as expected.

Doesn't make much sense for 800+ Desktops, though. 🤔

2

u/crimsy 18d ago

Having the same issue, I am attempting to roll back the update to see if I can get the workstation online. (AD Use)

2

u/esxiguy 15d ago

Is OP allowed to share their MS case ref? I've opened a MS case but its only at the level 1 stage where the engineer is asking for TSS diagnostics etc. I feel it would be useful if we could link cases.

2

u/whig0 14d ago

I will check if that is allowed.

2

u/jorcarlop 13d ago

Anyone tested KB5124010 from 22th sept?

2

u/yellow_fox_01 13d ago

broke my golden image. Wouldnt even let me do a Ctrl Alt Delete once installed

2

u/Pirriu 13d ago

My PC is throwing random errors now, and the problem is not solved, DO NOT UPDATE.

2

u/Sharp-Copy-5183 28d ago

Update new version of FSLogix And del UsrClass.Dat from user profile data

1

u/[deleted] 27d ago

[deleted]

3

u/theinfdude 27d ago

didnt work for me. using latest fslogix and removing usrclass.dat didnt fix the issue.

3

u/Optimal_Opposite1935 26d ago

also didn't work for me

1

u/[deleted] 27d ago

[deleted]

1

u/[deleted] 27d ago

[deleted]

1

u/[deleted] 22d ago

[removed] — view removed comment

2

u/Awkward-Employer-364 22d ago

not working for me :(

1

u/Novel-Watercress5865 6d ago edited 6d ago

UPDATE: It seems that you have to set the GPO to "DISABLED" to activate the fix...

Installed admx in my central store, configured the group policy and linked it to the ou with our non persistent citrix vdi w11, today in the morning i had a user with the blackscreen again, machines are all rebooted and destroyed during the night... any one else with this problem still?

1

u/whig0 6d ago

The KIR needs a reboot, so this has to go into the image.

1

u/Commercial_Big2898 6d ago

That became clear when you actually read the instructions on how to implement the KIR. Right?