windows 11 24h2, black screen, winlogon
Posted: Mon Mar 30, 2026 10:09 pm
Initial issue, Login, Go inactive, screen saver initiates, user input, system initiates secure lock. Sometimes the lock screen will appear some times it wont. Just a blank black screen with no user input. (tried entering in password to unlock even though nothing graphical was present. Attempted to use the graphics reset hot key (win + ctrl + shift+ B) Screen flickers back to black screen.
Checking background processes I can see gphotoshow still running. Trying to terminate it yields an error that it can't be terminated since it doesn't exist. Trying to terminate it along with parent processes yields error. There are 2 processes that gphotoshow is bound to. explorer.exe and winlogon
If its bound to explorer.exe it seems to clean itself up only if the scr file is in a directory with good user permissions. C:\windows (Apparently bad user context) vs C:\windows\system32 (Apparently good user context)
That said, killing the explorer process does not terminate the child process (even when killing gphotoshow explicitly or piped after the parent process is killed.
Though killing winlogon frees up the graphical environment. Probably because it forces log off of all users.
Very painful thing to troubleshoot. Figured I'd put my findings here in case there is an engineer that gets a random insight from this.
All drivers up to date, most current hotfix/cumulative for windows 24h2 has been installed as well. (KB5085516)
Checking background processes I can see gphotoshow still running. Trying to terminate it yields an error that it can't be terminated since it doesn't exist. Trying to terminate it along with parent processes yields error. There are 2 processes that gphotoshow is bound to. explorer.exe and winlogon
If its bound to explorer.exe it seems to clean itself up only if the scr file is in a directory with good user permissions. C:\windows (Apparently bad user context) vs C:\windows\system32 (Apparently good user context)
That said, killing the explorer process does not terminate the child process (even when killing gphotoshow explicitly or piped after the parent process is killed.
Though killing winlogon frees up the graphical environment. Probably because it forces log off of all users.
Very painful thing to troubleshoot. Figured I'd put my findings here in case there is an engineer that gets a random insight from this.
All drivers up to date, most current hotfix/cumulative for windows 24h2 has been installed as well. (KB5085516)