I have a Windows 2008 Server that I have been connecting to once a month remotely to apply OS updates.  Often, I reboot that server and it uses auto-logon to login and run an application. 

Today, I rebooted the server and when I try to connect with RDP, I get the login prompt and enter my credentials, I see a few expected messages fly by on the host OS (the last one I see is the word Welcome), but then the screen goes black.

The apps on the server are running successfully because our applications can connect to them, we just can't logon to the desktop of the Windows Server 2008.

I made no configuration changes (I NEVER do) other than to apply the latest Windows Server updates.

I would prefer not to drive to the computers location, or try to coordinate a time to have the server hosting company assist me with troubleshooting; but is there anything else I can do?  Any ideas about what might cause this?

Hi,

According to the description, I would like to confirm the following questions so that we can provide the exact suggestion:

1.       Do all clients encounter this issue, such as Windows XP and 7?

2.       Do all users encounter the same issue when logging on to the RDS server?

3.       Have you found any related event log when this issue happens?

4.       Have you tried to disable all firewalls to test whether this issue exist?

Thanks.

I'm sorry, I didn't have an email address assigned after the recent change in the Microsoft message boards so I did not receive notification of this reply.

This problem also occurred logging directly onto the server.  So it was not an RDP problem.  When we logged on at the physical server, the screen went black after the welcome message displayed.  However, the mouse cursor was still visible and functional.  We had no option at that point except to perform a hard reboot.  When the server rebooted, everything worked normally.

Hi Rob,

Thanks for your update.

Can you any new driver for the firmware of server? Also please try to run a clean boot to isolate any device drivers or programs that are loading at startup that may be causing a conflict.

Thanks.

I have the same problem. My system is windows server2008 enterprise without hyper-v, run as a guest OS on top of HYPER-V, I send ctrl+alt+del get to login screen, after I login as administrator, I get black screen except the mouse point on the screen, I can login as other account get normal screen, only administrator's account has this problem. After I rebooted the guest OS, problem dissappeared, I can login as administrator and get normal screen by using RDP. But after a two weeks today this problem is coming back again. There is no change to the system, don't know what is cauing the problem and how to prevent?

Thanks.

Edward Hua

Thanks for this Rob.  We are using SBS 2011 Standard.  RDP using a Windows 7 Pro client.  Worked like a charm. 

Login Screen -> Credentials -> Welcome message -> Black Screen -> Ctrl-Alt-End, then Cancel -> Screen is back

Not too concerned because no services are failing according to the logs. Just a small flaw.  But, in any event, it occurs in SBS 2011 as well.  

-Michael

• Proposed as answer by Sheshnath Yadaw Friday, January 06, 2012 1:54 PM
• Unproposed as answer by Rob Kraft Monday, February 02, 2015 5:41 PM

Thanks for this Rob.  We are using SBS 2011 Standard.  RDP using a Windows 7 Pro client.  Worked like a charm. 

Login Screen -> Credentials -> Welcome message -> Black Screen -> Ctrl-Alt-End, then Cancel -> Screen is back

Not too concerned because no services are failing according to the logs. Just a small flaw.  But, in any event, it occurs in SBS 2011 as well.  

-Michael

• Proposed as answer by Sheshnath Yadaw Friday, January 06, 2012 1:54 PM
• Unproposed as answer by Rob Kraft Monday, February 02, 2015 5:41 PM

Thanks for this Rob.  We are using SBS 2011 Standard.  RDP using a Windows 7 Pro client.  Worked like a charm. 

Login Screen -> Credentials -> Welcome message -> Black Screen -> Ctrl-Alt-End, then Cancel -> Screen is back

Not too concerned because no services are failing according to the logs. Just a small flaw.  But, in any event, it occurs in SBS 2011 as well.  

-Michael

• Proposed as answer by Sheshnath Yadaw Friday, January 06, 2012 1:54 PM
• Unproposed as answer by Rob Kraft Monday, February 02, 2015 5:41 PM

Thanks Rob!

I had to finish some important stuff from home and the connection stayed blank after receiving the "Welcome" message - Ctrl-Alt-End did the trick!

Now I can finish the upgrade, my boss will be happy tomorrow and I'll fetch some beer :)

cheerz,

MC

Hello all,

I am having the same issue - only CTRL-ALT-END doesn't do anything for me. CTRL-ALT-DEL only lets me open task manager on my client computer, not in the remote session - this is even when choosing the "Apply Windows key combinations" to be "On the remote computer".

I'm running Windows 7, with dual screen (I've tried telling it to use only one monitor) - but I seem to be ok to remote in using my wifes username and password. It is only my own.

When I press buttons (such as CTRL ALT DEL/END) I can hear a sound like the "Default Beep" sound in windows.

Tried a lot of things. I do feel like it sits on the "Welcome" message for far longer than it normally does.

As per another thread I found on the same issue, I tried connecting with a smaller resolution to reset the bitmap cache (as per support.microsoft.com/kb/555840).

In the same thread someone posted they had the problem occur because they left a game on their client computer in full-screen mode. I had a game open, tried closing that but no luck.

I notice I have some updates pending install, will try installing those and restarting.

*Update: Restart didn't work. Update was only a security update for Silverlight. Am now updating graphics drivers but I doubt this will work because as mentioned above I can log in fine using my wifes username/password. I may need to remote in with hers and restart the server.

• Edited by DanPritch Friday, May 11, 2012 11:06 AM

Hello all,

I am having the same issue - only CTRL-ALT-END doesn't do anything for me. CTRL-ALT-DEL only lets me open task manager on my client computer, not in the remote session - this is even when choosing the "Apply Windows key combinations" to be "On the remote computer".

I'm running Windows 7, with dual screen (I've tried telling it to use only one monitor) - but I seem to be ok to remote in using my wifes username and password. It is only my own.

When I press buttons (such as CTRL ALT DEL/END) I can hear a sound like the "Default Beep" sound in windows.

Tried a lot of things. I do feel like it sits on the "Welcome" message for far longer than it normally does.

As per another thread I found on the same issue, I tried connecting with a smaller resolution to reset the bitmap cache (as per support.microsoft.com/kb/555840).

In the same thread someone posted they had the problem occur because they left a game on their client computer in full-screen mode. I had a game open, tried closing that but no luck.

I notice I have some updates pending install, will try installing those and restarting.

*Update: Restart didn't work. Update was only a security update for Silverlight. Am now updating graphics drivers but I doubt this will work because as mentioned above I can log in fine using my wifes username/password. I may need to remote in with hers and restart the server.

• Edited by DanPritch Friday, May 11, 2012 11:06 AM

Hello all,

I am having the same issue - only CTRL-ALT-END doesn't do anything for me. CTRL-ALT-DEL only lets me open task manager on my client computer, not in the remote session - this is even when choosing the "Apply Windows key combinations" to be "On the remote computer".

I'm running Windows 7, with dual screen (I've tried telling it to use only one monitor) - but I seem to be ok to remote in using my wifes username and password. It is only my own.

When I press buttons (such as CTRL ALT DEL/END) I can hear a sound like the "Default Beep" sound in windows.

Tried a lot of things. I do feel like it sits on the "Welcome" message for far longer than it normally does.

As per another thread I found on the same issue, I tried connecting with a smaller resolution to reset the bitmap cache (as per support.microsoft.com/kb/555840).

In the same thread someone posted they had the problem occur because they left a game on their client computer in full-screen mode. I had a game open, tried closing that but no luck.

I notice I have some updates pending install, will try installing those and restarting.

*Update: Restart didn't work. Update was only a security update for Silverlight. Am now updating graphics drivers but I doubt this will work because as mentioned above I can log in fine using my wifes username/password. I may need to remote in with hers and restart the server.

• Edited by DanPritch Friday, May 11, 2012 11:06 AM

Well I had this problem now a couple of times in the last week or two.

Nothing specific running on the 2008 R2 server, I just disconnected and reconnected a couple of minutes later and I saw login was successful but then I got the black screen. Always had to restart the server remotely via shutdown /m \\server /r command.

Just found this topic here with the CTRL+ALT+END trick and will it try next time but I also use an Android RDP client which does not support such keyscombination.

I guess that this bug was caused by the patchday before the last one because it happened the first time for me two weeks ago and never had such a problem - also didnt change anything in the system or on the hardware.

I found only this in the logs (german) 

Protokollname: Application
Quelle:        Desktop Window Manager
Datum:         11.05.2012 18:00:47
Ereignis-ID:   9009
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:Klassisch
Benutzer:      Nicht zutreffend
Computer:      Epyon
Beschreibung:
Der Desktopfenster-Manager wurde mit dem Code (0x40010004) abgebrochen.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Desktop Window Manager" />
    <EventID Qualifiers="16384">9009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:47.000000000Z" />
    <EventRecordID>13069</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x40010004</Data>
  </EventData>
</Event>

Desktop manager has been aborted.

Protokollname: Application
Quelle:        Microsoft-Windows-User Profiles Service
Datum:         11.05.2012 18:00:48
Ereignis-ID:   1530
Aufgabenkategorie:Keine
Ebene:         Warnung
Schlsselwrter:
Benutzer:      SYSTEM
Computer:      Epyon
Beschreibung:
Es wurde festgestellt, dass Ihre Registrierungsdatei noch von anderen Anwendungen oder Diensten verwendet wird. Die Datei wird nun entladen. Die Anwendungen oder Dienste, die Ihre Registrierungsdatei anhalten, funktionieren anschlieend u. U. nicht mehr ordnungsgem.  

 DETAIL - 
 5 user registry handles leaked from \Registry\User\S-1-5-21-408648707-2363534474-3651942527-500:
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1530</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:48.515625000Z" />
    <EventRecordID>13070</EventRecordID>
    <Correlation ActivityID="{01D03A58-F800-0003-85C0-37DFD32ECD01}" />
    <Execution ProcessID="908" ThreadID="1104" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="EVENT_HIVE_LEAK">
    <Data Name="Detail">5 user registry handles leaked from \Registry\User\S-1-5-21-408648707-2363534474-3651942527-500:
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
</Data>
  </EventData>
</Event>

Protokollname: Application
Quelle:        Microsoft-Windows-User Profiles Service
Datum:         11.05.2012 18:00:50
Ereignis-ID:   1532
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:
Benutzer:      SYSTEM
Computer:      Epyon
Beschreibung:
Das Benutzerprofil wurde angehalten  


Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1532</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:50.691406200Z" />
    <EventRecordID>13071</EventRecordID>
    <Correlation />
    <Execution ProcessID="908" ThreadID="932" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Profile has been stopped!

Protokollname: Application
Quelle:        Microsoft-Windows-Winsrv
Datum:         11.05.2012 18:00:46
Ereignis-ID:   10002
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:
Benutzer:      EPYON\Administrator
Computer:      Epyon
Beschreibung:
Die folgende Anwendung wurde beendet, weil sie nicht reagiert hat: explorer.exe.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winsrv" Guid="{9D55B53D-449B-4824-A637-24F9D69AA02F}" />
    <EventID>10002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:46.789062500Z" />
    <EventRecordID>13068</EventRecordID>
    <Correlation />
    <Execution ProcessID="688" ThreadID="2392" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-21-408648707-2363534474-3651942527-500" />
  </System>
  <UserData>
    <HungAppEvent xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/winsrv">
      <AppName>explorer.exe</AppName>
    </HungAppEvent>
  </UserData>
</Event>

Force close of explorer.exe

Client is Windows 7 64bit SP1 latest Windows updates

Server is 2008 R2 SP1 also latest updates

Bug happened first time about 2 weeks ago. Same bug on Android RDP client and Windows 7 client.

I sometimes use hibernation on the client without closing the rdp connection, maybe that could have some impact after automatic reconnecting?

Can I help with anything else?

• Edited by Janus83 Friday, May 11, 2012 5:16 PM

Well I had this problem now a couple of times in the last week or two.

Nothing specific running on the 2008 R2 server, I just disconnected and reconnected a couple of minutes later and I saw login was successful but then I got the black screen. Always had to restart the server remotely via shutdown /m \\server /r command.

Just found this topic here with the CTRL+ALT+END trick and will it try next time but I also use an Android RDP client which does not support such keyscombination.

I guess that this bug was caused by the patchday before the last one because it happened the first time for me two weeks ago and never had such a problem - also didnt change anything in the system or on the hardware.

I found only this in the logs (german) 

Protokollname: Application
Quelle:        Desktop Window Manager
Datum:         11.05.2012 18:00:47
Ereignis-ID:   9009
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:Klassisch
Benutzer:      Nicht zutreffend
Computer:      Epyon
Beschreibung:
Der Desktopfenster-Manager wurde mit dem Code (0x40010004) abgebrochen.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Desktop Window Manager" />
    <EventID Qualifiers="16384">9009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:47.000000000Z" />
    <EventRecordID>13069</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x40010004</Data>
  </EventData>
</Event>

Desktop manager has been aborted.

Protokollname: Application
Quelle:        Microsoft-Windows-User Profiles Service
Datum:         11.05.2012 18:00:48
Ereignis-ID:   1530
Aufgabenkategorie:Keine
Ebene:         Warnung
Schlsselwrter:
Benutzer:      SYSTEM
Computer:      Epyon
Beschreibung:
Es wurde festgestellt, dass Ihre Registrierungsdatei noch von anderen Anwendungen oder Diensten verwendet wird. Die Datei wird nun entladen. Die Anwendungen oder Dienste, die Ihre Registrierungsdatei anhalten, funktionieren anschlieend u. U. nicht mehr ordnungsgem.  

 DETAIL - 
 5 user registry handles leaked from \Registry\User\S-1-5-21-408648707-2363534474-3651942527-500:
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1530</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:48.515625000Z" />
    <EventRecordID>13070</EventRecordID>
    <Correlation ActivityID="{01D03A58-F800-0003-85C0-37DFD32ECD01}" />
    <Execution ProcessID="908" ThreadID="1104" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="EVENT_HIVE_LEAK">
    <Data Name="Detail">5 user registry handles leaked from \Registry\User\S-1-5-21-408648707-2363534474-3651942527-500:
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
</Data>
  </EventData>
</Event>

Protokollname: Application
Quelle:        Microsoft-Windows-User Profiles Service
Datum:         11.05.2012 18:00:50
Ereignis-ID:   1532
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:
Benutzer:      SYSTEM
Computer:      Epyon
Beschreibung:
Das Benutzerprofil wurde angehalten  


Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1532</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:50.691406200Z" />
    <EventRecordID>13071</EventRecordID>
    <Correlation />
    <Execution ProcessID="908" ThreadID="932" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Profile has been stopped!

Protokollname: Application
Quelle:        Microsoft-Windows-Winsrv
Datum:         11.05.2012 18:00:46
Ereignis-ID:   10002
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:
Benutzer:      EPYON\Administrator
Computer:      Epyon
Beschreibung:
Die folgende Anwendung wurde beendet, weil sie nicht reagiert hat: explorer.exe.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winsrv" Guid="{9D55B53D-449B-4824-A637-24F9D69AA02F}" />
    <EventID>10002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:46.789062500Z" />
    <EventRecordID>13068</EventRecordID>
    <Correlation />
    <Execution ProcessID="688" ThreadID="2392" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-21-408648707-2363534474-3651942527-500" />
  </System>
  <UserData>
    <HungAppEvent xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/winsrv">
      <AppName>explorer.exe</AppName>
    </HungAppEvent>
  </UserData>
</Event>

Force close of explorer.exe

Client is Windows 7 64bit SP1 latest Windows updates

Server is 2008 R2 SP1 also latest updates

Bug happened first time about 2 weeks ago. Same bug on Android RDP client and Windows 7 client.

I sometimes use hibernation on the client without closing the rdp connection, maybe that could have some impact after automatic reconnecting?

Can I help with anything else?

• Edited by Janus83 Friday, May 11, 2012 5:16 PM

Well I had this problem now a couple of times in the last week or two.

Nothing specific running on the 2008 R2 server, I just disconnected and reconnected a couple of minutes later and I saw login was successful but then I got the black screen. Always had to restart the server remotely via shutdown /m \\server /r command.

Just found this topic here with the CTRL+ALT+END trick and will it try next time but I also use an Android RDP client which does not support such keyscombination.

I guess that this bug was caused by the patchday before the last one because it happened the first time for me two weeks ago and never had such a problem - also didnt change anything in the system or on the hardware.

I found only this in the logs (german) 

Protokollname: Application
Quelle:        Desktop Window Manager
Datum:         11.05.2012 18:00:47
Ereignis-ID:   9009
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:Klassisch
Benutzer:      Nicht zutreffend
Computer:      Epyon
Beschreibung:
Der Desktopfenster-Manager wurde mit dem Code (0x40010004) abgebrochen.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Desktop Window Manager" />
    <EventID Qualifiers="16384">9009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:47.000000000Z" />
    <EventRecordID>13069</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x40010004</Data>
  </EventData>
</Event>

Desktop manager has been aborted.

Protokollname: Application
Quelle:        Microsoft-Windows-User Profiles Service
Datum:         11.05.2012 18:00:48
Ereignis-ID:   1530
Aufgabenkategorie:Keine
Ebene:         Warnung
Schlsselwrter:
Benutzer:      SYSTEM
Computer:      Epyon
Beschreibung:
Es wurde festgestellt, dass Ihre Registrierungsdatei noch von anderen Anwendungen oder Diensten verwendet wird. Die Datei wird nun entladen. Die Anwendungen oder Dienste, die Ihre Registrierungsdatei anhalten, funktionieren anschlieend u. U. nicht mehr ordnungsgem.  

 DETAIL - 
 5 user registry handles leaked from \Registry\User\S-1-5-21-408648707-2363534474-3651942527-500:
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1530</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:48.515625000Z" />
    <EventRecordID>13070</EventRecordID>
    <Correlation ActivityID="{01D03A58-F800-0003-85C0-37DFD32ECD01}" />
    <Execution ProcessID="908" ThreadID="1104" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="EVENT_HIVE_LEAK">
    <Data Name="Detail">5 user registry handles leaked from \Registry\User\S-1-5-21-408648707-2363534474-3651942527-500:
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2320 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1660 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-408648707-2363534474-3651942527-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings
</Data>
  </EventData>
</Event>

Protokollname: Application
Quelle:        Microsoft-Windows-User Profiles Service
Datum:         11.05.2012 18:00:50
Ereignis-ID:   1532
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:
Benutzer:      SYSTEM
Computer:      Epyon
Beschreibung:
Das Benutzerprofil wurde angehalten  


Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1532</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:50.691406200Z" />
    <EventRecordID>13071</EventRecordID>
    <Correlation />
    <Execution ProcessID="908" ThreadID="932" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Profile has been stopped!

Protokollname: Application
Quelle:        Microsoft-Windows-Winsrv
Datum:         11.05.2012 18:00:46
Ereignis-ID:   10002
Aufgabenkategorie:Keine
Ebene:         Informationen
Schlsselwrter:
Benutzer:      EPYON\Administrator
Computer:      Epyon
Beschreibung:
Die folgende Anwendung wurde beendet, weil sie nicht reagiert hat: explorer.exe.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winsrv" Guid="{9D55B53D-449B-4824-A637-24F9D69AA02F}" />
    <EventID>10002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-11T16:00:46.789062500Z" />
    <EventRecordID>13068</EventRecordID>
    <Correlation />
    <Execution ProcessID="688" ThreadID="2392" />
    <Channel>Application</Channel>
    <Computer>Epyon</Computer>
    <Security UserID="S-1-5-21-408648707-2363534474-3651942527-500" />
  </System>
  <UserData>
    <HungAppEvent xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/winsrv">
      <AppName>explorer.exe</AppName>
    </HungAppEvent>
  </UserData>
</Event>

Force close of explorer.exe

Client is Windows 7 64bit SP1 latest Windows updates

Server is 2008 R2 SP1 also latest updates

Bug happened first time about 2 weeks ago. Same bug on Android RDP client and Windows 7 client.

I sometimes use hibernation on the client without closing the rdp connection, maybe that could have some impact after automatic reconnecting?

Can I help with anything else?

• Edited by Janus83 Friday, May 11, 2012 5:16 PM

Works like a charm, unless you're running an RDP inside another RDP.... then you're screwed. Nice one MS!

Hello

Same problem with a new installation of SBS 2011 (based on SRV 2008/R2) with every client I try to connect.

The problem is not specifiable in detail. 70% of time, the logon works normal.

I found another solution that works in our case:
Each time when we were inactive, the screensaver came after 10 minutes -> one keystroke or a mouse movement, and after the password input the desktop was here.
It works also, when we set the screensaver to reactivation without password. So we set the timeout to one minute and no password for reactivation.

That helps for the moment.

On Win7 conecting to XP Pro SP3 allowed enter user and password as normal then black screen.

Tried changing screen resolution of rdp connection back down to 1024x768 and connected fine

Changed back to full screen and back to black screen. 

So try changing rdp connection screen resolution 

Same problem and resolution here.

Windows 7 client RDP-ing into Windows 2008 server.  Sometimes I get a black screen.

Make sure you are in full screen mode and press Ctrl-Alt-End.

You should get the screen that allows you to lock, logoff, etc.

Press Cancel and everything is back to normal!

Thanks!

Is it just me, or is the 'solution' not just a work around? It seems to me that there is a problem that has no solution. Thanks though for the work around, it does the trick but leaves the bug/error/problem as it is; a nuisance...

Hope that MS has a real solution or maybe it is in an update. the hardware that I connect to is an HP ProBook 6570b Windows 7 Pro latest updates by MS in place.

Thanks Rob. Worked for me. 

Ran into this problem twice in the last week. Your solution worked like a charm. 

• Proposed as answer by DDeng Thursday, August 22, 2013 9:50 AM

• Proposed as answer by DDeng Thursday, August 22, 2013 9:50 AM

• Proposed as answer by DDeng Thursday, August 22, 2013 9:50 AM

• Proposed as answer by B.Stromberg Tuesday, September 10, 2013 10:32 AM
• Unproposed as answer by B.Stromberg Tuesday, September 10, 2013 10:32 AM

• Proposed as answer by B.Stromberg Tuesday, September 10, 2013 10:32 AM
• Unproposed as answer by B.Stromberg Tuesday, September 10, 2013 10:32 AM

• Proposed as answer by B.Stromberg Tuesday, September 10, 2013 10:32 AM
• Unproposed as answer by B.Stromberg Tuesday, September 10, 2013 10:32 AM

Found the (permanent) solution (for me) after 3 hours: Add the "Authenticated Users" and "Interactive Logon" to the local "Users" group and reboot. If the machine is a DC, do the same in the builtin\users Group - aaaand the screen is back wihtout black. Fixed all my Black-Logon-Machiens instantly.

The bug sits somewhere between the twintoken acquirement and the uac-prompt; the interactive logon is able to take the twintoken but cannot display the uac-warning that it is doing so. Twintoken ... what a faceplam-idea. If I got $1 for every uac/twintoken/runas/runasfoo problem I've seen, I would buy the windows division. Twice.

<small>Thanks to the guys from ugg.li and Marc for putting it up as KB at http://support.microsoft.com/kb/970879</small>

• Proposed as answer by B.Stromberg Tuesday, September 10, 2013 10:43 AM

Found the (permanent) solution (for me) after 3 hours: Add the "Authenticated Users" and "Interactive Logon" to the local "Users" group and reboot. If the machine is a DC, do the same in the builtin\users Group - aaaand the screen is back wihtout black. Fixed all my Black-Logon-Machiens instantly.

The bug sits somewhere between the twintoken acquirement and the uac-prompt; the interactive logon is able to take the twintoken but cannot display the uac-warning that it is doing so. Twintoken ... what a faceplam-idea. If I got $1 for every uac/twintoken/runas/runasfoo problem I've seen, I would buy the windows division. Twice.

<small>Thanks to the guys from ugg.li and Marc for putting it up as KB at http://support.microsoft.com/kb/970879</small>

• Proposed as answer by B.Stromberg Tuesday, September 10, 2013 10:43 AM

Found the (permanent) solution (for me) after 3 hours: Add the "Authenticated Users" and "Interactive Logon" to the local "Users" group and reboot. If the machine is a DC, do the same in the builtin\users Group - aaaand the screen is back wihtout black. Fixed all my Black-Logon-Machiens instantly.

The bug sits somewhere between the twintoken acquirement and the uac-prompt; the interactive logon is able to take the twintoken but cannot display the uac-warning that it is doing so. Twintoken ... what a faceplam-idea. If I got $1 for every uac/twintoken/runas/runasfoo problem I've seen, I would buy the windows division. Twice.

<small>Thanks to the guys from ugg.li and Marc for putting it up as KB at http://support.microsoft.com/kb/970879</small>

• Proposed as answer by B.Stromberg Tuesday, September 10, 2013 10:43 AM

I am also getting a blank black screen after successful login to the rdc.

Whereas,other users are properly able to connect to it.Only my screen blacks out.Whereas,till sometime back I was able to connect to it and the screen didn't go black.But,after sometime when I again logged in to the rdc this issue came up.Can someone please help?

What could be the possible reason of this?

Any help will be appreciated?

• Proposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:22 PM
• Unproposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:22 PM

• Proposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:22 PM
• Unproposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:22 PM

• Proposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:22 PM
• Unproposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:22 PM

KB970879 was not helpful.  The local Users group already had the Interactive and Authenticated Users account, and the problem still occurs.  The problem seemed to start happening after installing Microsoft Office Professional Plus 2013 on my Windows 7 system.

Previously, when this problem occurred with Office 2003, I simply installed KB2661332 and the problem went away, but that hotfix doesn't seem to work with this version.

http://support.microsoft.com/kb/2661332/en-us

• Proposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:21 PM
• Unproposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:21 PM

KB970879 was not helpful.  The local Users group already had the Interactive and Authenticated Users account, and the problem still occurs.  The problem seemed to start happening after installing Microsoft Office Professional Plus 2013 on my Windows 7 system.

Previously, when this problem occurred with Office 2003, I simply installed KB2661332 and the problem went away, but that hotfix doesn't seem to work with this version.

http://support.microsoft.com/kb/2661332/en-us

• Proposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:21 PM
• Unproposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:21 PM

KB970879 was not helpful.  The local Users group already had the Interactive and Authenticated Users account, and the problem still occurs.  The problem seemed to start happening after installing Microsoft Office Professional Plus 2013 on my Windows 7 system.

Previously, when this problem occurred with Office 2003, I simply installed KB2661332 and the problem went away, but that hotfix doesn't seem to work with this version.

http://support.microsoft.com/kb/2661332/en-us

• Proposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:21 PM
• Unproposed as answer by Milan Pavasovic Saturday, November 16, 2013 9:21 PM

Hello world:)

VPN connection and than rdp to local ip solved this problem for me.

I have simple setup. Windows 2008 R2 SP1 Standard. Server has DC, DNS, DHCP, File & Print, NPS & Acces services running.

When I try to RDP connect from away location, i get prompted for my credentials and after successful login i sometimes see remote interface for some short time and in majority of times i get BLACK screen immediately.

I tried updates and hotfixses suggested on forums online but nothing worked for me.

Also CTRL+ALT+END does nothing for me.

Only solution for the moment is this VPN bypass. No preoblems when i connect to VPN first and than rdp to 192.168.100.2 which is lan IP of my server.

Hope someone finds real solution for this, Milan:)

I am having the same problem and have yet to find a permanent solution.  Here is the setup:

Multiple Win 7 clients, fully patched

Windows 2008 R2 Server with RDP enabled (no RD-session or terminal services licensing), fully patched

RDP connection over public IP w/ non-standard RDP port

I have found a temporary (band-aide) fix for the issue.  If I log in via standard RPD session (start > mstsc) and I receive the black screen I switch to RDP admin session (start > mstsc /admin) and the screen comes up.  If I had most recently used RDP admin session I switch back to standard RDP session and the screen comes up.  Still very annoying since I have to switch back and forth between the two session types.  Hope this helps those who the ctrl + alt + end command doesn't work for.

I am also experimenting with disabling bitmap caching on the client connection by opening the RDP connection with notepad and adding the following below value.  I haven't verified that this works 100% of the time.

bitmapcachepersistenable:i:0

• Edited by mnispel Saturday, November 23, 2013 8:00 PM

I am having the same problem and have yet to find a permanent solution.  Here is the setup:

Multiple Win 7 clients, fully patched

Windows 2008 R2 Server with RDP enabled (no RD-session or terminal services licensing), fully patched

RDP connection over public IP w/ non-standard RDP port

I have found a temporary (band-aide) fix for the issue.  If I log in via standard RPD session (start > mstsc) and I receive the black screen I switch to RDP admin session (start > mstsc /admin) and the screen comes up.  If I had most recently used RDP admin session I switch back to standard RDP session and the screen comes up.  Still very annoying since I have to switch back and forth between the two session types.  Hope this helps those who the ctrl + alt + end command doesn't work for.

I am also experimenting with disabling bitmap caching on the client connection by opening the RDP connection with notepad and adding the following below value.  I haven't verified that this works 100% of the time.

bitmapcachepersistenable:i:0

• Edited by mnispel Saturday, November 23, 2013 8:00 PM

I am having the same problem and have yet to find a permanent solution.  Here is the setup:

Multiple Win 7 clients, fully patched

Windows 2008 R2 Server with RDP enabled (no RD-session or terminal services licensing), fully patched

RDP connection over public IP w/ non-standard RDP port

I have found a temporary (band-aide) fix for the issue.  If I log in via standard RPD session (start > mstsc) and I receive the black screen I switch to RDP admin session (start > mstsc /admin) and the screen comes up.  If I had most recently used RDP admin session I switch back to standard RDP session and the screen comes up.  Still very annoying since I have to switch back and forth between the two session types.  Hope this helps those who the ctrl + alt + end command doesn't work for.

I am also experimenting with disabling bitmap caching on the client connection by opening the RDP connection with notepad and adding the following below value.  I haven't verified that this works 100% of the time.

bitmapcachepersistenable:i:0

• Edited by mnispel Saturday, November 23, 2013 8:00 PM

I had the same issue - RDP to another RDP gave me black screen.

Enable sending all key combinations to the RDP session on the machine from where you are connecting to the target machine.

Inside target machine press CTRL+SHIFT+Esc and that would pop up Task Manager.

Click New Task and type "explorer.exe", hit Enter and there you go!

Hi,

 

According to the description, I would like to confirm the following questions so that we can provide the exact suggestion:

 

1.       Do all clients encounter this issue, such as Windows XP and 7?

 

2.       Do all users encounter the same issue when logging on to the RDS server?

 

3.       Have you found any related event log when this issue happens?

 

4.       Have you tried to disable all firewalls to test whether this issue exist?

 

Hi, I'm also experiencing the same issue (black screen on rdp connections), but with more issues:

1. Black screen appears when i have an active rdp connection to remote Win7 64bit SP1 PC (over LAN) AFTER i have minimized FULL_SCREEN RDP session window, wait 3-5-10 seconds (the longer - the better to reproduce) and restore the window - it's black. Pressing Ctrl-Alt-End brings
"Windows security" screen, hitting esc and get desktop back.

2. If I change from full window to none-full, I'm getting "previous bitmap" screen, not actual, so Ctrl-Alt-End is the only way to resolve - again.

3. Issue observed on hi-end video cards (both ATI and NVidia) with latest drivers on host (PC with session on, not client), with Intel GMA everything is ok. So I suppose there are problems with bitmap caching (turning it off on client doesn't help).

The issue is observed under following rdp client settings:

Remote Desktop Connection
Shell Version 6.3.9600
Control Version 6.3.9600
Network Level Authentication supported.
Remote Desktop Protocol 8.1 supported.

Update: changing color depth to 24bit (or less) in rdp file solves the problem, but this is a partial (unwanted) solution.

Update2: this issue is due to (now suspended by Microsoft) update 2830477: Update for RemoteApp and Desktop Connections feature is available for Windows. Here is more info: Remote Desktop Services Blog.Uninstalling this update resolves all issues. Can be done in WSUS by declining this update.

As commented by MS in blog:

IMPORTANT:

Update on November 18, 2013: We received feedback from some of you that with the RDP 8.1 update package installed, some users are unable to use their redirected smart cards in remote sessions. We have temporarily removed the update package from Windows Update and the Download Center while we investigate the problem and update the package with a fix if necessary.  Well post an update on this blog as soon as we have a timeline for republishing the update package.

• Edited by D F Saturday, January 18, 2014 11:09 AM

Hi,

 

According to the description, I would like to confirm the following questions so that we can provide the exact suggestion:

 

1.       Do all clients encounter this issue, such as Windows XP and 7?

 

2.       Do all users encounter the same issue when logging on to the RDS server?

 

3.       Have you found any related event log when this issue happens?

 

4.       Have you tried to disable all firewalls to test whether this issue exist?

 

Hi, I'm also experiencing the same issue (black screen on rdp connections), but with more issues:

1. Black screen appears when i have an active rdp connection to remote Win7 64bit SP1 PC (over LAN) AFTER i have minimized FULL_SCREEN RDP session window, wait 3-5-10 seconds (the longer - the better to reproduce) and restore the window - it's black. Pressing Ctrl-Alt-End brings
"Windows security" screen, hitting esc and get desktop back.

2. If I change from full window to none-full, I'm getting "previous bitmap" screen, not actual, so Ctrl-Alt-End is the only way to resolve - again.

3. Issue observed on hi-end video cards (both ATI and NVidia) with latest drivers on host (PC with session on, not client), with Intel GMA everything is ok. So I suppose there are problems with bitmap caching (turning it off on client doesn't help).

The issue is observed under following rdp client settings:

Remote Desktop Connection
Shell Version 6.3.9600
Control Version 6.3.9600
Network Level Authentication supported.
Remote Desktop Protocol 8.1 supported.

Update: changing color depth to 24bit (or less) in rdp file solves the problem, but this is a partial (unwanted) solution.

Update2: this issue is due to (now suspended by Microsoft) update 2830477: Update for RemoteApp and Desktop Connections feature is available for Windows. Here is more info: Remote Desktop Services Blog.Uninstalling this update resolves all issues. Can be done in WSUS by declining this update.

As commented by MS in blog:

IMPORTANT:

Update on November 18, 2013: We received feedback from some of you that with the RDP 8.1 update package installed, some users are unable to use their redirected smart cards in remote sessions. We have temporarily removed the update package from Windows Update and the Download Center while we investigate the problem and update the package with a fix if necessary.  Well post an update on this blog as soon as we have a timeline for republishing the update package.

• Edited by D F Saturday, January 18, 2014 11:09 AM

Hi,

 

According to the description, I would like to confirm the following questions so that we can provide the exact suggestion:

 

1.       Do all clients encounter this issue, such as Windows XP and 7?

 

2.       Do all users encounter the same issue when logging on to the RDS server?

 

3.       Have you found any related event log when this issue happens?

 

4.       Have you tried to disable all firewalls to test whether this issue exist?

 

Hi, I'm also experiencing the same issue (black screen on rdp connections), but with more issues:

1. Black screen appears when i have an active rdp connection to remote Win7 64bit SP1 PC (over LAN) AFTER i have minimized FULL_SCREEN RDP session window, wait 3-5-10 seconds (the longer - the better to reproduce) and restore the window - it's black. Pressing Ctrl-Alt-End brings
"Windows security" screen, hitting esc and get desktop back.

2. If I change from full window to none-full, I'm getting "previous bitmap" screen, not actual, so Ctrl-Alt-End is the only way to resolve - again.

3. Issue observed on hi-end video cards (both ATI and NVidia) with latest drivers on host (PC with session on, not client), with Intel GMA everything is ok. So I suppose there are problems with bitmap caching (turning it off on client doesn't help).

The issue is observed under following rdp client settings:

Remote Desktop Connection
Shell Version 6.3.9600
Control Version 6.3.9600
Network Level Authentication supported.
Remote Desktop Protocol 8.1 supported.

Update: changing color depth to 24bit (or less) in rdp file solves the problem, but this is a partial (unwanted) solution.

Update2: this issue is due to (now suspended by Microsoft) update 2830477: Update for RemoteApp and Desktop Connections feature is available for Windows. Here is more info: Remote Desktop Services Blog.Uninstalling this update resolves all issues. Can be done in WSUS by declining this update.

As commented by MS in blog:

IMPORTANT:

Update on November 18, 2013: We received feedback from some of you that with the RDP 8.1 update package installed, some users are unable to use their redirected smart cards in remote sessions. We have temporarily removed the update package from Windows Update and the Download Center while we investigate the problem and update the package with a fix if necessary.  Well post an update on this blog as soon as we have a timeline for republishing the update package.

• Edited by D F Saturday, January 18, 2014 11:09 AM

This simple (yet so elegant) work around made my day. :)

Thank you.

• Edited by Paurav Gandhi Thursday, January 16, 2014 9:44 AM

• Edited by Paurav Gandhi Thursday, January 16, 2014 9:44 AM

• Edited by Paurav Gandhi Thursday, January 16, 2014 9:44 AM

Am having the same problem also with my VDI deployment.  After logging in through the gateway when I get redirected to my VM it'll give me a black screen.  If I sit and wait about 90 seconds it eventually comes up.  That part that bothers me is that it wasn't doing this when I first set it up.

Does this sound like the same issue or something unrelated with similar symptoms?

This solution does not work for me. I have 2 terminal 2008 r2 patched. But the kb2830477 is not on both systems.

De solution Rob explained also does not work. I s till have black screens and a user who is logging in and the keyboard goes crazy.

Rdp connection is adapted to everything is told here. but still no solution.

Ik installed a complete new terminal and again same issue.

Al 3 systems are virtual  (esx5.1)

I still think this is a bug.

I tried this found on MS KB (which one i forgot...) and it works for me only that the aero theme is disabled the rest looks much better (vdo viewing and other experiences)

=======

To enable RDP 8.0 on a remote computer that's running Windows 7 SP1, follow these steps:

Note The following instructions are applicable only to remote computers that are running Windows 7 SP1. 1.Install the appropriate version of the update package by running the Windows6.1-KB2592687 update file.
2.Restart the computer.
3.Open the Local Group Policy Editor. gpedit.msc
4. Enable the Remote Desktop Protocol policy. The setting for this policy is under the following node:
Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment

5. If the UDP functionality is required, enable the RDP Transport policy, and then set the value to Use both TCP and UDP. The setting for
the RDP Transport policy is under the following node:
Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections
Note Configuring the RDP Transport policy also lets the firewall allow UDP port 3389.
6.Restart the computer.

hope this helps for those who just installed ALL updates from windows update site... :)

I just had an RDP session that worked fine when I was in the office, but was black when I got home.  Closing the connection and reconnecting didn't help.  Sometimes when I tried to connect, I would get disconnected with a protocol error.

I was able to connect to other existing sessions on the machine, and start new sessions as new users (I have access to 4 different accounts on that machine between domain and local), but that one session would stay black no matter what I did.  Now I'm in the office, so I logged on via the console, and got the same thing.  I tried Ctrl+Alt+End, and it displayed the screen via RDP but not via the console, cancelling didn't help.

Finally, I connected as a local admin, and killed dwm.exe and explorer.exe for that session.  I then reconnected, and the screen came back.  I also found that there was a "Restart Now" dialog from Windows Update open on the desktop.  The session was as a non-admin, and UAC is enabled on the machine, so maybe there was a bad interaction with a UAC dialog and RDP while the connection was inactive.

Windows 7 x64 Ultimate connecting to Windows Server 2008.

I have the same problem when I was connecting to one of our servers using RDP, then suddenly it went black, as in PLAIN BLACK after the "Welcome" message.

I tried the CTRL+ALT+END and it worked!

Thanks a lot! :)

• Edited by Van Balmizar Thursday, April 03, 2014 7:26 AM

I have the same problem when I was connecting to one of our servers using RDP, then suddenly it went black, as in PLAIN BLACK after the "Welcome" message.

I tried the CTRL+ALT+END and it worked!

Thanks a lot! :)

• Edited by Van Balmizar Thursday, April 03, 2014 7:26 AM

I have the same problem when I was connecting to one of our servers using RDP, then suddenly it went black, as in PLAIN BLACK after the "Welcome" message.

I tried the CTRL+ALT+END and it worked!

Thanks a lot! :)

• Edited by Van Balmizar Thursday, April 03, 2014 7:26 AM

Hello every one,

i was facing the same issue, after login to my remote Server (Windows Server 2003) I was getting a black screen and no other screens are visible. After applying the given settings as in above figure 2 i.e. Experience tab, I got my Desktop visible.

Thanks...100% working....

• Edited by Sudhanshu Shekhar MCA Wednesday, April 09, 2014 9:11 PM

Hello every one,

i was facing the same issue, after login to my remote Server (Windows Server 2003) I was getting a black screen and no other screens are visible. After applying the given settings as in above figure 2 i.e. Experience tab, I got my Desktop visible.

Thanks...100% working....

• Edited by Sudhanshu Shekhar MCA Wednesday, April 09, 2014 9:11 PM

Hello every one,

i was facing the same issue, after login to my remote Server (Windows Server 2003) I was getting a black screen and no other screens are visible. After applying the given settings as in above figure 2 i.e. Experience tab, I got my Desktop visible.

Thanks...100% working....

• Edited by Sudhanshu Shekhar MCA Wednesday, April 09, 2014 9:11 PM

Hey..!! I had the same issue with my server 2008 Remote log in. then i tried the above mentioned solution...It worked out........!!!!!!!!!!!!!!!!!111

Thanks....!!!!!!!! for sharing the tread here.....

You are a life saver Rob !! Thanks. Saved me from going to work since I was getting black screen whenever I RDP'd from home to my work PC

Cheers

Just type  CTRL+ALT+END, no CTRL+ALT+DEL.

Be

• Edited by zeboalfgang Monday, September 15, 2014 2:15 PM

• Edited by zeboalfgang Monday, September 15, 2014 2:15 PM

• Edited by zeboalfgang Monday, September 15, 2014 2:15 PM

Hello,

CTRL-ALT-END not working.

this solution works on Windows7 SP1 client / W2008 R2 STD server RDP :

gpedit.msc

Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections
activate BOTH TCP AND UDP !

 .Restart the computer.

thanks a lot !

Rob:

More than 3 years later and this is what I needed to find! Thanks so much.

Richard

My case is, on Windows Server 2012 R2, after installing FileZilla Server, MyPC Backup and WSE_Vosteran was brought in as unwanted, black screen appeared when remote connected to it. By using Ctrl_Alt_End, I was able  to terminate the running processes one-by-one, when it came to "Run Once Wrapper", boom, the remote desktop was shown. After removing those unwanted, reboot, "Run One Wrapper" disappeared from Task Manager, and remote connection was back on working charmingly!

• Edited by NickWink Tuesday, January 27, 2015 5:25 PM

My case is, on Windows Server 2012 R2, after installing FileZilla Server, MyPC Backup and WSE_Vosteran was brought in as unwanted, black screen appeared when remote connected to it. By using Ctrl_Alt_End, I was able  to terminate the running processes one-by-one, when it came to "Run Once Wrapper", boom, the remote desktop was shown. After removing those unwanted, reboot, "Run One Wrapper" disappeared from Task Manager, and remote connection was back on working charmingly!

• Edited by NickWink Tuesday, January 27, 2015 5:25 PM

My case is, on Windows Server 2012 R2, after installing FileZilla Server, MyPC Backup and WSE_Vosteran was brought in as unwanted, black screen appeared when remote connected to it. By using Ctrl_Alt_End, I was able  to terminate the running processes one-by-one, when it came to "Run Once Wrapper", boom, the remote desktop was shown. After removing those unwanted, reboot, "Run One Wrapper" disappeared from Task Manager, and remote connection was back on working charmingly!

• Edited by NickWink Tuesday, January 27, 2015 5:25 PM

Rob,

Thanks for your tip. I tried it and it worked perfectly. You're a genius.

Thanks once again

Islam Ejaz

Thanks Rob!   CTRL-ALT-END was the trick!

Rita V.

Thanks Rob

That works like a charm!

Jay

Yes its working thanks Rob....

• Edited by SunilIGX 3 hours 29 minutes ago

Yes its working thanks Rob....

• Edited by SunilIGX Thursday, July 23, 2015 3:32 AM

Yes its working thanks Rob....

• Edited by SunilIGX Thursday, July 23, 2015 3:32 AM

• Proposed as answer by vishal shindekar Tuesday, August 04, 2015 7:38 AM