none
Blank screen after pressing CTRLALTDEL for login after Windows Updates. No way of logging in on Domain.

    Question

  • Hello all.

    After a bunch of Windows updates last night we are no able to log in a significant amount of computers, this also happens in safe mode where upon pressing control alt delete for login it turns to a blank screen with just a mouse cursor.

    Reading up on google, someone said it was a DCOM setting in Group policy, but they didn't say exactly what.

    It seems to have happened to a number of other schools in the area as well. Likely to be a Windows Update issue. Any ideas?

    Cheers!

    Wednesday, November 11, 2015 12:50 PM

Answers

  • I have narrowed down the CTRL+ALT+DEL issue to the On Screen keyboard. Disabling the onscreen keyboard INSTANTLY fixes it. 

    If you followed the directions above to enable remote registery, navigate to HKEY Local Machine / Software / Microsoft / Windows / CurrentVersion / Authentication / LogonUI and change "SowTabletKeyboard" to 0 from 1. It will instantly fix the issue. 

    I just created a Group policy object and pushed it out to every single machine. They are all fixed now after a morning of nightmares.

    Wednesday, November 11, 2015 8:15 PM
  • Here is what I did.  

    Seems like ts only touch screen computes. Need to RDP into the computer from another workstation on the LAN (I did from the server), navigated to installed updates and remove KB3097877

    If RDP isn’t enabled on the affected PC, then follow these steps

    Enable Remote Registry Service

    -      Must use a computer on the LAN to access services > right click on services (local) > connect to another computer … > search for computer > start Remote Registry Service

     

    Enable Remote Desktop

    -      Launch Regedit from run command > File > Connect Network Registry > [name of remote computer] > HKLM\System\CurrentControlSet\Control\Terminal Server – Double Click “fDenyTSConnections” and set DWord value from 1 to 0

     

    Remote Reboot Workstation

    -      Launch a command prompt and type: shutdown /m \\remote computer name] /r /t 00

     

    Wednesday, November 11, 2015 6:33 PM

All replies

  • Black Screens caused by updates are relatively easy to fix compared to most as there is still a lot of access available. There could be many reasons of black screens in which mostly is hardware.
    For updates caused events use the top methods below then Control Panel - Updates - on lower left
    Installed Updates - Uninstall the updates thought to be the cause. Or try a System Restore back
    to before the update occurred (remember it will update again so when it does Right Click on the
    trouble causing Update and HIDE).

    Control Panel - Windows Updates - lower left Installed Updates - Uninstall or Change


    Hope this link will be helpfull

    http://windows.microsoft.com/en-us/windows7/why-is-my-screen-black-when-i-start-windows-7



    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”



    Wednesday, November 11, 2015 1:02 PM
  • We cannot log in using safe mode or anything. We cant change anything, whatever changes we make has to be through Group policy,.
    Wednesday, November 11, 2015 1:20 PM
  • We are having the same problem... I have 5 reported computers that just get a black screen after hitting Ctrl+Alt+Del, we cant log them into the domain. I wont be surprised if more get reported with this issue. Its the second Tuesday of the month so that means Microsoft updates did get pushed out last night... I'm betting this was caused by an update but not 100% sure yet and I have no idea right now how to fix it.
    • Edited by dfertig Wednesday, November 11, 2015 2:35 PM
    Wednesday, November 11, 2015 2:34 PM
  • So... if the screen is black, you should go to control panel? 0_o
    Wednesday, November 11, 2015 2:41 PM
  • Can we have some more info on what is happening?

    How were these patches delivered, WSUS or auto updates?  64 bit or 32 bit OS? Do you just do security updates or allow ALL patches to install?

    Wednesday, November 11, 2015 2:42 PM
  • The computers that this has happened to in my domain are all Windows 7 64 bit that are configured to download and install all critical windows updates overnight. (I'll likely be looking into setting up WSUS after this) We have about 150 computers and only 5 have been reported so far with this problem, I know for a fact that a lot of computers were just shutdown over night so they are likely downloading updates this morning automatically. This sucks...
    Wednesday, November 11, 2015 2:52 PM
  • The computers that this has happened to in my domain are all Windows 7 64 bit that are configured to download and install all critical windows updates overnight. (I'll likely be looking into setting up WSUS after this) We have about 150 computers and only 5 have been reported so far with this problem, I know for a fact that a lot of computers were just shutdown over night so they are likely downloading updates this morning automatically. This sucks...
    very similar situation here, cause seems to be KB3097877
    Wednesday, November 11, 2015 2:54 PM
  • Same here!
    Wednesday, November 11, 2015 3:06 PM
  • It is not in the bulletin anymore??

    https://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx?f=255&MSPPError=-2147217396

    Wednesday, November 11, 2015 3:16 PM
  • MICROSOFT???  PLEASE OFFER A TRUE REPLY.  THIS IS HAPPENING EVERYWHERE AND PEOPLE CAN'T LOGIN TO THEIR UNITS ANYMORE.  KB3097877 IS THE ISSUE. 
    Wednesday, November 11, 2015 4:04 PM
  • I am not seeing the issue because we do not automatically install patches until after testing.  But if you know which patch is the problem you need to open a ticket with Microsoft, support for patches with issues is free.  They are unlikely to work on this just because of comments in a Forum.  The moderator should know how to get this done and that would probably be better advice than telling us to restore and block a patch.

    Wednesday, November 11, 2015 4:24 PM
  • We had this problem in our company (4000+ computers), but it seemed to only be with certain tablets.

    Look for the Microsoft Security Update KB3097877 and uninstall it and reboot and it should allow you to go to the login screen after hitting ctrl+alt+del.  This is what worked for us, after several of us picking different tablets and then each one of us picking a different update to install.  KB3097877 seemed to be the culprit.

    Good Luck !!

    Wednesday, November 11, 2015 5:25 PM
  • I havent been able to uninstall this with a bat file or cmd line, could you tell me how you did this?

    Wednesday, November 11, 2015 5:36 PM
  • wusa /uninstall /kb:3097877 /quiet /norestart
    Wednesday, November 11, 2015 5:37 PM
  • Is there a way to run that command if I cannot get to a dos prompt, cant get into safe mode safe mode with networking etc... 
    Wednesday, November 11, 2015 5:43 PM
  • try with pdq deploy
    Wednesday, November 11, 2015 6:12 PM
  • Doesnt work for me unfortunately, it uninstalls the KB, but still have an issue with CTRL ALT DEL
    Wednesday, November 11, 2015 6:13 PM
  • Is there a way to run that command if I cannot get to a dos prompt, cant get into safe mode safe mode with networking etc... 
    also you can remote into the machine
    Wednesday, November 11, 2015 6:24 PM
  • Here is what I did.  

    Seems like ts only touch screen computes. Need to RDP into the computer from another workstation on the LAN (I did from the server), navigated to installed updates and remove KB3097877

    If RDP isn’t enabled on the affected PC, then follow these steps

    Enable Remote Registry Service

    -      Must use a computer on the LAN to access services > right click on services (local) > connect to another computer … > search for computer > start Remote Registry Service

     

    Enable Remote Desktop

    -      Launch Regedit from run command > File > Connect Network Registry > [name of remote computer] > HKLM\System\CurrentControlSet\Control\Terminal Server – Double Click “fDenyTSConnections” and set DWord value from 1 to 0

     

    Remote Reboot Workstation

    -      Launch a command prompt and type: shutdown /m \\remote computer name] /r /t 00

     

    Wednesday, November 11, 2015 6:33 PM
  • Asomodai... I had luck w/ using MSTSC to remote connect to machine in issue.  It allows you to login remotely, and then I uninstalled using programs and features.  If you can RDP to it, that is probably easiest fix.
    Wednesday, November 11, 2015 6:47 PM
  • Good call Mike.  Same method worked for me.  I noticed the KB was going back into queue, I'm removing it from updates until I hear resolution from MSFT. 
    Wednesday, November 11, 2015 7:05 PM
  • I have narrowed down the CTRL+ALT+DEL issue to the On Screen keyboard. Disabling the onscreen keyboard INSTANTLY fixes it. 

    If you followed the directions above to enable remote registery, navigate to HKEY Local Machine / Software / Microsoft / Windows / CurrentVersion / Authentication / LogonUI and change "SowTabletKeyboard" to 0 from 1. It will instantly fix the issue. 

    I just created a Group policy object and pushed it out to every single machine. They are all fixed now after a morning of nightmares.

    Wednesday, November 11, 2015 8:15 PM
  • I have a .bat file which is different to all of the ones posted that actually worked for us that you need to deploy via GPO, but I am not a verified member so I cannot post it!

    It is indeed the KB we have been talking about.

    Wednesday, November 11, 2015 10:53 PM
  • can you tell more about the GPO solution ?

    Wednesday, November 11, 2015 11:58 PM
  • We fixed by cmd command remotely doing:

    wusa /uninstall /quiet /forcerestart /kb:3097877

    • Proposed as answer by N74JW Thursday, November 12, 2015 2:21 PM
    Thursday, November 12, 2015 10:43 AM
  • Could you please tell me how to run this on the remote systems if you cannot RDP to them? No Expert here.
    Thursday, November 12, 2015 1:45 PM
  • My school is having the same exact problem.  I've got several hundred devices of this same type.
    Thursday, November 12, 2015 1:49 PM
  • Microsoft is working on this.  The issue is the onscreen keyboard on the login screen.  disable the keyboard and you can then access the login screen.  once logged in, remove KB3097877.

    if you have the ability to disable 'touch' in BIOS, or disconnect touch if it is connected via USB, this may suppress the issue since the tablet keyboard wouldn't be needed on login.  if you can't do this, then the fixes are a temporary registry change, then a hotfix removal, then block the hotfix, and finally reset the registry key we changed.  Details are all below.

    Registry Key

    HKEY Local Machine / Software / Microsoft / Windows / CurrentVersion / Authentication / LogonUI and change "ShowTabletKeyboard" to 0 from 1. It will instantly fix the issue. 

    Way to use CMD to remove the MS hotfix once logged into windows:

    wusa /uninstall /quiet /forcerestart /kb:3097877

    IT Professional should be able to push these out all domained systems today.  Also they should block this hotfix from downloading again.  

    EDIT: If you are part of a company, get with your IT department, and they can help you.  If you are an individual, continue to email Microsoft about this issue.  If you have some tech savvy skills, you can correct this your self.  if you do not, you will want to get help from someone who will.  These fixes on a individual's computer will require a WinPE bootable key.  These can be made for free online.  There are several sites that can walk you through this.  I will try to research the best ones for the information and update later today.  I am working and dealing with this same problem.

    Again, I can't stress.  This needs to be escalated, and MS needs to hear from everyone who is affected by this.  if you don't complain, they won't know the true severity of this critical error they made.

    EDIT2:

    How to Make WinPE --> https://technet.microsoft.com/en-us/library/hh825109.aspx?f=255&MSPPError=-2147217396

    How to modify the registry offline(in winpe) -->http://smallvoid.com/article/winnt-offline-registry-edit.html

    We are writing a batch file that can run at startup on WinPE boot, that will do this automatically.  I will try to share the details of that file soon for those who need the fix.



    • Proposed as answer by C0rnfus3d Thursday, November 12, 2015 4:50 PM
    • Edited by C0rnfus3d Thursday, November 12, 2015 5:05 PM
    Thursday, November 12, 2015 3:29 PM
  • Ok, so what if you are in a situation where RDP is not enabled, remote access to the computer is not enabled, the local firewall blocks remote access to the computer, remote registry is not enabled?  You can't use  net use, PsEXEC, etc.  These are hardened systems where even us (IT) do  not remote in because we can simply go to the system if something needs to be done at it physically.  Are we basically SOL?  We can't be the only ones in this boat. The only way I can think of is a 3rd party tool to boot the system and allow edits to the registry (dangerous at best).  This is really bad.


    • Edited by Val-dar Thursday, November 12, 2015 3:55 PM
    Thursday, November 12, 2015 3:54 PM
  • I have a whole suite of 32-bit Win7 Pro machines where the screen flashes constantly instead of showing the logon screen. Someone has messed up BIG time with this.
    Thursday, November 12, 2015 4:32 PM
  • Ok, so what if you are in a situation where RDP is not enabled, remote access to the computer is not enabled, the local firewall blocks remote access to the computer, remote registry is not enabled?  


    You need to use WinPE, and then you can load the registry to disable the 'ShowTabletKeyboard' option from the LoginUI

    Then you can restart and login, remove the KB3097877, block it, and then re-enable the 'ShowTabletKeyboard'.

    EDIT:  See my post 2 spots above for details on how to make WinPE and modify the registry in 'offline' mode.
    • Edited by C0rnfus3d Thursday, November 12, 2015 4:44 PM
    • Proposed as answer by Val-dar Thursday, November 12, 2015 11:09 PM
    Thursday, November 12, 2015 4:42 PM
  • Have you all checked your systems to see if you are dealing with the patch that was published on the 10th or the one on the 11th? Looks like Microsoft expired the first one. I have ran some tests on both 32 bit and 64 bit machines with no issues.

    Jed

    Thursday, November 12, 2015 4:45 PM
  • I have narrowed down the CTRL+ALT+DEL issue to the On Screen keyboard. Disabling the onscreen keyboard INSTANTLY fixes it. 

    If you followed the directions above to enable remote registery, navigate to HKEY Local Machine / Software / Microsoft / Windows / CurrentVersion / Authentication / LogonUI and change "SowTabletKeyboard" to 0 from 1. It will instantly fix the issue. 

    I just created a Group policy object and pushed it out to every single machine. They are all fixed now after a morning of nightmares.

    This was perfect.  I got this from MS probably 20 minutes AFTER trying it when I seen it here.

    This lets you login, where you can remove the KB3097877 and then restart.  THen you can re-enable the 'ShowTabletKeyboard' in LoginUI.  For tablet PC users, this is a must to be enabled, otherwise your SOL trying to login if you dont have a USB KB/FPC/CAC.

    Thursday, November 12, 2015 4:49 PM
  • screen flashes constantly instead of showing the logon screen. 
    This is the same issue as above.  Uninstalling KB3097877 will fix it, however you will need to work around to do this.  Few posts above you can see details i posted on the registry key that needs to be disabled.  this is where the problem is at.  once that key is disabled you can login and remove the hotfix.  IT department should be able to push these changes to units across the network.  if not, the other option is a winpe bootable key with a script that will do that automatically.  you would then need to boot to each unit using this key.
    Thursday, November 12, 2015 4:51 PM
  • Black Screens caused by updates are relatively easy to fix 

    THis is comical.  This fix IS NOT EASY to repair.  users can't boot to safemode.  Can't login.  Can't remove the KB3097877.  This was a HUGE GIANT MISTAKE by Microsoft.  OEM's, Business's, Schools, Home users are ALL affected if they have a W7 unit with a touch controller attached (via embedded or usb).  Only reason MS is not even more on top of this issue is because the precious surface is not affected because it runs W8/W10!

    I think this post needs to be deleted because it is totally irrelevant to the issue.

    Thursday, November 12, 2015 4:55 PM
  • Hello all.

    After a bunch of Windows updates last night we are no able to log in a significant amount of computers, this also happens in safe mode where upon pressing control alt delete for login it turns to a blank screen with just a mouse cursor.

    Reading up on google, someone said it was a DCOM setting in Group policy, but they didn't say exactly what.

    It seems to have happened to a number of other schools in the area as well. Likely to be a Windows Update issue. Any ideas?

    Cheers!

    Responding directly to the original post to bring this visibility to the top for others.

    Microsoft is working on this.  The issue is the onscreen keyboard on the login screen.  disable the keyboard and you can then access the login screen.  once logged in, remove KB3097877.

    if you have the ability to disable 'touch' in BIOS, or disconnect touch if it is connected via USB, this may suppress the issue since the tablet keyboard wouldn't be needed on login.  if you can't do this, then the fixes are a temporary registry change, then a hotfix removal, then block the hotfix, and finally reset the registry key we changed.  Details are all below.

    Registry Key

    HKEY Local Machine / Software / Microsoft / Windows / CurrentVersion / Authentication / LogonUI and change "ShowTabletKeyboard" to 0 from 1. It will instantly fix the issue. 

    Way to use CMD to remove the MS hotfix once logged into windows:

    wusa /uninstall /quiet /forcerestart /kb:3097877

    IT Professional should be able to push these out all domained systems today.  Also they should block this hotfix from downloading again.  

    If you are part of a company, get with your IT department, and they can help you.  If you are an individual, continue to email Microsoft about this issue.  If you have some tech savvy skills, you can correct this your self.  if you do not, you will want to get help from someone who will.  These fixes on a individual's computer will require a WinPE bootable key.  These can be made for free online.  There are several sites that can walk you through this.  I will try to research the best ones for the information and update later today.  I am working and dealing with this same problem.

    Again, I can't stress.  This needs to be escalated, and MS needs to hear from everyone who is affected by this.  if you don't complain, they won't know the true severity of this critical error they made.

    How to Make WinPE --> https://technet.microsoft.com/en-us/library/hh825109.aspx?f=255&MSPPError=-2147217396

    How to modify the registry offline(in winpe) -->http://smallvoid.com/article/winnt-offline-registry-edit.html

    I'm writing a batch file that can run at startup on WinPE boot, that will do this automatically.  I will try to share the details of that file soon for those who need the fix.


    • Edited by C0rnfus3d Thursday, November 12, 2015 4:59 PM
    • Proposed as answer by C0rnfus3d Thursday, November 12, 2015 4:59 PM
    Thursday, November 12, 2015 4:57 PM
  • Can anyone confirm that the new KB3097877 resolves this problem?

    Thursday, November 12, 2015 8:16 PM
  • Microsoft I am not amoused.

    Why do you not test an update being deployed to million workstations worldwide?

    Who pays me and my time?

    What is the solution??????????

    Angry :-(



    Thursday, November 12, 2015 8:53 PM
  • Can anyone confirm that the new KB3097877 resolves this problem?

    Yes, the one rereleased today did fix the issue on one of our exchange customers.



    The two files patched in this update are win32k.sys in \windows\system32 and gdiplus.dll in c:\windows\syswow64 - note that gdiplus.dll did not exist in c:\windows\syswow64 before this patch existed. Also copying win32k.sys from a pc without these updates will not correct the issue.




    I have narrowed down the CTRL+ALT+DEL issue to the On Screen keyboard. Disabling the onscreen keyboard INSTANTLY fixes it. If you followed the directions above to enable remote registery, navigate to HKEY Local Machine / Software / Microsoft / Windows / CurrentVersion / Authentication / LogonUI and change "SowTabletKeyboard" to 0 from 1. It will instantly fix the issue. I just created a Group policy object and pushed it out to every single machine. They are all fixed now after a morning of nightmares.
    Could someone confirm that GPO changes are applied before pressing ctrl-alt-del?


    Thursday, November 12, 2015 9:35 PM
  • Ah, of course! I didn't even think of that. I do have WinPE disks from when I sysprepped moving to new systems from XP. I will give that a shot, thanks!

    Val

    Thursday, November 12, 2015 11:09 PM
  • A user at infoworld (davebaum) here has been able to RDP into his computers and remove the update, when the keyboard wasn't responsive:

    http://www.infoworld.com/article/3004441/microsoft-windows/microsoft-surreptitiously-reissues-botched-patch-kb-3097877-for-windows-7.html

    A user over here had his display driver corrupted from this update and had to reinstall it, but apparently he is referring to some other update:

    http://www.myce.com/news/another-flawed-windows-7-update-prevents-users-from-logging-in-crashes-all-outlook-versions-77781/



    Thursday, November 12, 2015 11:30 PM
  • It is definitely KB3097877. If you have onscreen keyboard your computer got "infected".

    There is an article on MS site as well: https://support.microsoft.com/en-us/kb/3097877

    Solved four of my computers with the last method.

    Monday, November 16, 2015 2:34 PM
  • Tried new patch worked for one day then outlook crashed again. Have uninstalled the patch and on the 17th it was back. Direct download link gives the old patch. Affecting several users that use outlook 2013 on window 7 PC,s. Its a nightmare as this is in a school that relies on the functionality of outlook. Doesn't seem to affect office 365 email
    Monday, January 18, 2016 5:38 PM